UNAUTHORISED TRANSACTION MANAGEMENT POLICY

This Policy establishes the framework for receiving, investigating, containing, resolving and recording customer reports of unauthorised transactions, account compromise, payment misuse, fraudulent gift-card/voucher activity and related financial loss.

• Provide a clear process for customers to report suspected unauthorised activity.
• Protect customers and reduce further loss after a report.
• Verify and investigate transaction allegations using available evidence.
• Coordinate holds, reversals, refunds and partner actions where appropriate.
• Preserve evidence and maintain complete case records.
• Identify recurring fraud patterns and strengthen preventive controls.

This Policy applies to unauthorised or disputed transactions involving customer accounts, payment transactions, gift cards/vouchers, purchases, redemptions, refunds, account access or other transaction activity within the Company's operational scope.

Customers may report suspected unauthorised activity through authorised customer-support channels published by the Company. Employees and partners shall report suspected incidents through designated internal escalation channels.

• Customer name and contact information
• Transaction or order reference
• Date and amount of transaction
• Gift-card/voucher reference where applicable
• Payment reference where available
• Description of the unauthorised activity
• Relevant supporting information

On receipt of a credible report, appropriate controls may include account restriction, transaction hold, voucher suspension, credential reset, payment-partner escalation or other measures proportionate to risk and operational capability.

Each material unauthorised-transaction complaint shall be assigned a case or reference number and recorded with status, owner, actions, evidence and resolution.

The responsible team shall assess the transaction status, customer history, authentication information, account activity, voucher status, payment information and available fraud indicators.

Investigation shall use relevant system logs, transaction records, customer communications, authentication events, payment references, device or account indicators and partner information, as appropriate and lawfully available.

Where ongoing loss is reasonably suspected, the Company may apply appropriate holds or restrictions within its authority and contractual capabilities. Partner-dependent actions shall be escalated to the relevant partner.

Where a transaction is determined to be eligible for reversal or refund, the Company shall coordinate with Finance and the relevant payment or partner channel. Any refund or reversal shall be subject to applicable terms, evidence, transaction status and legal/partner requirements.

Before disclosing sensitive transaction information or processing certain account-level changes, the Company may conduct reasonable customer verification to reduce the risk of social engineering or fraudulent claims.

Cases indicating account takeover, identity theft, voucher theft, organised fraud, cyber attack or other material fraud shall be escalated under the Cyber Fraud Prevention & Incident Response Policy.

Where the transaction involves a bank, payment processor, PPI or other payment partner, the Company shall coordinate transaction tracing, status confirmation, holds, chargeback/reversal processes or other available remedies as applicable.

Customers shall receive clear updates appropriate to the case. The Company shall avoid disclosing sensitive security information that could compromise fraud controls or an investigation.

• Unauthorised activity confirmed
• Unauthorised activity not established
• Insufficient evidence / further information required
• Transaction reversed or refunded
• Partner investigation pending
• Fraud investigation escalated
• Case closed after customer or operational resolution

• High – ongoing loss, significant customer impact, account takeover, material data exposure or widespread fraud.
• Medium – credible unauthorised activity requiring investigation but with limited ongoing exposure.
• Standard – isolated or low-risk complaint requiring normal investigation.

Relevant transaction records, logs, communications, payment references, voucher records and other evidence shall be preserved according to investigation and retention requirements.

Information collected during unauthorised-transaction investigations shall be handled in accordance with the Company's Data Protection, Privacy, Retention & Record-Keeping Policy.

Case records shall include complaint details, investigation actions, evidence references, communications, decisions, refunds/reversals, partner correspondence and closure information, as applicable.

Material or recurring unauthorised-transaction cases shall be analysed to identify weaknesses in authentication, fraud controls, voucher controls, customer journeys, partner processes or employee procedures.

• Fraud-rule enhancement
• Transaction-limit adjustment
• Additional verification
• Account-security improvements
• Voucher-control enhancement
• Partner remediation
• Customer awareness
• Employee training

Management may receive periodic information on unauthorised transaction volumes, financial impact, resolution status, refund/reversal trends, fraud typologies, repeat cases and control remediation.

Exceptions shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory and contractual requirements shall continue to apply.

This Policy shall be reviewed at least annually and after material fraud incidents, significant product or partner changes, or material changes in applicable requirements.