Protect access
Use trusted devices, independent strong credentials and multi-factor authentication. Account security uses authenticator codes, session controls, scoped permissions and independent reviews. Production controls and incident response will be assessed against each provider’s requirements.
Review payment details
Check beneficiary and merchant details, currency, amount and reference. Treat requests to change bank details or share access codes as high-risk. Verify the request through a known channel before acting.
Report suspected fraud
Contact the bank or provider responsible for a real transaction using its verified channel. Retain the relevant dates and references. Protect the device, revoke unnecessary access where available and follow the provider’s instructions. Keep credentials and identity documents out of public enquiries.
Lost device or compromised integration
Use the verified provider route to report loss or suspected compromise. If your role permits, revoke the affected session or integration credential and review recent activity. Use the approved recovery process before adding a replacement device or issuing a new key.
Provider responsibilities
Effective service terms must explain authentication and exemptions where applicable, incident reporting, lost device and account recovery procedures, and rights when a payment is unauthorized or incorrectly executed.
Approval and publication requirements
Approve the production security plan, fraud monitoring and incident roles, service contacts, applicable authentication model and customer disclosures.