To add an extra layer of security to your payments, SuperPay now uses two-factor authentication (2FA) at the moment money leaves your account. Alongside your password and browser session (the first factor), you confirm the payment with a 6-digit OTP shown only inside the Alaan mobile app (the second factor), a device that's registered to you and locked behind your biometrics.
This means a web session on its own is no longer enough to release funds. Even if someone gained access to your Alaan account on the web, they could not move money without your phone in hand. It's the same protection major banks apply to corporate payment release.
The in-app OTP replaces the passcode step you used to see on Approve & Pay.
Why an in-app OTP, and not SMS or email
OTPs sent over SMS or email travel outside Alaan and can be intercepted before they reach you through SIM swaps, forwarded messages or a compromised inbox. An in-app OTP never leaves the Alaan app: it's delivered encrypted, revealed only after you re-authenticate on your own device, and screenshots are blocked while it's on screen. Even the push notification carries no OTP and no payment details, so an intercepted notification is worthless on its own.
When you'll be asked for an OTP
Two-factor authentication applies at payment release, not while a bill is being prepared.
Action | Requires an in-app OTP? |
Releasing a payment via Approve & Pay | Yes |
Creating, editing or approving a bill | No |
Adding or editing a recipient | No |
Note: Only final approvers permission to release payments are asked for an OTP, since they are the ones authorising money to leave the account.
How to confirm a payment with an OTP
In the web app, select the payments you want to pay and confirm Approve & Pay. The web app then waits on a verification screen.
A push notification arrives on the phone where you're logged in to the Alaan mobile app.
Tap the notification and verify with Face ID, Touch ID or your app passcode. This is the step that proves it's you.
The app shows a summary of the payment (or batch) and reveals the 6-digit OTP with a countdown.
Enter the OTP on the web app. Only then is the payment released to the bank.
💡 Tip: Didn't receive the push? Open the Alaan mobile app and check your notifications (bell icon) - pending OTP requests are listed there, so a missed or muted notification never leaves you stuck. If nothing appears at all, update your app to the latest version.
FAQ
Q: Do I need the Alaan mobile app to release payments?
Yes. The OTP is only shown inside the app, so it needs to be installed and logged in on your phone before you can release a payment. If you haven't logged in on mobile yet, the web app will tell you at the OTP step. Turning push notifications off doesn't block you — the OTP request is still waiting in the app's notifications — but having no registered device at all does.
Q: The OTP expired before I could use it.
Start the payment again from the web app to request a new OTP. Each OTP is tied to one specific payment request, which is what stops an old OTP being reused on a different payment.
Q: I entered the wrong OTP.
You get 3 attempts. After that the request is closed and you'll need to start the payment again. Repeated wrong passcode attempts inside the mobile app will pause your account as a precaution.
Q: I received an OTP request for a payment I didn't start.
Tap "I didn't start this" in the app. This cancels the payment, signs you out of active sessions and prompts you to reset your password. Please also email us so we can investigate.
Q: Can two people release the same payment at the same time?
No. A payment can only have one active OTP request at a time, so anyone attempting the same payment in parallel will be told it's already being verified.
Q: Does this replace approvals?
No. Approvals decide whether a bill should be paid; the OTP confirms that the person releasing the approved payment is genuinely them. Both steps still apply.
Need assistance? Please drop us an email on [email protected]
Related Articles