The Financial Supervisory Commission urged cardholders on Wednesday to read one-time password texts carefully as public flu and COVID-19 vaccinations began, warning that scammers reuse clinic appointment lures to capture OTPs and bind cards to mobile wallets.
Banks said appointment-booking traffic spiked after the Taiwan CDC opened phase-one shots for seniors, toddlers, pregnant women and high-risk adults. Fraud units reported fresh SMS templates that mimic clinic reminders and then steer users to fake payment pages asking for card numbers and OTPs.
What the FSC told issuers
Banking Bureau officials repeated long-standing guidance: never enter an OTP unless the currency, amount and merchant match a purchase you initiated, and hang up if a caller claims a vaccine booking requires card verification. Issuers were told to lower alert thresholds for first-time mobile-wallet bindings during October, when legitimate clinic copays and pharmacy charges also rise.
Major Taiwanese banks push real-time push notifications for foreign-currency charges and wallet provisioning. The FSC said customers who receive a binding alert without enrolling Apple Pay, Google Pay or Samsung Pay should freeze the card through the mobile app and call the printed number on the card back—not a link in the message.
Health tokens add a new wrinkle
The Health Promotion Administration said adults earning health tokens for flu, COVID-19 or pneumococcal shots must still register through official clinic systems; tokens are not redeemable for cash but can be exchanged for goods starting December 1. Consumer groups asked banks to separate token-marketing SMS traffic from fraud filters so legitimate Ministry of Health messages are not blocked.
Clinic staff do not need your card security code to give a government-funded dose. CDC Director-General Lo Yi-chun said peak influenza visits could reach 150,000 per week this month, increasing the chance that rushed patients tap phishing links on crowded waiting-room Wi-Fi.
Issuer steps this month
CTBC, Cathay United and Taishin said they would extend call-center hours on weekends through October and waive chargeback filing fees for verified wallet-fraud cases reported within 48 hours. The FSC asked e-commerce platforms to flag sellers that demand card photos for “vaccine registration deposits,” a pattern the Criminal Investigation Bureau flagged in August phishing statistics.
Cardholders planning travel after their shots should still notify issuers of overseas dates, bankers said, because legitimate clinic charges and duty-free spending can otherwise trigger automated blocks that push users toward scam “verification” sites.