DIGITTPAY SOLUTIONS LLP

This Policy establishes the framework for prevention, detection, escalation, investigation, containment, recovery and post-incident review of cyber fraud and information-security incidents affecting DIGITTPAY SOLUTIONS LLP, its customers, gift card/voucher services, systems, partners or data.

• Prevent and reduce cyber-enabled fraud and abuse.
• Detect suspicious activity promptly.
• Protect customers, transaction systems, voucher value and Company information.
• Establish clear incident escalation and response responsibilities.
• Preserve relevant evidence and maintain an auditable incident trail.
• Coordinate recovery, customer protection and corrective actions.

This Policy applies to cyber fraud, account takeover, credential compromise, phishing, social engineering, malicious code, unauthorised access, voucher theft or misuse, payment-related fraud, data compromise, API abuse, insider misuse and other material cyber or fraud incidents within the Company's environment or involving relevant third parties.

• Account takeover / credential compromise
• Phishing and social engineering
• Gift card / voucher theft or misuse
• Payment or transaction fraud
• API or application abuse
• Malware / ransomware events
• Unauthorised system access
• Data breach or unauthorised disclosure
• Insider misuse
• Third-party security or fraud incident

• Risk-based transaction limits and velocity controls
• Customer verification and authentication
• Least-privilege access controls
• Security monitoring and logging
• Fraud rules and anomaly detection
• Secure application and API controls
• Employee security awareness
• Vendor risk management
• Backup and recovery controls

• Unusual transaction frequency or value
• Multiple failed authentication attempts
• Rapid purchase and redemption patterns
• Unusual account or device behaviour
• Suspicious credential changes
• Unexpected refund or reversal activity
• Repeated activity across apparently linked accounts
• Known malicious indicators or partner alerts

Employees, customers, vendors and relevant partners should have appropriate channels to report suspected cyber fraud or security incidents. Reports shall be directed to designated support, security, risk or compliance channels as applicable.

• Identification and reporting
• Initial triage and classification
• Containment
• Investigation and evidence preservation
• Eradication / remediation
• Recovery and validation
• Post-incident review

The response team shall assess what happened, affected systems/accounts, potential customer or financial impact, immediate security risks, evidence requirements and whether external escalation may be required.

Appropriate containment may include disabling compromised accounts, revoking credentials or tokens, restricting transactions, blocking malicious activity, isolating systems, suspending affected integrations or applying temporary controls. Actions shall be proportionate to risk and documented where material.

Where an incident may affect customers or voucher value, the Company may apply transaction holds, account protection, credential resets, voucher restrictions, refunds or other protective measures as appropriate and lawful.

• Preserve relevant logs and system records.
• Record material response actions and timestamps.
• Protect evidence from unauthorised alteration.
• Restrict evidence access to authorised personnel.
• Coordinate with legal or law-enforcement requirements where applicable.

Investigations should determine the incident scope, attack or fraud indicators, affected assets, customer/financial impact, root causes and required remediation. Findings should be documented proportionately to incident severity.

Where required or appropriate, the Company may coordinate with banks, payment partners, technology providers, insurers, legal advisers, regulators, cyber-security authorities or law-enforcement agencies, subject to applicable requirements and contractual arrangements.

Material communications shall be coordinated through authorised personnel. Communications shall be accurate and timely while avoiding disclosure of sensitive information that could increase security or fraud risk.

Potential financial or voucher fraud shall be coordinated with Risk/Fraud and Finance teams for transaction review, holds, reconciliation, recovery assessment, refunds/reversals and evidence preservation as applicable.

Compromised accounts or credentials may be suspended, reset, revoked or subjected to enhanced verification. Recovery shall require appropriate validation of legitimate ownership where relevant.

Vendor or partner incidents affecting Company services, customer information or transaction processing shall be managed through this Policy and the Third-Party / Vendor Risk Management Policy.

Systems shall be restored through controlled recovery procedures. Recovery shall include security validation, reconciliation, monitoring for recurrence and confirmation that material customer or transaction records remain accurate.

Material incidents shall be reviewed to identify root causes, control gaps, lessons learned, financial/customer impact and corrective actions. Actions shall be assigned owners and tracked to closure.

A suitable incident register should capture incident reference, date/time, severity, affected systems, summary, actions, escalation, evidence, resolution and corrective actions.

The Company should periodically conduct incident-response exercises, phishing awareness activities, tabletop scenarios or other security drills proportionate to risk.

Personnel shall receive appropriate training on phishing, social engineering, credential protection, fraud indicators, incident reporting and response responsibilities.

Incident information, evidence and investigation material shall be handled confidentially and shared only with authorised personnel or parties with a legitimate need or legal basis.

Incident records, evidence references, investigation findings, communications and corrective actions shall be retained according to applicable legal, contractual and Company retention requirements.

Exceptions shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory, security or contractual requirements shall not be bypassed.

This Policy shall be reviewed at least annually and following material cyber fraud incidents, significant technology changes, audit findings or changes in applicable requirements.