Requesting one requires a BVN — handled carefully
Nomba issues a virtual account against a BVN (Bank Verification Number, 11 digits). Duro has no BVN validator of its own, so it treats the BVN as sensitive input from the moment it arrives:- Encrypted at rest. The BVN is encrypted with Duro’s cryptor and stored as
bvnCipher. It is never returned to the browser — the portal only ever learns whether a BVN is on file (hasBvn), never its value. - One BVN per account. A
sha256(bvn)hash is stored asbvnHashwith a unique constraint, so the same BVN can’t be linked to two different accounts. A collision surfaces as “this BVN is already linked to another account.” - Live-mode only. Virtual accounts are a real banking product — there is no sandbox equivalent, and the feature is unavailable unless the cryptor and the Nomba client are both configured.
Duro deliberately does not validate the BVN itself — it has no authority to. It collects it, secures it, and passes it to Nomba, which owns the KYC check. Duro’s job is custody: encrypt at rest, never echo it back, and enforce one-BVN-per-account.
Funding — an inbound transfer auto-credits the wallet
Once the account exists, funding it is just a bank transfer. Nomba notifies Duro, and the worker credits the wallet: The worker routes on the webhook’stransactionType of vact_transfer, correlates it to the right account by the accountRef carried on the event, and credits the wallet with reason: virtual_account_funding. The credit is idempotent on the Nomba transaction id, so a redelivered webhook credits the balance exactly once. An amount that resolves to zero kobo, an unresolvable accountRef, or a missing transaction id are each logged and skipped rather than crediting blindly.
Where it fits
A virtual account is the third way money reaches the wallet, sitting beside a card top-up:Card top-up
Inline Nomba checkout, arbitrary amount, card saved on the way through.
Bank transfer
A transfer into the dedicated virtual account — this page.
Then: wallet-first
However it was funded, the balance renews subscriptions before any card is touched. →