26/06/2024
What is tokenisation fraud?
Tokenisation involves linking your credit or debit card with payment services such as Apple Pay, Samsung Pay or similar services. Tokenisation may be performed via the Mobile banking app or directly on an Apple or Android mobile device.
In most instances, tokenisation can only be completed with an SMS containing a one-time password (OTP) sent to you by the bank. Once your card is linked with and activated on Apple Pay, Samsung Pay or similar services, subsequent online or in-store purchases using the device do not require any further OTPs.
What are the potential risks?
For criminals to defraud you via tokenisation, they require your card details and the OTP. To obtain these details, fraudsters may call their victims pretending to be police or government officials asking you to disclose this information under the pretence that it is for some official reason.
Alternatively, fraudsters place advertisements with attractive offers on popular search engines like Google and social media sites such as Facebook and Instagram. They may also send you an email pretending to be from a courier company informing you that you need to pay a small fee to receive a pending delivery.
Once you click on the link the fraudsters shared with you, you will be redirected to a fake website that appears identical to the original. Once you input your card details and OTP, criminals steal these details and use them to complete a transaction at a different merchant for a larger amount.
How do I protect myself?
1) Read the content of all the OTPs sent to you by the bank carefully and thoroughly to understand the underlying transaction requests and activations.
2) If you receive any OTPs indicating a request to activate your card for Apple Pay, Samsung Pay or similar services and you did not initiate this process, DO NOT proceed any further and report the incident to Bank.
