Bank SMS beside receipts: the SMS app (optional)

You do not need this app. Customers upload their bank receipt, your team reviews it in Receipts, and every payment can be completed that way. The SMS app is an extra: it forwards the deposit SMS your bank sends to your Bezanbecard account, signed, so the bank's own word sits beside each receipt.

What it adds

• The bank SMS beside the receipt. A deposit SMS matched to a payment, on its card or account, corroborates the oldest pending receipt it fits: the amount the receipt states (or, when it states none, the amount the payment asked for when the receipt was sent) and its paying card, when the receipt and the SMS both name one. The queue says the bank SMS matched, and approving takes one click. See receipts and review.
• Transfers without a receipt. A customer who paid but never sent a receipt still shows up: the SMS is matched to its payment, or waits in Review and fix for you.
• One transfer, counted once. When a receipt was approved before its SMS arrived, the SMS takes the place of the receipt's provisional deposit instead of adding to it.
• Automatic approval, if you want it. A setting in your payment settings, off by default. When it is on, a payment completes by itself when its bank SMS matches it exactly, and when the payment has a single pending receipt and the SMS fits it, the system approves that receipt. A receipt flagged as a copy of another is only marked, and so is any receipt while the payment waits in review for another reason. With several pending receipts, the SMS only marks the oldest one it fits, and a person decides.

Android

The Android app receives bank SMS even when it is closed and after the phone restarts, queues them on the phone, and uploads them as soon as there is internet. Google Play does not allow apps of this kind to read SMS, so the app is installed from an APK.

1. On the phone that receives your bank SMS, open the download page and install the latest APK. Android asks once to allow installs from your browser.
2. In the dashboard open SMS phones → Pair a phone, give the phone a name and scan the QR code with the app (or type the 8-character code). A code is valid for 10 minutes and works once.
3. Allow SMS (required), notifications (so you hear if the phone is disconnected) and running in the background (without it Android may hold uploads for hours).
4. Press Send test in the app. The test message appears on the phone's page in the dashboard; it is never turned into a deposit.

iPhone

iPhones do not let any app read SMS. Instead, a Shortcuts automation hands each bank message to the app's Forward Bank Message action, which signs and sends it in the background. Set the automation up so it catches every kind of deposit: many banks word a Pol, Paya or Satna deposit differently from a card-to-card one, and some never write «واریز» at all.

1. Install the Bezanbecard app (the download page says how to get it) and pair it the same way: SMS phones → Pair a phone in the dashboard, then scan the code.
2. Open the Shortcuts app, go to Automation and tap New Automation.
3. Choose Message, tap Sender and pick your bank's number (add it to Contacts first if it is not there). Leave Message Contains empty, so Pol, Paya and Satna deposits are forwarded too. Choose Run Immediately, then Next.
4. Tap New Blank Automation, search for Bezanbecard and add Forward Bank Message. Set Message to the message content and Sender to the sender.
5. Tap Done. Repeat for every bank that texts this phone.
6. Press Send test in the app to check the connection. The automation itself is checked by your bank's next SMS.

If your bank texts from a name you cannot pick as a sender, use Message Contains instead, with a phrase that only that bank's deposit SMS contains, copied from a real one. Everyday words turn up in other people's texts too, and those would be forwarded. Then add your bank's sender, exactly as the phone shows it, under Bank senders in the app's settings, so texts from other senders are dropped on the phone. If some deposits lack your phrase, as Paya or Pol deposits often do, make a second automation with a phrase from one of those.

The automation runs even when the app is closed. Messages that arrive without internet are sent the next time the automation runs or you open the app.

Which messages are sent

• On Android, list your banks' sender numbers on the phone's page in the dashboard (up to 50). Messages from any other sender are dropped on the phone, before they are stored or sent. With an empty list every message is sent, and the server sets aside anything that is not a bank transaction.
• On iPhone, the app cannot read your messages: only those your automations match are forwarded, so match your bank's sender, or list it under Bank senders in the app.
• OTPs, wallet messages and adverts are recognised and kept apart; only credits become deposits.

How a message becomes a deposit

The server reads the bank, the amount, how the money came (card to card, Pol, Paya, Satna or a same-bank transfer, when the bank says so), the digits of your card or account and, when present, the payer's card and the bank's trace number. A credit becomes a deposit on the card whose last four digits it names, or on the card or account whose IBAN ends with the account digits it names (the phone's own destinations first). Otherwise it goes to the phone's only destination, else to your default destination at that bank. When no destination is safe, the deposit waits in Review and fix for you to choose. The same transfer reported twice (the same destination and trace number) is one deposit.

Health

The phone checks in every 15 minutes with its battery, its permissions and the length of its upload queue. The dashboard shows each phone as online, quiet (no check-in for 20 minutes) or offline (an hour). Going offline notifies the owner and admins and emits device.offline; the next check-in emits device.online. Keep the phone charged and online, and give it a SIM that receives the bank's SMS.

Security and privacy

• Pairing gives the phone a secret that never leaves it, kept in Android's encrypted storage or the iPhone Keychain. Every request is signed with it (HMAC-SHA256 over the timestamp and body), and a replayed or late request is refused.
• Message texts are encrypted at rest and wiped after 90 days; the parsed amount, digits and trace number stay with the deposit.
• The phone deletes forwarded messages from its own queue after 7 days.
• Only owners, admins and support members of your team can read a message's text, in the dashboard and in the evidence pack.
• Remove a phone under SMS phones at any time. It stops at once and the app shows that it was disconnected.

Without the app

Everything works without it. Customers send receipts, your team approves them, partial payments, corrections and the evidence pack all work the same, and test mode needs no phone at all. You can still record a transfer you see in your bank app by hand (dashboard or POST /v1/deposits). A customer who said they paid without a receipt file waits in your Receipts queue until you check your bank.