Security

Logging in gets you into the app. It doesn't let you move money. That's a second, deliberate step.

The transaction PIN

Every action that moves money, a member requesting a withdrawal, a leader crediting income, requires a transaction PIN entered at the moment of the action. It's set once, separately from the account password, and it's asked for every single time, not just on the first transaction of a session.

If a member hasn't set one yet, the PIN dialog offers to set it up inline instead of dead-ending with an error. Nobody has to hunt through settings to find where PINs get configured before they can do the thing they came to do.

Wrong PIN

Get it wrong and the wallet says so, plainly, without turning it into a security incident. The message doesn't leak which part of the PIN was wrong or how many attempts remain in a way that would help someone guessing. The dialog stays open so a genuine mistake, a fat-fingered digit, doesn't cost a full re-navigation back to the action.

Receipts as a second check

Withdrawal payouts get verified against the receipt uploaded for them; amount, recipient, and date all have to line up. A PIN proves the request came from the right person. The receipt check proves the money actually moved the way the request said it would. Neither one substitutes for the other.