Abu Dhabi: Bank customers have complained of incurring losses due to fraudulent transactions carried out through digital wallets. Their cards were added to phones not belonging to them, and a series of purchases were made within a short period, despite their insistence that they did not authorise these transactions.
Customers confirmed that the fraudsters’ use of the verification code sent to their phones does not constitute their consent to add the card or make purchases.
At one point, a banking expert said that entering the verification code is a procedure adopted by banks to prove approval of linking the card to the wallet, while emphasising the customer's responsibility to protect their confidential data and not share the code.
A technology expert considered that verification when adding the card to a digital wallet should not be the only evidence when investigating complaints, calling for an examination of the device to which the card was linked, the timing and pattern of the transactions, and the ability of the security systems to detect unusual activity.
It is noted that the Consumer Protection Standards issued by the Central Bank of the UAE stipulate that a transaction is considered authorised if the financial institution has applied correct and secure verification procedures, unless the customer provides preliminary evidence that raises reasonable suspicion that he did not carry out the transaction in dispute. The standards also require the return of unauthorised transactions within 30 days.
Fraudulent transactions
Specifically, bank customers complained about being charged for fraudulent transactions carried out using their cards through digital wallets, confirming that they were surprised to find their cards added to devices that did not belong to them, and a series of purchases made within a short period, before the banks rejected their objections, claiming that the card was added after entering a verification code sent to their registered phone numbers.
They said that the fraudsters’ access to the verification code does not necessarily mean their approval to add the card or carry out transactions, especially in light of the use of sophisticated fraud methods that rely on impersonating banks or official bodies, and sending links and electronic pages similar to the original sites, with the aim of pushing the customer to disclose his data without realising the true nature of the process being adopted.
They demanded that the use of the verification code should not be sufficient reason to close the complaint or to charge the customer with the full loss, calling on banks to conduct an extensive technical investigation that includes the device to which the card was added, its location, the timing of the transactions, their number, and their compatibility with the customer’s usual spending pattern, as well as the efficiency of the monitoring systems in detecting successive or unusual transactions.
They explained that the problem is concentrated in cases where the fraudster obtains the card data and verification code through a fake call or message, then adds the card to a digital wallet on another phone, since after the addition is completed, the fraudster becomes able to carry out multiple transactions without needing to request a new code each time, which may lead to the customer discovering his loss after carrying out a large number of purchases.
One-time passwords
For his part, banker Issa Al Ali said that the process of linking cards to digital wallets is carried out according to approved verification procedures, which rely on the verification code or OTP sent to the phone number registered with the customer, as it is an official means of proving ownership of the device or application that requests to be added, and accordingly, entering the code is considered an explicit approval of the process from the perspective of banking systems.
He added: “In return, the customer is responsible for protecting his confidential data and not sharing the verification code with any party, in addition to avoiding opening links from unknown sources, and reviewing any unexpected notification that arrives on his phone regarding adding a card or carrying out a transaction.”
Al Ali continued: “Banks constantly recommend that customers activate instant alerts, review their accounts immediately if they suspect any unusual activity, and contact the bank directly to take the necessary measures. They also confirm that all objections are studied individually, and the process is checked to ensure the protection of customers and prevent the recurrence of such cases.”
He stressed that the safety of customer data and the security of their transactions are a top priority for banks, and that protection systems are continuously being strengthened to keep pace with modern fraud methods.
Three stages of security
From a technical standpoint, Assem Jalal, a management science and IT consultant at G&K Consulting, explained that understanding responsibility begins with distinguishing between three stages.
In the first stage, with a traditional credit card, verification is done using the card itself and the PIN or CVV code. If an online transaction is made, the bank sends a one-time verification code (OTP) to confirm the cardholder's presence and consent.
He added: “In the second stage, when adding the card to a digital wallet such as Apple Pay, Samsung Wallet, or Google Pay, the card isn't copied to the phone. Instead, a unique token (toke) is generated and linked to that specific device. The OTP is requested only once to approve this link. The third stage, which many overlook, is that every subsequent transaction made through the wallet doesn't require a new verification code from the bank, as the device itself becomes the authentication tool using fingerprint or facial recognition."
Jalal explained that “the code that is entered once when linking is the gateway to everything that follows it, and this is where the danger lies, because whoever gets one code at one moment practically gets a card that works fully on a device that does not belong to the owner of that card.”
Bank responsibility
Based on this sequence, Jalal believes that the bank's responsibility does not end with proving that the code was sent and successfully verified, because that proves that someone entered the code, not that this person is the customer. He explained that the bank's responsibility is to treat the first card linking to a digital wallet on a new device as a high-risk event that requires additional confirmation within the banking application, and to monitor unusual patterns such as a succession of many transactions within hours or exceeding the credit limit, and to conduct an actual investigation when objecting, examining the type of device, the channel, the timing, and the delivery records of messages, rather than closing the complaint on the pretext that the transaction was carried out through a "secure wallet".
He added: “On the other hand, it is the customer’s responsibility to protect his data, his phone SIM card and his email, and not to share any verification code with any party, no matter who claims to be him, and to report immediately any suspicious activity.”
Jalal pointed out that text messages alone are no longer a sufficient safeguard because they are susceptible to SIM card swapping, phishing, and message interception.
He advised customers to take five practical steps, including: activating instant notifications for every transaction and every change in account settings, periodically reviewing the devices and wallets linked to the card and canceling any unknown ones, not entering a code for a request that they did not initiate themselves, in addition to contacting the telecommunications company immediately if the phone service is suddenly interrupted because it may be an indication of SIM card replacement, documenting any objection in writing with the bank, and resorting to the regulatory authority if the response is not justified.
Official stance
The Central Bank states that the transaction is authorised if the financial institution applies secure verification procedures.
The Consumer Protection Standards issued by the Central Bank of the UAE stipulate that a transaction is considered authorised if the financial institution has applied proper and secure verification procedures, unless the customer provides preliminary evidence that raises reasonable suspicion that he did not carry out the transaction in dispute.
The standards also give the customer a grace period of no less than 30 working days to report after being notified of the transaction, and obligate the bank to document the report, inform him of the options to stop the account, card or digital payment tool, and take appropriate measures to prevent the execution of additional transactions.
According to the standards, the value of unauthorised transactions must be refunded after the investigation is completed or within 30 calendar days of the reporting date, whichever is shorter, except in cases where there is evidence of fraudulent or grossly negligent conduct by the customer. If the bank cannot clearly document the customer's authorisation, and the dispute regarding liability or the strength of the evidence persists, the complaint must be referred to the dispute resolution mechanism.