Tap, pay, what could go wrong? E-wallet cases at FMOS

Going cashless through e-wallets has become a seamless part of our daily lives.

In Malaysia, the use of digital payments has grown rapidly, with e-wallets making it easier to pay for everyday purchases, shop online, transfer money and manage payments from our phones.

When Things Go Wrong with an E-Wallet

A few taps are often all it takes. 

But the same convenience that makes e-wallets useful can also make them a target for scams. Fraudsters may steal account details, take control of an account or device, or trick consumers into making payments themselves.

FMOS receives disputes related to scams and other e-wallet issues. These include unauthorised transactions, duplicate charges, transfers that never reach the intended recipient, unsuccessful payments and delays in obtaining refunds. FMOS examines the circumstances of each dispute and the available evidence to establish what happened.

E-Wallet Scam Patterns

FMOS has observed several recurring patterns across disputes involving e-wallet scams. While each case presents its own circumstances, a number of common scam scenarios have emerged:

Phishing, stolen login details and unauthorised device access

A scammer may impersonate a bank, government agency, merchant, or other trusted organisation or direct the consumer to a fake website or app. The consumer may be tricked into sharing their login details, PIN or One-Time Password (OTP), or downloading an app that contains malicious software.

In some cases, the scammer may entice the consumer to stay on a video call, allowing them to use the consumer’s facial biometrics to approve a transaction. 

With this access, the scammer may gain entry into the consumer’s e-wallet account, register or link another device, change security settings, or make transactions without the consumer’s knowledge.

When Consumers are manipulated into authorising payments

Scammers may deceive consumers into authorising payments or transferring funds by presenting fraudulent investment opportunities, job offers, rental listings, online shopping deals or other seemingly legitimate offers.

Rapid Transactions, Linked Cards and Automatic Reloads

Once scammers gain unauthorised access to an e-wallet, whether through compromised login credentials or a newly registered device, they may make multiple transfers or payments within minutes. 

If the e-wallet is linked to a debit or credit card and automatic top-up is enabled, additional funds may be loaded into the e-wallet. 

If the credentials of an e-wallet have been compromised, the automatic top-ups can allow scammers to quickly transfer or spend the money before the consumer becomes aware of the unauthorised activity. This may result in substantial losses within a short period. 

What Does FMOS Look At?

FMOS looks at transactions from start to finish, including how the transactions were made, whether the consumer used a device linked to his/her account, and what login details and security checks were required. This may include device registration history, authentication records, login activity, and the sequence of events leading up to the disputed transaction.

The e-money issuer’s records of account activity, devices and logins may also help establish whether someone else accessed the account, stole the consumer’s details or linked an unauthorised device.

For scam-related disputes, FMOS examines the timing, value, frequency and sequence of the transactions, as well as the overall pattern of activity. This may include multiple reloads, transfers, or payments made within a short period; changes to the device or account settings; and transactions that deviate from the consumer’s usual activity or transaction patterns.

FMOS may also consider the nature of the scammer’s representation, the circumstances in which the consumer was persuaded to authorise the transaction, and whether the transaction pattern was consistent with the consumer’s usual activity. It may further assess whether the activity could reasonably have triggered fraud-monitoring controls, and whether the e-money issuer’s alerts, transaction limits, and steps to prevent further losses were reasonable in the circumstances. 

For other disputes, such as duplicate payments, transfers that never arrived, or service failures, FMOS may review transaction records, merchant or recipient details, receipts, account statements, and other documents to determine what happened to the money.

The manner in which the e-money issuer handled the complaint also forms part of FMOS’s assessment.  Relevant considerations may include the timeliness and adequacy of the investigation, the clarity and evidential basis of the response, the steps taken to explore available recovery options, including chargeback where applicable, and whether such steps were taken within the relevant time limits. 

Ultimately, each dispute is assessed on its own facts and the evidence provided by both parties. FMOS considers what each party did or failed to do, whether the records and supporting documents can be relied upon, and whether either party’s actions contributed to the financial loss. 

The outcome is based on what is fair and reasonable in the circumstances.

Real E-Wallet Cases: What Happened and What FMOS Decided

Actual disputes handled by FMOS illustrate how liability is determined based on device security, authentication, and service delivery.

Case Study 1: When the Bound Device Matters

Sharifah disputed nine unauthorised e-wallet transactions totalling RM606 for Razer Gold game credits. After her e-money issuer rejected her claim, she contacted FMOS.

The records showed that the transactions were made using her registered device, which was linked to her e-wallet account since 14 January 2021. There was no record of any new device being used to access the e-wallet before the disputed transactions. The e-wallet was also topped up using Sharifah’s linked credit card. 

While an OTP was required when the credit card was initially linked to the e-wallet, subsequent reloads made using the saved “favourite card” did not require an additional OTP under the merchant’s standard process.

Having considered the available evidence, FMOS upheld the e-money issuer’s decision. 

