Token FAQs
A security token is a physical or mobile device used to gain access to an electronically restricted resource. The token is used in addition to or in place of a password. It acts like an electronic key to access a website or computer.
For our Corporate Internet Banking Service (Sterling Pro), the token is a second factor authentication method used for consummating transactions
M-token (Mobile Token) & Hard Token
M-Token
The M-token is one of the authentication methods used for completing transactions on SterlingPro.
It is a mobile token application used to generate one-time passwords. It can be downloaded from your phone’s Playstore/Appstore (Android & iOS).
(iOS – Sterling M-token or Android – Sterling M-token)
Sterling M-token (Mobile Token) is the mobile application used to authorize login to some sterling applications & transactions using one-time passwords where required.
Some of the new features on the M-token application, include the following;
- Migration from offline to online mode – You need to be connected to the internet to launch the application
- Onboarding swiper – This is an interactive guide that gives you information on how to use the app upon installation.
- You can now delete your token profile on the ‘Enter PIN’ screen at launch – This enables new activation codes to be used for re-enrollment without a need to uninstall and redownload the M-Token application.
- Multiple tokens for different accounts and different user profiles functionality – Use the same M-token app for all your accounts or profiles.
The M-token application can be used on Android v5.0 & above and iOS v10.0 & above.
Once generated, an OTP is valid for 30 seconds
No, the M-token application requires internet connection.
The app is configured to accept numbers only; strong PIN policy is applied and this has been put in place to prevent a customer from using:
- PIN with all the same digits (e.g. 1111, 2222),
- Ascending number array (e.g. 1234, 3456),
- Descending number array (e.g. 4321, 6543).
- The default PIN length is a minimum of 4 to a maximum of 6 digits
- Default number of wrong PIN entries is 3.
If you use an iOS device, you can login using Touch or Face ID.
The “Delete token” & “Migrate Token” options are available in the “My Token” menu.
The privacy policy can be assessed from the Settings menu on the application.
Yes, upon migration to a new device, QR codes can be used to activate your M-token (this feature is only available on Android devices).
You can get the QR codes under “My Tokens”, on your old device. Click on “Migrate token to a new device” to reveal new activation codes and QR code. Scan the QR code generated on your old device with your new device to activate the M-token.
Yes, but only if you’re in possession of the old device.
New activation codes can be generated without you having to visit the branch or contact our One Customer Centre. Once the generated activation codes are used, the current token becomes invalid.
Go to “My Tokens” on your old device, click on “Migrate token to a new device” to reveal new activation codes and QR code. Enter the new activation codes on your new device.
Please use any of the following to request for a token reset:
- Branch: Visit any of our branches and request for an M-token reset;
- Relationship Manager: Call/ Email your Relationship Manager and request for an M-token reset or;
- Customer Success: Send a duly signed written instruction with your company letterhead to [email protected] to request for an M-token reset.
You are required to provide at least one of the following to complete your request for an M-token reset:
- Filled SterlingPro Request Form – available at any of our branches.
- Signed written instruction on Company Letterhead.
Yes, you would need to send a duly signed written instruction to [email protected] requesting for a new activation code. Ensure to include your Username, Corporate Account Number, Mobile Number and Registered Email Address on the written instruction.
Send an email to [email protected] or visit any of our branches to deactivate the M-token from your profile
Please send an email to [email protected] OR visit us at any of our branches OR call your Relationship Manager.
All user roles (Authorizers, Admin, Approver, Verifier and Initiator)
- Branch: Visit any of our branches to request to be profiled for the M-token.
- After you have been profiled on the mobile application, the Admin sets up the other users: initiator, authorizer, verifier and selects the type of token each user should use.
- Relationship Manager: Call/Email your Relationship Manager and request to be profiled on the M-token application.
- Customer Success:
- Send a duly signed written instruction with your company letter head to
- Your instruction should contain your Corporate Account Number, Username, Mobile Number, Email Address.
- After verification, a 16-digit Activation Code (Valid for 10 days) will be sent to your registered Email Address and Phone Number.
To begin your M-token activation, please follow these steps:
- Download the M-Token application from your phone’s application store. (iOS – Sterling M-token OR Android – Sterling M-token)
- Enter token Nickname (which is your preferred name of choice)
- Enter the 16-digit activation code, the first 8-digits is your default login ID while the last 8-digits is your default password.
- Create a new PIN.
Go to ‘My token’, click on ‘Migrate token’ to reveal new activation and QR codes.
Yes, go to ‘My token’ and click on ‘Reset token’.
Alternatively, you can select the token profile to be deleted by clicking on ‘Delete token’ in the settings menu at the top right corner.
Any preferred name of choice different from the other profiles.
On the landing page, click on ’Add token’ and follow the prompts to activate token.
Yes, OTPs can be copied by selecting the icon next to the six-digit code.
This is because the M-token app has been migrated from offline mode to online mode and no longer requires the use of flag for authentication. If inputted PIN is wrong, the app displays incorrect PIN instead of the flag in the previous version.
You are required to visit the App store on your iOS device or Play store on android to update the M-token app (Sterling M-token) but if your device has been configured to automatically update apps you won’t need to.
This implies that you would need to request for new activation codes to proceed. Kindly request for new activation codes through your Relationship Manager or send a duly signed written instruction with your company letter head to [email protected].
- Your instruction should contain your Corporate Account Number, Username, Mobile Number, Email Address.
- Upon Verification, a 16-digit activation code will be sent to you.
- Enter the 16-digit activation code, the first 8-digits is your default login ID while the last 8-digits is your default password.
- Create a new PIN.
This implies that you would need to request for new activation codes to proceed. Kindly request for new activation codes through your Relationship Manager or send a duly signed written instruction with your company letter head to [email protected].
- Your instruction should contain your Corporate Account Number, Username, Mobile Number, Email Address.
- Upon Verification, a 16-digit activation code will be sent to you.
- Enter the 16-digit activation code, the first 8-digits is your default login ID while the last 8-digits is your default password.
- Create a new PIN.
- Download the M-Token application from your phone’s application store. (iOS – Sterling M-token OR Android – Sterling M-token)
- Enter token Nickname (which is your preferred name of choice)
- Enter the 16-digit activation code, the first 8-digits is your default login ID while the last 8-digits is your default password.
- Create a new PIN.
You can please send an email to [email protected] or call 0700 822 0000 for prompt resolution of your complaints.
Yes, it is compulsory. Each user role can only request for M-token.
Yes, you can. Please send a duly signed instruction via email to [email protected] or visit us at any of our branches.
HARD TOKEN
Please report the token as lost/stolen via any of our branches or send an instruction to [email protected] to deactivate the hard token device from your profile
You’re required to visit any of our branches to request for a new hard token or request to be profiled for an M-token.
