How to safely sign-in to CashPro®

Searching for “CashPro Sign In”, “CashPro Login”, or “CashPro” may expose users to Search Engine Optimization (SEO) poisoned search results. These are fraudulent websites that cybercriminals have manipulated to appear legitimate and often appear near the top of the search results. These sites are designed to steal credentials and other sensitive information. This guide explains how to safely sign in to CashPro and how to help protect yourself from fake CashPro websites.

CashPro has one official website: https://online.cashpro.bankofamerica.com.

For CashPro India users, a dedicated site is available with reference to the Reserve Bank of India’s directive on migration to the .bank.in domain: https://online.cashpro.bankofamerica.bank.in.

To sign in to CashPro securely, always enter these website addresses directly into your browser or save them as a bookmark and use that bookmark every time. Avoid using links from emails, text messages, sponsored search results, or unfamiliar websites claiming to offer CashPro access.

Once on the official CashPro site, you will be asked to enter:

• Company ID
• User ID
• Password

Phishing websites often copy the look and feel of the site they are impersonating, but there are common warning signs. Be cautious if you see:

• Web addresses that do not end in bankofamerica.com
• Slight misspellings or extra words in the URL
• Requests for sensitive information CashPro does not ask for
• Urgent messages claiming your account is suspended or compromised

If the page does not look exactly right and you did not use the trusted site, do not enter your credentials.

CashPro offers Strong Authentication at Sign In, which is also referred to as Multi-Factor Authentication (MFA) or Two-Factor Authentication (2FA). It works by combining two elements to authenticate your identity. You must have an assigned and active token for this feature. This may be:

• A CashPro Mobile Token through the CashPro App
• A CashPro Physical Token issued to you

If you're authenticating with a mobile token during sign in, you will be prompted to send a push notification to your device or enter a one-time passcode generated from your token. This additional step helps protect your account even if your username and password are compromised. If you're authenticating with a physical token, you'll be prompted to input the one-time passcode on your physical token.

If your token is lost, stolen, or stops working, contact your CashPro Primary Administrator immediately.

Never share your token code. Bank of America will never call or text you and ask for your token code.

Do not approve a token authentication request that you did not initiate. If you receive an unexpected authentication request, reject it and contact your client team immediately.

The CashPro App offers QR Sign In. To use QR Sign In:

1. Open the CashPro App on your mobile device
2. Select the Online Sign In option
3. Go to CashPro Online https://online.cashpro.bankofamerica.com/ and select “Sign in with QR”
4. Scan the QR code shown on your desktop sign in screen
5. Authenticate using your biometrics or CashPro Password

This method allows you to sign in without typing your password on your computer, reducing exposure to keylogging and phishing attacks.

QR Sign-In also includes CashPro Verified QR Scan™, which verifies the QR code you're scanning and alerts you if a fraudulent or tampered code is detected.

If you forget your password, use the Sign in assistance link on the official CashPro sign in page and select Reset my password. The process will guide you through identity verification and password reset steps.

If your account becomes locked after multiple failed attempts, contact your CashPro Primary Administrator for assistance.

If you suspect your information may have been compromised:

• Change your CashPro password immediately
• Notify your CashPro Primary Administrator to deactivate your CashPro account
• Review account activity and audit logs for any suspicious transactions, including future-dated payments
• If you identify a transaction that was not initiated by an authorized user:
  • U.S.: Contact Global Treasury Fraud at +1 877.220.0842
  • International: Contact your local client services for next steps
  • ACH payments (U.S.): Call ACH Returns at +1 877.220.0891
  • Check payments (U.S.): Call U.S. Check Returns at +1 877.220.0891
• Contact law enforcement if fraudulent activity is confirmed
• Contact Global Treasury Fraud at +1 877.220.0842 to report malware or ransomware, or to deactivate CashPro access if credentials may be compromised.
• Report suspicious emails by forwarding them to abuse@bankofamerica.com.

Acting quickly can help prevent unauthorized access and protect your organization.

One of the best defenses against fraud is to be sure that Bank of America can contact you in a timely manner.

• Go into “My Profile” in CashPro and update your contact information
• If you need assistance with updating your information, contact CashPro Client Services

Phishing attacks rely on confusion and urgency. By bookmarking and using the official CashPro website, enabling Strong Authentication, and using the CashPro App with QR Sign In, you significantly reduce the risk of fraud. As a reminder, Bank of America will never contact you requesting credentials.

For help with access or security concerns, CashPro Client Services is available to support you.