Haripay INDIA PRIVATE LIMITED

This Policy establishes the framework for receiving, recording, investigating and resolving customer reports of transactions, purchases, activations or redemptions that the customer claims were not authorised by them.

Haripay shall act according to its actual role and contractual arrangements. Where an authorised PPI issuer, bank, payment processor or other regulated partner controls the transaction, authentication, dispute or refund process, Haripay shall coordinate and provide relevant information rather than represent that it independently controls the regulated process.

• Provide a clear reporting channel.
• Protect customers against unauthorised activity.
• Contain ongoing risk where appropriate.
• Investigate using available evidence.
• Coordinate with relevant partners.
• Process eligible refunds/reversals according to applicable rules.
• Maintain complete case records.

This Policy applies to suspected unauthorised purchase, activation, redemption, account access, payment or other transaction activity relating to Haripay-supported gift cards, vouchers and virtual products.

• Customer denies making the transaction
• Customer reports compromised credentials
• Unknown gift-card purchase
• Unknown redemption
• Account takeover indicators
• Payment instrument misuse
• Suspicious change in customer details followed by transaction

Customers should report suspected unauthorised activity promptly through the officially published support/grievance channels. The report should include the transaction/reference number and relevant details where available.

1. Receive complaint.
2. Create case/reference number.
3. Record date and time.
4. Capture available transaction details.
5. Classify severity.
6. Apply immediate protective measures where appropriate.
7. Assign investigator.
8. Track case to closure.

• Temporary transaction restriction
• Account/session restriction where applicable
• Credential reset or security verification
• Blocking a compromised voucher/code where technically and contractually possible
• Partner notification
• Preservation of relevant evidence

Protective measures shall be proportionate and shall not unnecessarily restrict legitimate customer activity.

Before disclosing sensitive transaction information or making account changes, reasonable verification shall be performed using approved procedures. Passwords, PINs or OTPs shall not be requested through insecure or unauthorised channels.

The investigator shall review available transaction records, authentication information, timestamps, device/channel indicators where available, redemption information, customer communications, partner records and relevant system logs.

Where the transaction was processed by a PPI issuer, bank, payment provider, merchant or other partner, the case shall be escalated through the documented partner process. Relevant evidence shall be shared only as permitted by law and contract.

Suspected unauthorised transactions shall also be assessed under the Fraud Prevention & Transaction Monitoring Policy and Cyber Incident Response & Cyber Fraud Policy where applicable.

Where an unauthorised transaction is established or a refund/reversal is otherwise approved, processing shall follow the Refund, Cancellation & Chargeback Policy and the relevant partner/network rules.

Where a payment dispute or chargeback is initiated, the responsible payment/partner process shall be followed. Evidence and response deadlines shall be tracked.

After investigation, the case may be classified as confirmed unauthorised, suspected but inconclusive, authorised/valid, duplicate/technical issue, fraud-related or other appropriate category. The decision shall be documented with supporting evidence.

Customers shall be informed of material case outcomes and next steps, subject to security, confidentiality, partner and legal limitations.

• Material financial loss
• Repeated or linked unauthorised transactions
• Account takeover
• Systemic compromise
• Cybersecurity incident
• High-value transaction
• Partner dispute
• Law-enforcement or regulatory request

• Transaction/reference data
• Authentication records where available
• System/API logs
• Redemption records
• Customer complaint
• Partner communications
• Relevant screenshots or documents
• Investigation decisions

Case information shall be accessed on a need-to-know basis and protected according to applicable data-protection requirements and Haripay's Data Protection, Privacy & Retention Policy.

Customer-facing materials may include basic security guidance such as protecting OTPs, passwords, PINs and gift-card codes and reporting suspicious activity promptly.

Material cases shall have an assigned owner, status, action history, evidence, decision and closure date. Cases shall not be closed without recording the basis for closure.

A case may be reopened where new evidence is received, the customer provides material additional information, a partner changes its decision or a continuing risk is identified.

• Number of unauthorised transaction cases
• Financial value
• Confirmed vs inconclusive cases
• Response time
• Refund/reversal outcomes
• Repeat cases
• Partner-related cases
• Root causes
• Control improvements

Relevant personnel shall be trained on customer verification, fraud indicators, secure communications, evidence handling, escalation and applicable partner procedures.

Periodic reviews may test case registration, investigation quality, customer communication, evidence preservation, refund decisions and partner escalation.

Any exception shall be documented, risk-assessed and approved by an authorised function. Mandatory legal, regulatory or partner requirements shall not be overridden.

This Policy shall be reviewed at least annually and whenever there is a material change in fraud patterns, product design, technology, partner arrangements or applicable requirements.