Yes. Koobo does not handle raw card data itself. Payments are processed by Xendit, a licensed payment provider operating under Payment Card Industry Data Security Standards.
What this means
- Full card numbers are never stored on Koobo's servers.
- If a guest chooses to save a payment method for faster checkout, it is tokenised and held by the payment provider, not by us.
- Saving a card is always optional and only happens with the guest's consent.
Fraud monitoring
Transactions are monitored for signs of fraud. Occasionally this means we contact a guest to verify something before a booking is confirmed, for example an unusually large booking made from a new location. If the legitimacy of a booking cannot be verified, we may cancel it rather than let it proceed.
This occasionally means a genuine booking is delayed by a verification step. We would rather briefly inconvenience a real guest than let a fraudulent booking reach a host.
Why off-platform payment is unsafe
The protections above only exist inside Koobo's checkout. A guest who sends money directly to a host by bank transfer or e-wallet has no payment protection, no record in the platform, and no route to a refund if something goes wrong. Neither does the host, if the transfer is later reversed.
This is why hosts must not request payment outside the platform, and guests should never agree to it.
If something looks wrong
If a guest sees an unexpected charge, or a host sees a booking they do not recognise, contact your bank or payment provider first to secure the account, then email [email protected] so we can investigate on the platform side.