Keeping you and your money safe is our top priority, and we have stringent safeguarding measures in place to help protect all our customers. But there are also steps you need to take to protect yourself from fraud.
To help you identify potential scams and stay safe, we’re publishing a series of articles on fraud protection. This article looks at digital wallet scams.
What is a digital wallet scam?
Digital wallet scams involve fraudsters stealing your debit or credit card details and using them to add your card to a digital wallet, such as Apple Pay, Google Wallet or Samsung Pay, on a device they control.
Digital wallets allow you to make payments using your smartphone or another connected device, without needing to use your physical bank card. While they can offer additional security and convenience, fraudsters can exploit the process of adding a card to a digital wallet if they can obtain your card details and any verification information required by your bank.
The scam will often begin with a phishing message, fake advert or bogus website, which will trick you into entering your personal and card details.
The fraudster can monitor this information in real time and use your card details to set up a digital wallet on their own device. You may then receive a one-time passcode (OTP) from your bank, which the scammer will try to trick you into providing. They can use this code to complete the wallet registration and begin spending from your account.
Digital wallet fraud can be particularly concerning because it can easily go undetected. Your card can remain safely in your wallet while someone else uses its details to make payments.
An example of a digital wallet scam
John was preparing for a holiday overseas and received a text message that appeared to be from a well-known parcel delivery company. The message explained that a small fee was required because a delivery could not be completed and provided a link to arrange redelivery.
The message looked convincing and John was expecting a parcel, so he followed the link. He was taken to a website that appeared to belong to the delivery company and was asked to enter his name, address and card details to pay the small fee.
John entered the requested information and was then told that he would receive a verification code from his bank to complete the payment. A few moments later, John received a one-time passcode by text message.
The website asked him to enter the code, explaining that it was needed to confirm the payment. John entered the code and received confirmation that his payment had been processed.
After returning from his holiday, John noticed several unusual transactions on his bank account. He checked his phone and discovered a notification from his bank stating that his card had been added to a digital wallet.
John had not added his card to a digital wallet and contacted his bank immediately. It became clear that the original message had been a scam. The fraudster had used John's card details to add his card to their own digital wallet and had used the one-time passcode to complete the registration.
Although John's physical card had never left his wallet, the fraudster had been able to use its details to make fraudulent payments.
Five tips on how to protect yourself from recovery scams
1. Be wary of unexpected messages
Exercise caution if you receive an unexpected email or text message asking you to make a payment or provide personal or financial information, particularly if they are trying to create a sense of urgency by claiming that a payment needs to be made immediately or that you will face a penalty if you do not act.
If you receive an unexpected message, take a moment to consider whether it is genuine. Avoid clicking on links and contact the organisation directly using official contact details.
2. Never share one-time passcodes
Never share a one-time passcode with another person unless you are certain about what you are authorising.
Your bank will never ask you to disclose a security code simply because someone has contacted you unexpectedly. If you receive a code for an action you did not request, contact your bank immediately.
3. Check websites carefully
Before entering your card details online, make sure you are using the genuine website of the organisation you intend to deal with. Check the web address carefully and be particularly cautious if you have reached the site through an unexpected email, text message or online advert.
If you are unsure, close the website and navigate to the organisation's official website directly rather than following a link in a message.
4. Turn on payment notifications
If your bank or card provider offers payment notifications through its mobile app, consider turning them on as these alerts can help you identify unusual transactions early.
You should also pay attention to notifications telling you that your card has been added to a digital wallet. If you receive one and you did not add the card yourself, contact your bank immediately.
5. Keep your accounts secure
Use strong, unique passwords for your online accounts and enable two-factor authentication or two-step verification where available. You should also keep your phone, computer and banking apps updated to ensure you have the latest security protections.
If your bank offers additional ways to approve the addition of a card to a digital wallet, such as approval through its mobile app, consider using these features. No security measure is completely foolproof, but taking advantage of the available protections can make it harder for fraudsters to access your accounts.
If someone targets you
If you suspect you are being targeted by a digital wallet scam, stop communicating with the scammer and do not provide any further information or security codes.
If you have entered your card details into a suspicious website or believe your card has been added to a digital wallet without your permission, contact your bank or card provider as soon as possible. They can help secure your account, cancel your card and investigate any fraudulent transactions.
If you have lost money to a scam, you should report it to Report Fraud, the UK's national reporting centre for fraud and cyber crime, by calling 0300 123 2040 or using its online reporting service.
You can also report suspicious emails, text messages, phone calls, social media messages and websites to Report Fraud, even if you have not lost money.
If you’ve been a victim, you can also get free specialist help from Victim Support.
More information on digital wallet scams
Digital wallet scams are just one of the many ways fraudsters can exploit stolen personal and financial information. Staying alert to suspicious messages and understanding how scammers try to obtain your card details can help you avoid becoming a victim.
Several organisations provide further information and guidance on fraud prevention. Report Fraud has resources covering different types of fraud and cyber crime, while UK Finance also provides guidance on protecting yourself from scams.
As well as checking the FCA’s Register and Warning List, you can also find other information for consumers and firms on the FCA website.
Finally, we’re always more than happy to help our customers. If you’ve got any concerns or questions about the security of your Currencies Direct funds, or need guidance in relation to a transfer, please do get in touch.
You might also want to read our article on phishing scams, as digital wallet scams often begin with fraudulent emails, text messages or websites designed to steal personal and financial information.
