DIGITTPAY SOLUTIONS LLP

This Policy establishes a risk-based framework for preventing, detecting, investigating and responding to fraudulent or suspicious transactions and account activity involving DIGITTPAY SOLUTIONS LLP.

• Reduce fraud losses and customer harm.
• Detect suspicious transaction and account patterns.
• Apply proportionate preventive and detective controls.
• Support timely investigation and escalation.
• Protect gift card/voucher value and transaction integrity.
• Continuously improve fraud controls using data and incident learnings.

This Policy applies to customer accounts, gift cards/vouchers, purchases, redemptions, refunds, cancellations, payment activity, APIs, applications, employee activity, partner transactions and other relevant services.

Fraud risk shall be managed through defined ownership, risk assessment, monitoring, preventive controls, investigation, reporting and corrective action. Material risks shall be escalated to authorised management.

• Account takeover
• Identity misuse
• Payment fraud
• Gift card / voucher theft or abuse
• Promo or coupon abuse
• Refund abuse
• Duplicate or synthetic accounts
• Automated / bot activity
• Transaction manipulation
• Insider misuse
• Collusion or third-party fraud

• Customer and account verification
• Authentication and access controls
• Transaction limits and velocity controls
• Device/session and behavioural indicators where lawfully available
• API security and rate limiting
• Voucher issuance and redemption controls
• Refund and cancellation controls
• Employee access restrictions
• Third-party risk controls

Transactions and relevant account activity may be monitored using rules, thresholds, behavioural indicators, alerts, manual review and other proportionate controls. Monitoring parameters shall be reviewed periodically based on fraud trends and business risk.

• Unusually high transaction amount
• Rapid repeated transactions
• Multiple transactions within a short period
• High-volume voucher purchase or redemption
• Multiple accounts sharing suspicious characteristics
• Unusual refund-to-purchase patterns
• Repeated failed authentication
• Unusual changes in account or payment information
• Transactions inconsistent with normal account behaviour

Fraud alerts shall be reviewed using available evidence and appropriate prioritisation. Alerts may be cleared, escalated, placed under enhanced monitoring or result in temporary controls based on the investigation.

Where implemented, transaction or account risk scores may combine relevant indicators to support decisioning. A score is a risk-management input and should not be treated as conclusive proof of fraud.

Depending on risk and applicable rules, the Company may allow, challenge, delay, hold, decline, cancel, restrict or subject a transaction to additional verification or review.

Additional verification may be requested where transaction or account behaviour presents elevated risk. Verification shall be proportionate and consistent with the KYC / Customer Verification Policy.

• Monitor purchase and redemption velocity
• Detect unusual redemption patterns
• Protect voucher credentials and codes
• Apply limits or restrictions where appropriate
• Review rapid transfer or resale indicators
• Coordinate with issuer or partner systems where relevant

Refund and reversal requests may be assessed for abuse indicators, including repeated refunds, mismatched payment details, unusual timing or suspicious account behaviour.

Fraud investigations may use transaction history, account information, authentication records, system logs, voucher lifecycle records, customer communications and relevant partner information, subject to lawful access.

Material fraud cases should have a case reference, classification, evidence record, investigation outcome, actions taken and closure rationale.

Confirmed or suspected material fraud shall be escalated to Risk/Fraud, Information Security, Compliance, Legal, Finance or Management as appropriate. Cyber incidents shall follow the Incident Response Policy.

Where fraud risk is credible, appropriate measures may include transaction holds, account restrictions, credential resets, voucher restrictions, refunds or other protective actions, subject to evidence and applicable rules.

The Company shall coordinate with payment gateways, banks, voucher issuers, technology vendors and other relevant partners for fraud alerts, investigations, evidence, reversals and remediation.

Fraud losses and recoveries should be tracked where material. Root causes, loss trends and control effectiveness should be periodically reviewed.

Fraud monitoring shall use information lawfully available for authorised fraud-prevention purposes and shall follow applicable privacy, security and data-retention requirements.

Where automated fraud rules or models are used, material changes should be documented, tested and monitored for effectiveness, excessive false positives and unintended customer impact.

The Company shall seek to minimise unnecessary customer friction by periodically reviewing rules, thresholds and alert outcomes and adjusting controls based on evidence and risk.

• Fraud attempts and confirmed fraud
• Fraud loss and recovery
• Alert volumes and conversion
• False-positive trends
• Chargeback/dispute correlation
• Top fraud typologies
• Control performance and ageing of open cases

Relevant personnel shall receive training on fraud typologies, monitoring alerts, customer verification, investigation procedures, evidence handling, escalation and confidentiality.

Fraud alerts, investigations, decisions, evidence references, actions and material reporting shall be retained according to applicable requirements and the Company's Data Retention & Record-Keeping Policy.

Exceptions shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory, contractual or security requirements shall not be bypassed.

This Policy shall be reviewed at least annually and following material fraud incidents, major product or payment changes, audit findings or significant changes in the threat environment.