# Who is allowed to move money > Roles, PINs and signing keys: the three controls that decide who can send money out of your account. Category: Getting your money · Last updated: 2026-09-16 · Source: https://ultraner.com/resources/payouts/who-can-move-money Most payment fraud inside a business is not clever. It is somebody using access they were given and nobody thought about again. Three controls sit between a person and your balance. ## 1. Their role Everyone you invite has a role, and a role either includes sending payouts or it does not. Somebody in customer care can see a transaction and answer a question about it without ever being able to move the money behind it. ## 2. A PIN, for anything done by hand In the dashboard, sending money asks for the PIN belonging to the person pressing the button. It is not a shared company PIN, and it confirms the human rather than the session. ## 3. A signature, for anything done by software An API key identifies a business, not a person, which is fine for taking payments and not enough for sending money. A payout made over the API carries a signing key issued to a named person, so every withdrawal has somebody’s name against it. The signature is checked against that person’s current access every time it is used. Remove them from the team, or take payouts off their role, and it stops working on the next request, with nothing to remember to revoke. ## Why an API key is not enough on its own A key is a string in a config file. It can be copied into a laptop, a CI system and a colleague’s terminal without anybody deciding that should happen, and it carries no information about who is using it at the moment it is used. For collecting payments that is acceptable: the worst case is somebody creating charges that land in your own account. For sending money it is not, because the worst case is money leaving to an address you never chose. ## What the audit trail actually contains Every payout records who authorized it, whether that was a person in the dashboard or the human behind a signing key. Months later, "who sent this" has an answer that is a name rather than an inference from a timestamp. This matters most in the ordinary case rather than the dramatic one. Most of these questions come from an auditor or a board member, not from a fraud investigation, and a trail that names people ends the conversation quickly. **The practical advice** Give payout permission to the smallest number of people who genuinely need it, and make sure at least two of them exist. The most common failure here is not fraud. It is the only person who can approve payroll being unreachable on payday. ## Read next - Your team, roles and permissions: https://ultraner.com/resources/business/team-roles - Payouts and disbursements explained: https://ultraner.com/resources/payouts/payouts-explained - API keys, scopes, and what a key can never do: https://ultraner.com/resources/developers/api-keys --- Ultraner is the payment layer for Africa. https://ultraner.com