AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
Most transfer app takeovers start somewhere else: a hacked email account used to reset the password, a SIM swap that diverts text codes, or a fake support agent who talks you into reading out a code. Protect the email first with 2-step verification, use an authenticator app or passkey rather than SMS where the app allows, set a transaction PIN, keep the app's notifications on, and never share a code with anyone who contacts you.
Once someone controls your remittance app, they can add a new recipient in Nigeria and send your balance or card-funded transfers within minutes. Funds paid out to a Nigerian account are hard to recover. Prevention matters more here than with almost any other app.
How takeovers happen
- Email first. The UK's National Cyber Security Centre (NCSC) says criminals with access to your inbox can use it to reset passwords on your other accounts. Your transfer app is one of them.
- SIM swap. If codes go by text, a criminal who persuades your network to move your number to a new SIM receives them. This is a known risk for Nigerian numbers kept active abroad; MTN Nigeria's own page describes proxy SIM swaps for customers abroad using affidavits and ID, which shows how much depends on documents. See the Nigeria library guide on SIM swap fraud.
- Fake support. A call or chat from "the app's security team" asking you to read out a code "to block a suspicious payment".
- Reused passwords. A password leaked from another site is tried on transfer apps.
- Changed details. The FBI's IC3 notes that email compromise often begins with social engineering or intrusion, and advises two-factor authentication and a second channel to confirm any request to change account details.
- Phishing pages. Covered in texts saying your transfer failed.
The settings that stop them
- Lock down your email. Turn on 2-step verification (2SV) on the email linked to the app. The NCSC recommends 2SV on your important accounts and says you should use it for email.
- Choose the strongest second step offered. The NCSC says text messages are not the most secure type of 2SV, though any 2SV is better than none, and names authenticator apps as the main alternative. Some apps also offer passkeys; Kuda's help centre, for example, lists passkeys among its security settings. Use them where available.
- Store backup codes safely. The NCSC notes backup codes work once each and should be kept somewhere safe.
- Set a transaction PIN different from the passcode on your phone, and do not write it in your notes app.
- Use a unique password for the app and for the email behind it.
- Keep notifications on for logins, new devices, new recipients and payments.
- Review devices. Remove old phones from the app's logged-in devices list.
Recovery details are part of security
Check the email address and phone number the app holds for you. If either is an old address you no longer read, or a number you have let lapse, a password reset may go somewhere you cannot see. Update them from inside the app, and make sure the recovery options on your email account are current too.
If you live abroad with a Nigerian SIM
Many senders keep a Nigerian number for bank alerts and BVN-linked services. If your transfer app or Nigerian bank still sends codes to it by text, that number is a weak point. Move the app's second step to an authenticator or passkey, keep the Nigerian SIM somewhere safe, and know how to reach your network to block it. For changing the number on a Nigerian bank account from abroad, see this guide.
Warning signs and what to do
| Sign | Do this |
|---|---|
| Password reset email you did not request | Change your email password and check its recovery settings |
| Phone suddenly shows "No service" | Call your network from another phone; ask whether a SIM swap was made |
| Login alert from a new device | Use the app's help to freeze the account and change your password |
| New recipient you did not add | Freeze the account, call your card issuer, report to the provider |
The FTC's identity theft guidance gives a practical order for the first hour: call the fraud departments of the companies involved, close or freeze affected accounts and change logins, then report it.
Worked example
Example only. Kunle in London gets a login alert from a device in another city at 2am. He opens the app, freezes his account from the help section and changes his password. His email shows a password reset he did not request: someone had his old email password from a leak. He changes it, turns on 2SV with an authenticator app and removes unknown devices. No money left, because a payment would also have needed his transaction PIN.
If money did leave, follow recovering money paid to a fraudster's Nigerian account.
Where Pryme fits
Pryme security uses an authenticator app rather than SMS codes, and every payment needs your transaction PIN. Pryme will never ask you for a code or your PIN. The Personal Assistant can prepare a payment, but nothing moves without your approval.
Questions people ask
How do hackers get into money transfer apps?
Usually through the email account behind them, a SIM swap that diverts text codes, a reused password, or a fake support call asking for a code.
Is SMS verification safe enough?
The NCSC says text messages are not the most secure kind of 2-step verification. Use an authenticator app or passkey where offered.
Someone asked me for a code to secure my account. Is that normal?
No. Do not share it. Real providers do not ask you to read out codes.
What should I do first if my app account is hacked?
Freeze the account through the app's help, change your email and app passwords, call your card issuer and report it to the provider.
Sources
- NCSC: Setting up 2-Step Verification (reviewed Jan 2022) · accessed Oct 2026
- FBI IC3: Business email compromise · accessed Oct 2026
- MTN Nigeria: SIM swap · accessed Oct 2026
- Kuda Help Centre: Security · accessed Oct 2026
- FTC: Identity theft, what to do right away · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.