UAE digital wallet fraud: How criminals can add a card to their phone using one verification code

Abu Dhabi: Bank customers have complained of incurring losses due to fraudulent transactions carried out through digital wallets. Their cards were added to phones not belonging to them, and a series of purchases were made within a short period, despite their insistence that they did not authorise these transactions. Customers confirmed that the fraudsters’ use of the verification code sent to their phones does not constitute their consent to add the card or make purchases. At one point, a banking expert said that entering the verification code is a procedure adopted by banks to prove approval of linking the card to the wallet, while emphasising the customer's responsibility to protect their confidential data and not share the code. A technology expert considered that verification when adding the card to a digital wallet should not be the only evidence when investigating complaints, calling for an examination of the device to which the card was linked, the timing and pattern of the transactions, and the ability of the security systems to detect unusual activity. It is noted that the Consumer Protection Standards issued by the Central Bank of the UAE stipulate that a transaction is considered authorised if the financial institution has applied correct and secure verification procedures, unless the customer provides preliminary evidence that raises reasonable suspicion that he did not carry out the transaction in dispute. The standards also require the return of unauthorised transactions within 30 days. Fraudulent transactions Specifically, bank customers complained about being charged for fraudulent transactions carried out using their cards through digital wallets, confirming that they were surprised to find their cards added to devices that did not belong to them, and a series of purchases made within a short period, before the banks rejected their objections, claiming that the card was added after entering a verification code sent to their registered phone numbers. They said that the fraudsters’ access to the verification code does not necessarily mean their approval to add the card or carry out transactions, especially in light of the use of sophisticated fraud methods that rely on impersonating banks or official bodies, and sending links and electronic pages similar to the original sites, with the aim of pushing the customer to disclose his data without realising the true nature of the process being adopted. They demanded that the use of the verification code should not be sufficient reason to close the complaint or to charge the customer with the full loss, calling on banks to conduct an extensive technical investigation that includes the device to which the card was added, its location, the timing of the transactions, their number, and their compatibility with the customer’s usual spending pattern, as well as the efficiency of the monitoring systems in detecting successive or unusual transactions. They explained that the problem is concentrated in cases where the fraudster obtains the card data and verification code through a fake call or message, then adds the card to a digital wallet on another phone, since after the addition is completed, the fraudster becomes able to carry out multiple transactions without needing to request a new code each time, which may lead to the customer discovering his loss after carrying out a large number of purchases. One-time passwords Banker Issa Al Ali said that the process of linking cards to digital wallets is carried out according to approved verification procedures. Picture credit: Supplied For his part, banker Issa Al Ali said that the process of linking cards to digital wallets is carried out according to approved verification procedures, which rely on the verification code or OTP sent to the phone number registered with the customer, as it is an official means of proving ownership of the device or application that requests to be added, and accordingly, entering the code is considered an explicit approval of the process from the perspective of banking systems. He added: “In return, the customer is responsible for protecting his confidential data and not sharing the verification code with any party, in addition to avoiding opening links from unknown sources, and reviewing any unexpected notification that arrives on his phone regarding adding a card or carrying out a transaction.” Al Ali continued: “Banks constantly recommend that customers activate instant alerts, review their accounts immediately if they suspect any unusual activity, and contact the bank directly to take the necessary measures. They also confirm that all objections are studied individually, and the process is checked to ensure the protection of customers and prevent the recurrence of such cases.” He stressed that the safety of customer data and the security of their transactions are a top priority for banks, and that protection systems are continuously being strengthened to keep pace with mode