Insights for consumers
Never share one-time passcodes with anyone. One-time codes are the final security check before a payment is processed. Once entered, they confirm that a transaction is authorised and cannot be reversed. If someone asks for your one-time passcode, stop.
Insights for providers
When a scam is reported, act quickly. We expect clear explanations and empathy. Even if recovery is unlikely, consider taking practical steps to support your customer.
Scam responsibility while travelling overseas
Aria* was travelling in Bali and checked into a hotel on 9 December 2025. As part of the process, she shared her passport and card details with the hotel’s reception staff. She paid for her stay and made a small purchase at the hotel bar. Soon after, Aria received a phone call from her credit card provider. The caller knew Aria’s date of birth and described her recent transactions at the hotel as well as two payments she knew nothing about. One payment was for $1,445.47 and the other was for $3,703.42.
Aria asked the caller to reverse the two unknown transactions, to which they agreed. The caller asked for the last four digits of Aria’s card number and email address, which she provided. Then they told Aria to expect some one-time passcodes which were needed to reverse the transactions. Aria received the codes and read them out, as instructed.
About an hour later, Aria realised she had been scammed. She contacted the credit card provider straight away and the card was cancelled. Aria was told the payments could not be reversed as they had been authorised using one-time passcodes. Aria felt distressed and confused.
Aria complained to FSCL.
Was it fair to hold the customer responsible?
Aria said she was deceived by a convincing scam, when she thought she was stopping fraudulent transactions. She acted quickly after realising what had happened and felt it was unfair to be held responsible. She thought that the credit card provider should have done more to support her.
The credit card provider said the payments were authorised even though one payment was still pending at the time they were notified. This is because once the one-time passcodes are entered, the transactions cannot be reversed.
How FSCL assesses responsibility for scams
We looked at the card’s terms and conditions, the law, and industry best practice. We reviewed what happened after the scam was reported, and whether the response was fair and reasonable.
We focused on two questions.
- Who was responsible for the transactions?
- Did the provider respond appropriately after the scam?
Responsibility for authorised transactions
We accepted that Aria was the victim of a scam. However, by sharing the passcodes with the scammer, she had approved the payments.
The card provider’s terms and conditions required Aria to protect security information and keep her card safe, including not sharing one-time security codes or account information with anyone else. We found Aria was responsible for the payments, because she had provided the one-time security passcodes to the scammer.
One-time passcodes are the final security check before a payment is processed. Once entered, they confirm that a transaction is authorised and cannot be reversed, even if they briefly show as pending.
The provider’s response after the scam
Aria contacted the provider quickly, despite being overseas and distressed. The provider had correctly explained that the transactions could not be reversed. However, we found that the advice was limited, and there was little effort to reassure or guide Aria. The explanation lacked clarity and empathy.
We also considered whether more could have been done, such as a request to recall the funds. Even if unlikely to succeed, it shows an effort made.
We found a lost opportunity to support Aria, adding to her stress and frustration.
We did not hold the provider responsible for the payments, as Aria had approved the transactions under the terms and conditions. However, we partially upheld the complaint, as we found that the provider’s response after the scam was not fair.
We decided the provider should pay $500 to recognise Aria’s distress and the lost opportunity to offer her some support.
Both parties accepted our proposal, and the complaint was closed.
Morgan’s view
Morgan’s financial mentor said that this was irresponsible lending. The financial mentor pointed towards inaccuracies in Morgan’s expenses and income that the credit card company used in their assessment of her ability to repay.
What was FSCL’s view?
After investigating, we found that the credit card company had not reasonably inquired into Morgan’s income. In her credit application, Morgan had correctly recorded her net weekly income amount and said that she was employed. However, this was a mistake – Morgan’s only income for the past decade had been from ACC payments. And the lender had not obtained any documentation to verify Morgan’s income.
We said that if the credit card company had complied with their obligation under the CCCFA and made reasonable inquiries into Morgan’s income, they would have found this inaccuracy. We also said the credit card company could reasonably have identified that Morgan’s ACC payments would soon cease because ACC eligibility ends once a person turns 65. Morgan’s income would then be from New Zealand superannuation, which was going to be considerably less than her ACC income.
There was also an issue with Morgan’s declared expenses. Morgan used very conservative estimates of her expenses, because she misunderstood the categories the credit card company used in their application. The credit card company then compared these to average benchmark figures, which show what an average person in Morgan’s demographic was spending, and took the higher of the two. The credit card company did not request any further information from Morgan to verify her expenses.
After analysing Morgan’s actual spending during the three months before her application, we found that the credit card company had underestimated Morgan’s total expenses. This meant that when they completed their affordability assessment, they took Morgan’s disposable income (or income that could be used to make repayments) to be considerably higher than it actually was.
How did FSCL suggest that the complaint should be resolved?
We said that there was evidence of irresponsible lending.
As a result of this finding, and in line with the remedy set out at section 89(1)(aaa) of the CCCFA, we suggested to the credit card company that they should settle the complaint by removing all fees and interest and crystalise the remaining debt. We also suggested that they provide non-financial loss compensation for the stress they had caused Morgan of $600.
The parties accepted this resolution, and we then helped the parties agree on an affordable repayment plan to pay off the principal debt.
