Phishing exists because money does. Verify it's really us before you click, log in, or share anything.

‍

1. Official Ontop domains

All Ontop sites and apps live under getontop.com. Anything else, isn't us.

• getontop.com → Main website
• app.getontop.com → Product app

• *.getontop.com → Verified subdomains

If a URL doesn't end in .getontop.com, it isn't Ontop. Don't continue.

‍

2. Official Ontop emails

Every real Ontop email comes from an address ending in @getontop.com. No exceptions.

Lookalike domains like getontops.com, get0ntop.com, or ontop-support.com are not us, no matter how the message is signed or styled.

Verification codes may also arrive through SMS or WhatsApp from official Ontop channels. We'll never send them through unverified numbers or ask you to forward them to anyone.

‍

3. What we'll never ask for

Through messages, calls, or unofficial sites, Ontop will never ask you for any of these:

• ✕ Your password
• ✕ Your full card number or CVV
• ✕ One-time codes outside the Ontop app
• ✕ Remote access to your device
• ✕ Any other sensitive account credential

If anyone asks for these claiming to be from Ontop, they're not from Ontop.

‍

4. Spot something off?

Step 1: Don't click.

‍Step 2: Don't reply.

‍Step 3: Don't share.

Forward the suspicious message or a screenshot to support@getontop.com and we'll investigate.

If you already shared something you shouldn't have, contact us right away so we can secure your account.

‍

5. The 10-second check

Before you act on any Ontop email, link, or message, confirm three things:

1. The sender's domain ends in @getontop.com
2. The URL ends in .getontop.com
3. No one is asking for credentials or codes outside the app

Three out of three? Safe to continue.One miss? Stop.