FRAUD PREVENTION & TRANSACTION MONITORING POLICY

This Policy establishes a risk-based framework for preventing, detecting, investigating and managing fraudulent or suspicious transaction activity associated with the Company's gift-card and gift-voucher business, customer accounts, payment channels, redemption activity and relevant partner relationships.

• Identify and reduce fraud risks before financial loss occurs.
• Monitor transactions and customer activity for unusual patterns.
• Generate, review and resolve risk alerts.
• Apply proportionate transaction controls and restrictions.
• Coordinate fraud cases with payment and business partners.
• Use fraud intelligence to strengthen preventive controls.

This Policy applies to customer onboarding, purchases, payments, gift-card/voucher issuance, activation, redemption, refunds, account activity, APIs, merchant activity and other transaction processes within the Company's operational scope.

Management shall establish appropriate fraud-risk oversight, risk appetite, resources and accountability. Risk/Fraud, Operations, Technology, Compliance, Finance and Customer Support shall cooperate in fraud prevention and investigation.

• Payment fraud
• Account takeover
• Identity misuse
• Gift-card / voucher theft or misuse
• Refund and reversal fraud
• Promotion / coupon abuse
• Bot or automated transaction abuse
• Merchant or partner fraud
• Employee or insider misuse
• Cyber-enabled financial fraud

• Customer and account verification
• Authentication and access controls
• Transaction limits
• Velocity and frequency controls
• Device and behavioural indicators
• Voucher issuance and redemption controls
• Refund controls
• API security controls
• Partner controls

The Company shall maintain transaction monitoring controls appropriate to its risk profile and business model. Monitoring may consider transaction value, frequency, velocity, customer behaviour, voucher activity, payment status, account/device indicators and other relevant signals.

• Unusually high-value transactions
• Rapid repeated purchases
• Multiple transactions within short periods
• Repeated failed authentication or verification
• Unusual voucher issuance and redemption
• Multiple accounts showing linked suspicious behaviour
• Repeated refunds or cancellations
• Attempts to bypass transaction limits
• Known fraudulent indicators

Where technology supports risk scoring, transactions or accounts may be assigned risk indicators based on approved rules, models or signals. Risk scores shall support investigation and control decisions and shall be subject to appropriate review.

Alerts shall be prioritised according to potential customer impact, financial exposure, fraud indicators, transaction status, recurrence and other relevant risk factors.

Higher-risk alerts may require manual review. Reviewers shall examine available transaction, customer, account, payment, voucher, device and communication information and document the rationale for the outcome.

Where risk is sufficiently identified, the Company may delay, decline, hold, restrict or otherwise control a transaction or account within its authority and applicable partner arrangements.

• Monitor unusual issuance and redemption patterns.
• Apply appropriate activation and transaction controls.
• Investigate rapid or concentrated redemption activity.
• Monitor suspicious refund or replacement requests.
• Restrict suspected stolen or compromised vouchers where appropriate.

Refund and reversal requests may be subject to verification and risk review. Repeated, unusual or inconsistent refund activity shall be escalated for investigation.

Indicators of account takeover may include unusual login behaviour, credential-reset activity, device changes, transaction behaviour or customer reports. Appropriate account protection and escalation measures shall be applied.

Material fraud alerts and investigations shall be assigned an owner and tracked through appropriate case records, including alert reason, evidence, actions, decision and closure.

Investigations shall be evidence-based and may include transaction history, customer communications, authentication information, device indicators, voucher records, payment data, system logs and partner information, as lawfully available.

Where fraud involves a bank, payment processor, PPI, merchant or other partner, the Company shall coordinate with the relevant party for transaction tracing, blocking, reversal, investigation and other appropriate actions.

• High-risk or ongoing financial exposure
• Multiple affected customers
• Material account compromise
• Organised or repeated fraud patterns
• Significant data or cyber-security concerns
• Legal, regulatory or law-enforcement sensitivity

The Company shall take reasonable steps within its authority to limit further customer loss, secure affected accounts, investigate reported fraud and coordinate appropriate refunds, reversals or partner actions where applicable.

Disputed or unauthorised-transaction claims shall be assessed objectively. The Company shall not automatically conclude that a claim is fraudulent or genuine without reasonable review of available evidence.

Relevant fraud patterns, indicators, confirmed cases and lessons learned may be used to improve fraud rules, monitoring, training and partner controls, subject to confidentiality and applicable data-protection requirements.

Fraud alerts, investigations, evidence references, decisions, communications, restrictions, refunds, reversals and corrective actions shall be retained in accordance with applicable requirements and the Company's record-retention policy.

Fraud monitoring and investigation data shall be collected, accessed, used and retained in accordance with the Company's Data Protection, Privacy, Retention & Record-Keeping Policy.

Fraud rules and monitoring controls should be periodically tested and calibrated using appropriate historical cases, false-positive analysis, emerging fraud patterns and control performance information.

Management may receive reports on fraud attempts, confirmed fraud, prevented losses, alert volumes, false positives, chargebacks, refunds, account restrictions, fraud typologies and remediation.

Relevant employees shall receive periodic training on fraud indicators, escalation, customer handling, transaction controls, social engineering and applicable procedures.

Exceptions shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory and contractual requirements shall continue to apply.

This Policy shall be reviewed at least annually and whenever there is a material change in fraud trends, products, transaction channels, technology, partner arrangements or applicable requirements.