Account security
DzalekaPay protects sign-in with HTTPS, idle session timeouts of 20 to 30 minutes by role, password resets, merchant verification, and payment monitoring. Changing a password signs out other devices. Card numbers are entered only on PayChangu hosted checkout.
Keep your password private. Use at least 8 characters. Mix letters and numbers. Do not share your password, mobile money PIN, or a one-time code. Staff, email, and WhatsApp will never ask for those, and will never ask you to pay to unlock, confirm, or reverse a payment.
Genuine pages are on https://pay.dzaleka.com. Look-alike hosts and raw IP addresses are not DzalekaPay. Transactional email is sent from pay@dzaleka.com. Questions go to info@mail.dzaleka.com.
To reset a password, use Forgot your password on the sign-in page. The link goes to the email saved on the account and expires after 1 hour.
If you already sent money to a scammer, use https://pay.dzaleka.com/stay-safe for Malawi Police, Airtel Money, TNM Mpamba, and MACRA contacts. Report phishing to info@mail.dzaleka.com.
Full HTML page: https://pay.dzaleka.com/security.