How supermarket till vouchers become criminals fast cash tool
· Citizen
Gift vouchers and other value-added services sold at supermarket tills may present a much broader fraud risk than previously thought, with criminals able to convert stolen or fraudulently obtained funds into digital value that can be transferred and redeemed within minutes.
Visit h-doctor.club for more information.
A recent article in The Citizen highlighted the case of an elderly KwaZulu-Natal pensioner who lost more than R421 000. This was after criminals allegedly used his stolen bank card to buy Pick n Pay gift vouchers across multiple tills at the same Umhlanga store over two days.
Pensioner loses more than R421000
At the time, Pick n Pay described the incident as unprecedented and maintained that the fraud had been committed against the customer rather than the retailer.
It said the transactions had appeared legitimate because they were authenticated using a chip and PIN card and that it had subsequently tightened its systems to prevent similar abuse.
Private investigator Brad Nathanson, who is acting on behalf of the pensioner, believes the case may point to a much wider problem.
“I don’t believe my client is the only person. I think there are perhaps millions of rands that have gone through retailers in this fashion,” he said.
A senior retail executive with direct knowledge of security and fraud detection systems also alleged to The Citizen that fraudulent value-added service transactions may have cost retailers millions of rands over the past six months. “It’s not only limited to gift vouchers,” said the source.
“Almost any voucher can be purchased in the same manner. There have been no less than eight instances where I have personally investigated fraudulent transactions using the same tactics as had occurred in Umhlanga.”
Not only limited to gift vouchers
The source said transactions investigated included various top-up services, bill payments processed through commonly used systems and betting vouchers.
These products fall into a broader category of value-added services, which allow customers to purchase digital products or services directly at till points.
Nathanson said their nature made them attractive to organised crime fraudsters because the proceeds could potentially disappear before a victim or bank had time to intervene.
Standard Bank said gift vouchers were particularly attractive to criminals because they could be transferred and redeemed rapidly.
The problem is not necessarily confined to stolen cards. Social engineering sees criminals deceiving victims into approving transactions themselves, often through a one-time password (OTP), banking app or other authentication method.
The money can then be converted into vouchers or other digital products and redeemed almost immediately.
Standard Bank, Absa say authenticated OTP app approval not treated as unauthorised
Both Absa and Standard Bank told The Citizen that whether the customer authenticated a transaction was critical to how the subsequent dispute was handled.
Standard Bank said where a transaction was fully authenticated through an OTP, in-app approval or USSD approval completed by the cardholder, it did not treat the transaction as unauthorised, even when the customer had been deceived by a fraudster into approving it.
Absa said that an authenticated transaction would not ordinarily trigger a chargeback on the basis that it was unauthorised.
Where only card details were provided and the transaction was not authenticated, however, the issuing bank could initiate a chargeback, with liability resting on the acquiring side.
Both banks made an important distinction between whether a payment was authorised and whether the customer actually received what was purchased.
Standard Bank said an unauthorised transaction was treated differently from a dispute, where a customer acknowledged making the payment but argued that the goods or services were not delivered as agreed.
Separate processes for different disputes
Absa similarly confirmed that it had separate processes for different disputes, including fraudulent transactions and goods not received.
In simple terms, Absa said that once a transaction was disputed, the bank first established what type of dispute it was and whether liability rested with the issuing or acquiring bank.
With sufficient information, the issuing bank could trigger a chargeback through the acquiring bank and merchant. For an authenticated transaction, a recovery process involving the goods or voucher could instead apply.
And that is where evidence of what happened to the voucher becomes important. Absa said information required during such a recovery process could include order details, the voucher beneficiary’s contact information, delivery records, proof of issuance and redemption and email or SMS delivery confirmations.
The source said an investigation could establish what was purchased, who received it and whether the goods or digital value reached the legitimate customer.
“It’s just that nobody’s taking responsibility,” the source said. “The question becomes: why are banks not flagging transactions that clearly fall outside a customer’s normal spending patterns?”