AES-256 Encryption and TLS 1.3
Every CFFC online banking session is encrypted using the Advanced Encryption Standard with 256-bit keys (AES-256) — the same cipher approved by the National Security Agency for classified material. Data in transit between your browser or mobile device and C&F Bank's servers travels through TLS 1.3 tunnels, the latest transport layer security protocol, which eliminates older cipher suites vulnerable to downgrade attacks.
At rest, your account data, transaction records and personal information reside in encrypted databases behind multiple firewall layers. Even in the unlikely event of a physical breach, the encrypted data would be computationally infeasible to decode. C&F Bank's encryption key management follows OCC guidance for national bank-grade information security, though we apply these standards voluntarily as a Virginia-chartered institution.
Certificate pinning in the C&F Bank mobile app prevents man-in-the-middle attacks by verifying the server's SSL certificate against a known value embedded in the application. If the certificate does not match — as would happen with a fraudulent proxy — the connection terminates immediately.

