CYBER FRAUD PREVENTION & INCIDENT RESPONSE POLICY

This Policy establishes the Company's framework for preventing, detecting, investigating, containing and responding to cyber fraud and cyber-enabled financial abuse affecting customers, gift cards/vouchers, payment transactions, systems, employees, vendors or business operations.

• Reduce exposure to cyber-enabled fraud and financial loss.
• Detect suspicious activity through preventive and detective controls.
• Respond quickly to suspected fraud, account compromise and cyber incidents.
• Protect customers, transaction records, voucher value and confidential information.
• Preserve evidence and support investigation and lawful reporting.
• Strengthen controls through post-incident learning.

This Policy applies to websites, applications, APIs, customer accounts, gift-card/voucher systems, payment integrations, employee systems, cloud infrastructure, vendors, partners, devices, transaction monitoring and related operational processes.

Management shall establish appropriate oversight, resources and accountability for cyber-fraud prevention. Information Security, Risk/Fraud, Technology, Operations, Compliance and relevant business owners shall coordinate based on incident type and severity.

• Account takeover and credential compromise
• Phishing, social engineering and impersonation
• Payment fraud and unauthorised transactions
• Gift-card / voucher theft or misuse
• Fake refund or reversal activity
• Malicious code or unauthorised system access
• Data theft or unauthorised disclosure
• Employee or third-party misuse
• API or automated abuse
• Fraudulent customer or merchant activity

• Strong authentication and access controls
• Least-privilege access
• Transaction limits and velocity controls
• Fraud monitoring and alerting
• Secure software and API controls
• Endpoint and network security
• Employee awareness and phishing training
• Vendor risk management
• Customer awareness where appropriate

Credentials, authentication factors and security secrets shall be protected. Suspicious login, credential-reset, device or account behaviour may trigger additional verification, temporary restrictions or investigation.

The Company shall use appropriate transaction and voucher monitoring controls, proportionate to its business model and partner arrangements, to identify unusual value, velocity, redemption, refund, account or payment behaviour.

• Unusual transaction value or frequency
• Rapid voucher issuance and redemption
• Multiple failed authentication or verification attempts
• Unusual account or device behaviour
• Repeated refund or cancellation patterns
• Known fraud indicators or partner alerts
• Suspicious API activity

Employees, contractors and relevant partners shall promptly report suspected cyber fraud, phishing, unauthorised access, suspicious transactions, data compromise or other security concerns through designated reporting channels.

Incidents shall be classified according to severity, customer impact, financial impact, data exposure, operational disruption, scope and legal or regulatory significance.

• Identification and reporting
• Initial triage
• Containment
• Evidence preservation
• Investigation
• Eradication / remediation
• Recovery
• Validation and monitoring
• Post-incident review

Depending on the incident, containment may include account restrictions, transaction holds, disabling compromised credentials, isolating systems, blocking malicious indicators, suspending affected integrations or coordinating with relevant partners.

Relevant logs, transaction records, account information, communications, system artefacts, device information and other evidence shall be preserved in a manner that supports investigation and applicable legal or law-enforcement processes.

• Prioritise protection of affected customers.
• Restrict confirmed or suspected fraudulent activity where appropriate.
• Coordinate transaction holds, reversals or refunds where justified.
• Provide appropriate customer guidance.
• Protect customer information during investigation.

Where an incident involves a bank, payment processor, PPI, merchant, technology provider or other partner, the Company shall coordinate with the relevant party for transaction tracing, blocking, reversal, investigation and other appropriate actions.

Where required or appropriate, the Company may coordinate with law-enforcement authorities, cybercrime authorities, regulators, payment partners or other competent bodies. Any required notifications shall be handled by authorised personnel.

External communications regarding material cyber-fraud incidents shall be controlled by authorised management and relevant Compliance/Legal personnel. Employees shall not make unauthorised public statements regarding incidents.

Material cyber-fraud incidents originating from or affecting a vendor or partner shall be managed under this Policy and the Third-Party / Vendor Risk Management Policy, including escalation, evidence preservation and remediation.

Affected services shall be restored only after appropriate security validation, removal or containment of the threat, data-integrity checks and approval by authorised personnel.

Material incidents shall undergo post-incident review to identify root causes, control weaknesses, customer impact, financial impact and corrective actions.

• Security-rule or fraud-rule updates
• Access-control improvements
• System or application fixes
• Customer communication improvements
• Employee training
• Vendor remediation
• Process changes
• Additional monitoring

Incident reports, investigation records, evidence references, communications, decisions, transaction information, recovery records and corrective actions shall be retained according to applicable legal, regulatory and internal retention requirements.

Cyber-fraud investigations shall be treated as confidential. Access shall be limited to authorised personnel and information shall be shared only on a need-to-know basis or where disclosure is required or authorised.

The Company may conduct phishing simulations, tabletop exercises, incident-response drills, fraud-rule testing and other awareness or control exercises appropriate to its risk profile.

Exceptions shall be documented, risk-assessed and approved by authorised management. Exceptions shall not override mandatory legal, regulatory or contractual obligations.

This Policy shall be reviewed at least annually and following any material cyber-fraud incident, major technology change, significant partner change or material change in the Company's risk environment.