Keeping your account secure
Learn how the Affirm Security team works to protect your information and what you can do to keep your account secure.
We use safeguards such as access controls, encryption, data handling practices, and internal security processes to help protect sensitive information from unauthorized access, misuse, or unnecessary exposure.
We maintain processes to identify, evaluate, and address security vulnerabilities based on risk. Findings are handled through remediation, mitigation, or documented risk review.
We maintain security monitoring, alerting, and incident response processes to help identify, investigate, contain, and respond to potential security events.
Report suspicious activity
If you notice unusual or suspicious activity, report it right away. We’ll review your report, secure your account if needed, and contact you through official Affirm channels if we need more information or have next steps to share.
Report activityWhere scams happen
Scammers may reach out in different ways, but their goal is usually the same—to get your information or money. Affirm will never ask for your password, PIN, or a one-time code.
Email
Scam emails look real, but they often have grammatical errors, are sent from suspicious accounts, and use fake links. Don’t click any links or attachments. Instead, check your account in the Affirm app.
Phone calls
Scam callers may pretend to be Affirm and ask for one-time codes, login details, or personal information. If a spammer calls you, hang up and contact Affirm using the phone number listed on our website.
Text messages
Scam texts often pressure you to act quickly, come from unknown numbers, or include shortened or suspicious links. Don’t reply or click any links. Instead, check your account in the Affirm app.
Social media
Scammers may pose as Affirm or someone you trust to gain your personal information. Don't engage with unknown accounts or share personal details over social media.
Protect your Affirm account
Incident response
We maintain an incident response program designed to identify, contain, and remediate security incidents. Our process includes established response procedures, cross-functional collaboration, root cause analysis, and customer communication.
If an incident impacts your personal information, we’ll notify you in accordance with legal and regulatory requirements.
Transparency and accountability
We follow applicable laws and regulations to protect your information. Independent third parties review part of our security program.
If you find a security vulnerability, report your findings through our bug bounty platform. We review and investigate all concerns.
If an incident affects your information, we'll contact you in accordance with applicable legal and regulatory requirements.
