Security awareness: Digital pickpockets

A quick guide from iFAST Global Bank on the new wave of “digital pickpocketing” and the simple steps that keep you safe. 

What is “digital pickpocketing”? 

It’s when a fraudster adds your debit or credit card to a digital wallet on their device and then spends in shops or online. 
They don’t need your physical card. Instead, they lure you to a fake site (e.g., a bogus parcel-fee page or “verification” screen) and get you to enter your card details and a one-time passcode (OTP). That OTP actually authorises adding your card to a wallet — not paying a fee. Once added, they can tap-to-pay and shop online immediately. 

How the scam typically unfolds 

1. You tap a convincing ad/link or message and land on a look-alike website. 
2. The site asks for personal data and card details (number, expiry, security code). 
3. A prompt appears: “Enter the code to finish the payment.” At the same time, your bank sends an OTP — because someone is trying to add your card to a digital wallet. 
4. You enter the OTP on the fake site. The criminal completes wallet setup on their phone and starts spending. 

Five ways to stay safe 

1. Never share or type an OTP outside your bank’s app. No bank or retailer will ask you to read out or key in an OTP on a third-party site or to a caller. 
2. Add cards to wallets only via your bank app. If you want to set up Apple/Google Pay, start in the banking app and follow its prompts. If you get an unexpected “your card was added to a wallet” alert, contact us immediately. 
3. Treat links like needles. Don’t tap payment/delivery links in messages; go directly to the official website or app. 
4. Switch on spend and wallet alerts. Enable push notifications for card transactions and new wallet/device enrolments. 
5. Secure your phone. Use a strong screen lock; hide SMS previews on the lock screen; keep your OS/apps updated; consider a password manager and turn on multi-factor authentication for email and key accounts. 

How iFAST Global Bank helps protect you 

A numberless card for less exposure. The iFAST Multi-Currency Debit Card (UK residents only) shows only your name; sensitive details live securely in-app. If the card is lost, there’s no printed data to steal — and you stay in control. 

Built-in controls that work for you: 

• Card data stored and encrypted in the app 
• Instant card freeze/unfreeze in a tap 
• Generate fresh card details without replacing your physical card 

If you think you’ve been targeted 

• Freeze your card in the app and contact us right away. 
• Review recent transactions and dispute anything unfamiliar. 
• Change passwords on your email and banking app if you entered them on a suspicious site. 
• Report the scam to the appropriate authority in your country (e.g., the national fraud reporting service). 

The most powerful defense is awareness. Please share this guide with anyone who might need it. 
Stay alert, stay secure.