FRAUD PREVENTION & TRANSACTION MONITORING POLICY

This Policy establishes a risk-based framework to prevent, detect, investigate and respond to fraud and unusual transaction activity associated with REMPINDIA MULTITRADE PRIVATE LIMITED's gift-card and gift-voucher business. Controls shall operate within the Company's role and the responsibilities allocated to authorised PPI, bank and payment partners.

• Reduce fraud losses and customer harm.
• Identify suspicious or abnormal transaction behaviour at an early stage.
• Maintain appropriate transaction-monitoring controls.
• Support timely investigation, blocking, restriction and escalation.
• Preserve evidence and maintain audit trails.
• Coordinate effectively with authorised partners and competent authorities where required.

This Policy applies to gift-card/voucher purchases, activations, redemptions, refunds, cancellations, customer accounts, payment activity, merchant activity, APIs, devices, digital channels, partner transactions and related operational processes within the Company's control.

Management shall establish fraud-risk ownership and ensure appropriate resources, controls and escalation arrangements. Risk/Fraud and Compliance shall periodically review fraud trends, material incidents and control effectiveness.

Fraud risk shall be assessed across customers, products, channels, payment methods, transaction behaviour, devices, geography, merchants, partners and technology. New products or material changes shall undergo fraud-risk assessment before or during controlled launch.

• Account takeover and credential compromise
• Identity misuse or synthetic identity indicators
• Stolen payment instrument use
• Unauthorised gift-card purchase
• Gift-card / voucher redemption abuse
• Refund and cancellation abuse
• Multiple-account or coordinated activity
• Bot or automated transaction abuse
• Promotion / coupon abuse where applicable
• Merchant or partner misuse
• Social-engineering related fraud
• Other emerging digital-payment fraud patterns

The Company and relevant partners shall use risk-based monitoring appropriate to the transaction flow. Monitoring may include rules, thresholds, velocity checks, behavioural indicators, device signals, payment signals and manual review.

• Unusually high transaction value
• High transaction frequency or velocity
• Repeated failed transactions
• Multiple cards, accounts or identifiers associated with one risk pattern
• Rapid purchase followed by redemption
• Unusual refund or cancellation patterns
• Repeated changes to customer or payment details
• Multiple transactions from suspicious devices or technical patterns
• Activity inconsistent with expected customer behaviour
• Known fraud indicators received from partners or authorities

1. Generate or receive the alert.
2. Record the relevant transaction and risk indicators.
3. Prioritise the alert based on risk.
4. Conduct initial review.
5. Request additional information where appropriate.
6. Decide whether to release, restrict, block, reverse or escalate the activity according to authority and partner arrangements.
7. Record the decision and evidence.

Transactions or accounts identified as higher risk may be placed into an appropriate review process. Reviews shall be documented and handled by authorised personnel.

Where permitted by the Company's role and partner arrangements, suspicious activity may be temporarily restricted, blocked or referred to the relevant authorised PPI/bank/payment partner. Controls shall be applied consistently and documented.

Fraud controls shall seek to prevent customer harm while avoiding unnecessary restrictions. Customer communications shall be accurate and shall not disclose confidential investigation information where such disclosure could compromise security or an investigation.

Reports of unauthorised transactions shall be handled under the Unauthorised Transaction Policy, including verification, investigation, partner coordination, evidence review and applicable refund/reversal processes.

Fraud indicators that may indicate money laundering, terrorist financing or other financial crime shall be escalated under the AML/CFT Policy and to the relevant regulated partner where applicable.

The Company shall maintain appropriate procedures for communicating material fraud events, transaction details, evidence and required actions to authorised PPI, bank, payment and technology partners.

Material fraud incidents, coordinated attacks, significant customer impact, large-scale misuse or repeated control failures shall be escalated promptly to management and relevant partners.

Fraud investigations shall be proportionate to risk and may include transaction history, account information, device or technical information, payment records, communications and partner data, subject to applicable law and privacy requirements.

Relevant evidence shall be preserved securely, including transaction identifiers, timestamps, logs, alerts, communications, approvals and partner correspondence. Evidence shall be protected against unauthorised alteration or deletion.

Material cases shall have a case record containing the incident summary, risk assessment, actions taken, responsible owner, supporting evidence, partner coordination, outcome and closure rationale.

Fraud losses, prevented losses and recoveries may be recorded and analysed to identify control weaknesses and emerging patterns.

Monitoring rules and thresholds shall be documented, tested and reviewed periodically. Changes to material rules shall be subject to appropriate approval, testing and change control.

The Company shall seek to reduce unnecessary customer disruption by periodically reviewing false-positive rates and improving risk-based controls without weakening material fraud safeguards.

Third parties supporting fraud monitoring or transaction processing shall be subject to appropriate due diligence, security requirements, confidentiality obligations and performance monitoring.

Fraud-monitoring data shall be accessed only by authorised personnel and processed according to applicable privacy, security, retention and contractual requirements.

Relevant employees shall receive periodic awareness on fraud typologies, monitoring indicators, customer protection, evidence handling, escalation and confidentiality.

Management reporting may include fraud volumes, prevented losses, confirmed losses, recovery, alert volumes, investigation ageing, major typologies, customer impact, partner incidents and remediation actions.

Fraud controls may be tested through sample reviews, rule testing, scenario testing, internal audit, partner assurance or other appropriate mechanisms.

Fraud alerts, cases, decisions, evidence, customer communications, partner correspondence and material reports shall be retained according to applicable legal, regulatory, contractual and business requirements.

Exceptions to material fraud controls shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory and partner controls shall not be bypassed.

This Policy shall be reviewed at least annually and whenever there is a material change in fraud patterns, product design, transaction channels, partner arrangements, technology, applicable requirements or risk profile.