AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
Choose a transaction PIN that has nothing to do with you: not your birthday, phone number, year of birth, house number or a pattern such as 1234 or 1111. Use different PINs for your card, your banking app and USSD, never write them down near your phone or card, and never tell anyone, including people who say they are from your bank. Change it at once if you think someone has seen it.
What a transaction PIN does
A transaction PIN is the code you enter to approve a payment or transfer. It is separate from the password or fingerprint you use to open an app, and separate from your card PIN, although many people set them the same. It is there so that someone who gets into your app, or picks up your phone while it is open, still cannot move money.
It only works if it is secret and hard to guess. Most PIN failures in Nigeria are not technical: someone guessed it, watched it being typed, found it written down, or was told it by the owner.
How to choose a strong PIN
| Avoid | Why |
|---|---|
| Your birthday or birth year (e.g. 1990, 0412) | Your date of birth is on social media, ID cards and forms |
| Last four digits of your phone number | Anyone who has your number has your PIN |
| Repeated or sequential digits (1111, 1234, 2580) | These are the first ones tried |
| Your children's birthdays or your anniversary | Easy to find out |
| The same PIN for every card, app and USSD | One leak opens everything |
| A PIN you have told a friend or relative before | Assume it is no longer secret |
A better approach: pick digits from something only you know that leaves no trace, such as a combination of numbers that have private meaning, and avoid anything that appears in your documents. If your bank allows six digits, use six.
Change any default PIN a bank or network gave you, such as 0000, the day you receive it. Fraudsters know the common defaults and try them first on stolen cards, SIMs and phones.
Where never to type or store it
- Never into a website or form you reached from a link in a message.
- Never on a call, a WhatsApp chat or social media, whatever reason you are given.
- Never on a POS terminal held out of your sight, or by an operator who offers to type it for you.
- Never in your phone's notes, photos, contacts or chats, even disguised as a phone number.
- Never on paper in your wallet, purse or phone case.
- Never type it in public without covering the keypad or screen.
The same care applies to your BVN, NIN and date of birth, which fraudsters combine with a PIN to pass as you. See is it safe to share your BVN.
Shoulder surfing in traffic and at the till
Thieves who plan to snatch a phone sometimes watch the owner type their PIN first. At ATMs and POS terminals, an accomplice may stand close or film. Shield the screen or keypad with your hand every time, even when you feel safe.
Signs your PIN may be known
- You see transactions you did not make, even small ones; fraudsters sometimes test with a small amount first.
- You get a message that your PIN was changed or that there were failed attempts.
- Someone you shared your phone or card with knows things about your balance they should not.
- You typed your PIN on a page or terminal that later seemed suspicious.
If any of these apply, change your PIN in the app or at your bank straight away, from a device you trust. If money has gone, follow our first-hour fraud plan.
Worked example
Example only. Musa's card PIN, app PIN and USSD PIN were all 1985, his birth year, which is on his Facebook profile. His wallet is stolen with his card inside. Within an hour, ₦70,000 is withdrawn at an ATM. Because he used the same PIN everywhere, he also has to worry about his app and USSD. After blocking everything and reporting, he sets three different six-digit PINs, none linked to dates in his life. A month later, a phishing text asks for his PIN to 'reactivate' his account; he ignores it, because he now knows nobody legitimate needs it.
Family, staff and shared phones
Sharing a PIN with a spouse, a child or a shop assistant so they can pay for things is common, and it is one of the main ways PINs leak. It also weakens your position if something goes wrong: under the CBN's draft guidelines on authorised push payment fraud, a customer found to have been negligent may not qualify for a refund. If someone needs to pay on your behalf, look for safer options, such as a separate account or card for them, a business account with its own approvals, or a request you approve yourself. See will your bank refund you after fraud.
For the code you get when signing in, see authenticator app vs SMS codes; for USSD, see USSD banking fraud.
Where Pryme fits
Every payment from a Pryme account needs your transaction PIN, alongside an authenticator app rather than SMS codes. Pryme will never ask you for your PIN. For businesses, Pryme's agents prepare payments and a person approves above a set ceiling, so staff do not need the owner's PIN to get work done. Read more on security.
Questions people ask
What is a good transaction PIN?
One with no link to your birthday, phone number, address or family dates, and not a pattern like 1234 or 1111. Use six digits if your bank allows it.
Should my card PIN and app PIN be the same?
No. Use different PINs so one leak does not open everything.
Can my bank ask for my transaction PIN?
No. Your bank will never need your PIN to help you. Anyone asking is a fraudster.
How do I change my transaction PIN?
Usually in your banking app's security settings, or at an ATM for a card PIN. Do it from a device you trust.
Sources
- CBN: Exposure draft of the Guidelines for Handling Authorised Push Payment Fraud · accessed Oct 2026
- CBN: Consumer Protection, how to lodge a complaint · accessed Oct 2026
- CISA: Guidance on phishing-resistant and number-matching MFA · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.