Trust Center

Phishing is one of the most common methods that fraudsters use to gain unauthorized access to online accounts. It involves tricking people into divulging sensitive information, such as login credentials.

Phishing attacks are becoming more sophisticated and difficult to identify. These best practices will help to prevent your Airwallex account from being compromised by a phishing attack.

Be cautious of any message that creates urgency and asks you to share sensitive information. Airwallex will never contact you directly by email, SMS or phone to ask for your full password, PIN or one-time passcodes (OTPs). We may send security alerts, product updates and service messages, but we will not ask you to reply with your password, full card details or 2FA codes. 

To help confirm an email is from Airwallex, check the full sender address and make sure its domain matches one of the authorized domains in our email-verification guide. Do not click links or open attachments if you are unsure. Instead, access your account by typing airwallex.com into your browser or using the official Airwallex app. Only enter an OTP if you initiated the login on the official Airwallex site, and do not use unexpected OTPs.

If you receive a suspicious message or think your account may be at risk, do not reply or interact with the message. Contact us through in-app support or our official support channels. 

For more steps to secure your account, see our account takeover prevention guide.

Following the disclosure of critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), the Airwallex Security team  reviewed our systems to identify any potentially affected services. Because Airwallex does not generally use PHP across our core platform, web applications, or APIs, no Airwallex production services were impacted or required patching.

Customer Action

- Airwallex Platform and API Customers: No action is needed on your part.
- Self-Hosted Payment Plugin Customers: If you self-host an Airwallex payment acceptance plugin on your own commerce platform (such as WooCommerce, PrestaShop, or Magento), the PHP runtime operates within your own hosting environment. We recommend updating your PHP installation to the latest patched release in accordance with official PHP security advisories if you have not already done so.

If you have any additional questions, please reach out to your Airwallex representative or contact our support team.

Airwallex is proud to announce the successful renewal of our Payment Card Industry Data Security Standard (PCI DSS) Service Provider Level 1 certification. Completing this thorough certification process underlines our strong commitment to ensuring the highest levels of security and data protection for our customers. This achievement demonstrates our dedication to safeguarding sensitive payment card information and maintaining the trust of our clients and partners.

The Airwallex PCI-DSS Level 1 Certificate is available for public download here and registered accounts may access the full Attestation of Compliance via the private access portal.

To find out more about PCI DSS please visit the PCI Security Standards Council

Airwallex is committed to building a strong relationship with the information security community. In order to reward the best external contributions that help us keep our users safe, we maintain a Bug Bounty Program for Airwallex owned web properties.
Starting from 13/07/2021 the Airwallex Bug Bounty Program is invite only. Issues submitted to bugbounty@airwallex.com will be handled based on priority.

Services in scope

Any Airwallex owned web service that handles reasonably sensitive user data is intended to be in scope. This includes virtually all the content in the *.airwallex.com domain.

Qualifying vulnerabilities

Any design or implementation issue that substantially affects the confidentiality or integrity of user data is likely to be in scope for the program. The program is limited to technical vulnerabilities in Airwallex owned / used web applications.
Please do not attempt to carry out DoS or DDoS attacks, social engineering, spamming or do other similarly questionable things.

For more information please visit Airwallex Bug Bounty Program