FINZOOPAY SOLUTIONS LLP

1. PURPOSE

This Policy establishes a risk-based framework to prevent, detect, investigate and respond to fraudulent, suspicious or abusive activity involving FINZOOPAY SOLUTIONS LLP, its customers, transactions, gift cards, vouchers, systems and partners.

2. OBJECTIVES

• Reduce fraud losses and customer harm.
• Detect suspicious transaction patterns and account behaviour.
• Apply preventive and detective fraud controls.
• Support timely investigation and escalation.
• Coordinate fraud controls with payment, security, AML/KYC and grievance processes.

3. SCOPE

This Policy applies to customer accounts, payment and transaction flows, gift cards and vouchers, refunds, redemptions, APIs, merchant/partner activity and other relevant digital services.

4. FRAUD GOVERNANCE

Management shall assign appropriate responsibility for fraud risk management and ensure that fraud controls are proportionate to the Company's products, transaction model, risk profile and operational capacity.

5. FRAUD RISK ASSESSMENT

Fraud risks shall be assessed using factors including transaction type, customer behaviour, product design, payment method, channel, geography, device or account signals, partner exposure and historical fraud trends.

6. FRAUD TYPOLOGIES

• Account takeover
• Credential theft and phishing
• Payment instrument misuse
• Transaction manipulation
• Gift card / voucher abuse
• Refund fraud
• Duplicate transaction abuse
• Identity or document misuse
• Bot or automated abuse
• Collusive or coordinated activity
• Merchant / partner fraud

7. PREVENTIVE CONTROLS

• Customer and transaction verification
• Transaction and velocity limits
• Authentication controls
• Device / session controls where available
• Risk-based transaction blocking
• Voucher issuance and redemption controls
• Access controls and segregation of duties

8. TRANSACTION MONITORING

Relevant transactions shall be monitored using rules, thresholds, alerts, manual review or other appropriate mechanisms proportionate to risk.

9. RISK RULES

Monitoring rules may consider transaction value, frequency, velocity, customer history, failed attempts, account age, device or network indicators, beneficiary or counterparty information and other lawful risk signals.

10. ALERT GENERATION

Risk alerts shall be prioritised according to severity and potential impact. High-risk alerts shall be escalated promptly for investigation.

11. MANUAL REVIEW

Where automated controls are insufficient, authorised personnel may conduct manual review of transaction, account, customer and supporting information.

12. TRANSACTION HOLD / DECLINE

Where permitted, transactions may be held, declined, blocked or subjected to enhanced verification when risk indicators meet approved thresholds.

13. CUSTOMER ACCOUNT CONTROLS

Accounts showing credible fraud indicators may be restricted, suspended or subjected to enhanced verification in accordance with applicable procedures and customer-protection requirements.

14. GIFT CARD / VOUCHER FRAUD

The Company shall maintain appropriate controls against voucher code theft, abnormal issuance, rapid redemption, resale abuse, redemption anomalies and other relevant voucher fraud patterns.

15. REFUND FRAUD

Refund activity shall be monitored for unusual frequency, amount, account behaviour, repeated claims, duplicate refunds or other indicators of abuse.

16. COLLUSION & COORDINATED FRAUD

Where multiple accounts, devices, merchants or transactions show coordinated suspicious behaviour, the activity may be reviewed as a linked risk event.

17. FRAUD INVESTIGATION

Investigations shall use relevant transaction records, authentication data, logs, account history, communications and partner information, subject to applicable access and privacy controls.

18. EVIDENCE PRESERVATION

Relevant evidence shall be preserved appropriately for material fraud investigations, disputes, law-enforcement requests or recovery actions.

19. CUSTOMER PROTECTION

Fraud controls shall seek to minimise customer loss and unauthorised activity while providing appropriate review and dispute mechanisms for legitimate customers.

20. FRAUD LOSS MANAGEMENT

Confirmed fraud losses shall be recorded and analysed. Where appropriate, the Company may coordinate recovery, reversal, chargeback, refund or other lawful measures with relevant partners.

21. THIRD-PARTY FRAUD RISK

Payment gateways, banks, processors, merchants and other relevant partners shall be assessed and monitored for fraud risk according to the Company's third-party risk framework.

22. AML / KYC COORDINATION

Potential fraud patterns that may also indicate money laundering, terrorist financing or identity misuse shall be escalated under the AML-CFT & KYC Policy where applicable.

23. CYBER INCIDENT COORDINATION

Fraud involving account compromise, malware, credential theft, data compromise or other cyber events shall also be handled under the Cyber Incident Response & Cyber Fraud Management Policy.

24. METRICS & REPORTING

• Fraud attempts and confirmed fraud
• Fraud loss and recovery
• Blocked / declined transactions
• Transaction monitoring alerts
• Alert conversion and false-positive trends
• Account restrictions
• Refund fraud
• Voucher fraud
• Material partner incidents

25. ROOT-CAUSE ANALYSIS

Material fraud events shall be reviewed to identify control weaknesses, attack patterns, process failures or product vulnerabilities and appropriate remediation shall be assigned.

26. CONTROL TUNING

Fraud rules, thresholds and monitoring logic should be reviewed periodically to balance fraud detection with customer experience and false-positive management.

27. CONFIDENTIALITY

Fraud detection rules, investigation information and sensitive indicators shall be protected from unauthorised disclosure.

28. TRAINING

Relevant personnel shall receive periodic training on fraud typologies, alert handling, escalation, evidence preservation, customer protection and applicable procedures.

29. RECORD KEEPING

Fraud alerts, investigations, decisions, evidence, losses, recoveries and remediation actions shall be retained according to applicable legal, contractual and internal requirements.

30. RESPONSIBILITY MATRIX

31. POLICY EXCEPTIONS

Exceptions shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory or contractual requirements shall continue to apply.

32. REVIEW & AMENDMENT

This Policy shall be reviewed at least annually and following material fraud events, significant losses, control failures, product changes or changes in applicable requirements.

33. APPROVAL