UNAUTHORISED TRANSACTION & CUSTOMER PROTECTION POLICY

This Policy establishes the framework for receiving, investigating and resolving reports of unauthorised transactions, account compromise, voucher misuse and related customer-protection incidents associated with REMPINDIA's gift-card and gift-voucher business.

• Provide a prompt and structured response to suspected unauthorised activity.
• Protect customers from avoidable financial and security harm.
• Coordinate with relevant PPI, bank, payment and merchant partners.
• Preserve transaction and technical evidence.
• Prevent duplicate or fraudulent claims.
• Identify systemic issues and implement corrective measures.

This Policy covers unauthorised purchases, unauthorised redemptions, account takeover, compromised voucher credentials, payment misuse, fraudulent refunds and other customer-protection events within the Company's role.

Customers should report suspected unauthorised transactions as soon as reasonably possible through the designated support or partner channel. Reports should include available transaction/order references, date, amount, voucher details and contact information.

Each material report shall be assigned a case or complaint reference where appropriate. The case record shall capture the reported event, time received, transaction identifiers, initial risk assessment and actions taken.

• Secure or restrict the affected account or voucher where permitted.
• Coordinate with the relevant payment/PPI partner for transaction status.
• Prevent further misuse where technically and legally possible.
• Preserve relevant logs and evidence.
• Inform the customer of safe next steps without disclosing confidential investigation details.

Reasonable authentication shall be performed before disclosing sensitive information or making account-level changes. Authentication controls shall be proportionate to the risk and shall not create unnecessary barriers for genuine fraud reporting.

1. Verify the reported transaction.
2. Review account, payment and voucher status.
3. Review activation/redemption and relevant system logs.
4. Check fraud and transaction-monitoring alerts.
5. Coordinate with partners where required.
6. Assess customer and transaction risk.
7. Document findings and decision.
8. Communicate the outcome through an approved channel.

Evidence may include transaction IDs, payment references, timestamps, account records, voucher status, activation/redemption logs, device or security logs, customer communications and partner confirmations, subject to applicable privacy and legal requirements.

Where an unauthorised transaction is confirmed or otherwise eligible for remediation, reversal/refund shall be handled under applicable product terms, law and partner procedures. The Company shall avoid duplicate compensation for the same loss.

Cases requiring action by a PPI issuer, bank, payment processor, card network, merchant or other partner shall be escalated through documented partner contacts and within applicable timelines.

Suspected organised fraud, identity misuse, money laundering, terrorist financing or other financial crime indicators shall be escalated under the Fraud Prevention and AML/CFT Policies and to the relevant regulated partner where applicable.

Communications shall be clear, factual and security-conscious. Customers shall not be asked to disclose passwords, OTPs, PINs or other authentication secrets through insecure channels.

• Protect passwords, PINs, OTPs and voucher credentials.
• Use official customer-support channels.
• Report suspicious activity promptly.
• Provide accurate information during investigation.
• Do not share confidential investigation information with unknown third parties.

Where risk is sufficiently established and the Company's systems or partner arrangements permit, an affected account, voucher or transaction may be blocked or restricted pending investigation.

Repeated false claims, fabricated evidence or abuse of the unauthorised-transaction process may be escalated and may result in restrictions consistent with applicable terms and law. Genuine customers shall not be penalised merely for reporting suspected fraud.

Appropriate remediation may include account recovery, voucher replacement where permitted, refund/reversal, correction of records, security reset or other reasonable action based on the investigation outcome.

Material cases shall be analysed to identify weaknesses in authentication, product design, fraud rules, partner processes or customer communications. Corrective actions shall be tracked.

Case records, evidence, communications, decisions, refunds/ reversals, partner correspondence and corrective actions shall be retained according to applicable legal, regulatory, contractual and business requirements.

Case information shall be restricted to authorised personnel and shared only when necessary and permitted. Personal information shall be handled according to applicable privacy and security requirements.

Periodic reporting may include number and value of reported unauthorised transactions, confirmed fraud, refunds/reversals, recovery, ageing, repeat incidents, root causes and outstanding actions.

Relevant employees shall receive training on fraud reporting, customer authentication, evidence preservation, customer communication, escalation and privacy.

Management may conduct periodic sample reviews of cases to assess timeliness, evidence quality, customer treatment, decision consistency and control effectiveness.

Exceptions to this Policy shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory or partner requirements shall not be bypassed.

This Policy shall be reviewed at least annually and whenever there is a material change in fraud patterns, products, payment methods, partner arrangements, technology or applicable requirements.