Consumer takeaway: Keep your phone secure, protect your account details, and regularly check your linked cards and automatic reload settings.

Case Study 2: The Room Rental Scam

Shan was looking for a room to rent when he came across a rental scam. Believing he had secured the accommodation, he made two e-wallet transfers totalling RM500 to two different individuals.

The disputed transfers were authorised using Shan’s registered mobile number, a bound device, and a six-digit PIN. FMOS noted that the e-wallet had been reloaded with amounts matching the disputed transfers shortly before the payments were made.

In this case, the evidence indicated that Shan had personally initiated and authenticated the transactions after being deceived by the scammer. FMOS therefore found in favour of the e-money issuer.

The Ombudsman disallowed the claim and emphasised the consumer’s responsibility to exercise vigilance before making third-party transfers.

A similar principle applies to an e-wallet scam involving a fraudulent lucky-draw promotion.  The consumer was deceived by an online promotion and voluntarily transferred RM1,600.  The transactions were carried out using the consumer’s existing registered device and authenticated with the user’s six-digit PIN. 

Consumer takeaway: A scam can still involve a transaction that the consumer personally authorised. Before making a transfer, pause and independently verify the person, merchant or opportunity involved rather than relying solely on information provided by the other party. 

Case Study 3: Duplicate E-Wallet Payment for the Same Flight

Chen used his multi-currency debit card to book a flight with an airline. When he did not receive a confirmation code, he tried again with the same flight details. He received confirmation only after his third attempt and promptly asked for the earlier transactions to be cancelled. 

By the time the e-money issuer tried to initiate a chargeback, more than 120 days had passed, and the Visa chargeback timeframe had expired. Although the transactions had been authorised using 3D Secure, the Ombudsman found evidence that the earlier flight bookings had not been successfully completed. 

As Chen had raised the issue promptly, the e-money issuer’s failure to advise him of the chargeback process and to act within the required timeframe had unfairly deprived him of the opportunity to recover the funds. The Ombudsman found in Chen’s favour and required the e-money issuer to refund RM14,000.

Consumer Takeaway: If a payment goes wrong, promptly report it to your financial service provider and ask about available options and deadlines for disputing the transaction.

How to Keep Your E-Wallet Safe

• Protect your security details. Never share your PIN, password or OTP with anyone. Avoid suspicious links and apps from unknown or unofficial sources, especially Android Package Kit (APK) files sent through WhatsApp, SMS or social media.

• Be cautious during calls. Do not stay on a video call, share your screen, approve transactions or use facial recognition to log in at the instruction of a stranger. Never allow unknown persons to remotely access or control your phone. If a caller claims to represent a bank, e-wallet issuer or government agency, end the call and contact the organisation through its official number or app.

• Monitor your account. Review your e-wallet transactions and linked cards regularly. Enable transaction alerts, use a strong screen lock, keep your phone and apps updated, and check for unfamiliar devices linked to your account. Where available, set suitable transaction and reload limits, and review your automatic reload settings.

• Verify before paying. Check the recipient before transferring money, especially if an offer seems too good to be true or someone pressures you to act quickly. Even if you have been deceived, the circumstances surrounding a payment you authorised may matter if you later dispute the transaction.

What to Do If You Have Been Scammed

Act quickly!

Contact your e-wallet issuer or relevant financial service provider as soon as you notice suspicious activity. Report the incident and lodge a police report.

Keep evidence of what happened, including transaction receipts, screenshots, messages, emails, phone numbers, beneficiary details and correspondence with the financial service provider. 

These can help establish the sequence of events if you need to dispute the transactions later.

How to Seek Redress Through FMOS

If you have suffered a financial loss from an e-wallet scam, an unauthorised transaction or a dispute involving the e-wallet products or services, you do not have to navigate the dispute alone or resort to court proceedings. 

FMOS accepts eligible disputes involving direct financial losses of up to RM250,000, subject to its jurisdiction and eligibility requirements.

Before approaching FMOS, you must first lodge a formal complaint with the relevant financial service provider. If you are dissatisfied with the final decision, you may refer the matter to FMOS within 6 months of receiving it. If there is no response within 60 days from the date of your complaint, you may also refer the matter to FMOS.

FMOS offers a free and impartial avenue for consumers and investors to seek redress in the financial and capital markets.

Resolving Disputes, Maintaining Trust

File Your Dispute: complaint.fmos.org.my
Official Website: www.fmos.org.my
General Line: +603-2272 2811
Address: Level 14, Main Block, Menara Takaful Malaysia, No. 4, Jalan Sultan Sulaiman, 50000 Kuala Lumpur
Operating hours: 8:30 am – 5:30 pm, Monday–Friday

This content is provided by Financial Markets Ombudsman Service (FMOS)

The views expressed here are those of the author/contributor and do not necessarily represent the views of Malaysiakini.

View the article here: Tap, pay, what could go wrong? E-wallet cases at FMOS