Banking app prompt contained clear warnings that transaction was a scam

Categories:

Fraud & scams, Cards, Chargebacks,

Summary:

In February 2026, Manuel advertised an item through an online marketplace, and an apparently genuine buyer sent him a link. Manuel said the link took him to a fake NZ Post website and then to a fake bank website. He entered his credit card details because he believed this was necessary to receive payment for the item. His card details were then used to pay for a booking at a hotel in Dubai totalling $4,112. Manuel approved a prompt asking him to check the transaction details sent to the banking app on his phone. He said he did not read the message. He contacted the bank immediately after seeing the transaction as pending. The bank cancelled his card, issued a replacement, and later tried to recover the funds through a chargeback on the basis that the merchant did not provide the services. The merchant’s bank responded to the chargeback request with evidence that someone had used the booking. The bank did not pursue the chargeback further, and also refused to otherwise reimburse Manuel.

Published:

July 2026

Our investigation

Manuel believed he was approving a step to receive payment from the buyer and was unaware of the overseas payment instruction, so the transaction was therefore unauthorised. This meant he was entitled to reimbursement under the online fraud guarantee – provided he took reasonable care during the transaction. However, the prompt asking Manuel to check the transaction details showed that someone was using his credit card, and that the merchant was overseas. It also showed the amount of the transaction in a foreign currency. Manuel acknowledged that he approved the prompt without reading it. In our view, a reasonable person would have read the alert before confirming the transaction was genuine. Had he done so, he would have seen that the transaction details did not match what he believed he was doing. We therefore found Manuel did not take reasonable care, so the bank did not have to reimburse him.

The bank could not dispute the transaction through a chargeback for reasons of fraud because Manuel had confirmed it through the card issuer’s authentication process. The bank still attempted a chargeback on the basis that Manuel did not receive the service he had paid for – namely, accommodation in Dubai. But the merchant’s bank supplied evidence that the booking had been used. The relevant question under this chargeback ground was whether the service was provided, not who used it. Accordingly, we found the bank acted reasonably by not challenging the response to its chargeback request.