# Security Testing for Fintech Apps

AgentProof tests fintech apps for wrong-account transfers, changed amounts, double payments and skipped approvals, then fixes them.

Fintech apps move money and show balances. AgentProof checks that no user can send, see or change money that is not theirs, and fixes your code when one can.

## The Attack Agent tries to move money in ways your app should refuse.

- **WRONG ACCOUNT** Can a user send a transfer from an account that belongs to someone else?
- **AMOUNTS** Can a user change the amount after it was approved, or send a negative amount?
- **REPEATS** Does sending the same payment request twice pay it out twice?
- **APPROVALS** Can a payment that needs a second approval go through with only one?
- **STATEMENTS** Can a user download another customer's statement by changing a number in the link?
- **LIMITS** Can a user get around a daily transfer limit by splitting one payment into many small ones?

For each problem, the report shows **the request that was sent and what your app did with it**.

## An example: sending one payment request twice paid it out twice.

Example finding: A repeated transfer request is paid twice

```
REQUEST
POST /api/transfers, sent twice
Same request ID, same moment

RESPONSE
201 Created, 201 Created
Two transfers of $500 made

FIX
- await db.transfers.insert(input);
+ // request_id has a unique index, so a repeat fails
+ await db.transfers.insert({ ...input, requestId });

RETEST
POST /api/transfers, sent twice
201 Created, 409 Conflict. Fixed.
```

Each payment request now carries an ID that the database accepts **only once**, so a repeat is refused.

## Your payment code is tested every month, week or day, not once a year.

- **A YEARLY TEST:** Tests the app as it was that week. Misses changes made after it ends.
- **AGENTPROOF:** **Tests again on your schedule**, so a change to transfer code is checked within a month, a week or a day.

## Common questions from fintech teams, answered.

- **Does this make us PCI DSS compliant?** No. AgentProof tests and fixes your app. It does not certify you for PCI DSS or any other standard. Its reports show what was tested and how each problem was fixed.
- **Will fixes go live without review?** Only if you choose that. With pull requests, your team reviews every change before it merges.
- **How long are reports kept?** For as long as your account exists. Deleting the workspace deletes them. Removing a teammate does not.

## Every plan includes both agents for one fintech app.

Monthly checks cost $199 a month and weekly checks cost $399. **Daily checks cost $999 a month.**

- [See plans](/pricing/)
- [See how fixes work](/defense/)

## AgentProof also tests these kinds of apps.

- [SaaS](/solutions/saas/): Checks that each customer account can reach only its own data, roles and billing.
- [AI products](/solutions/ai/): Checks chats, shared links, model keys, usage limits and the tools your assistant can use.
- [Health tech](/solutions/health-tech/): Checks that patients and staff see only the records they are allowed to see.
- [Marketplaces and stores](/solutions/marketplaces/): Checks prices, orders, payouts and the line between buyers and sellers.
- [Apps built with AI tools](/solutions/ai-built-apps/): Checks database rules, exposed keys and unprotected routes in apps written with AI coding tools.

AgentProof is in development. The example finding on this page is an illustration, not a result from a customer's app.