The Criminal Investigation Bureau and CTBC Bank issued a joint consumer alert Saturday telling cardholders to match every digit in a one-time password text to the merchant, currency, and amount shown at checkout before approving mobile-wallet binding— the step fraud rings exploit after phishing for card numbers.
Investigators said recent busts in Taipei involved suspects who harvested credentials through fake utility bills and parcel-fee links, then loaded victims’ cards into wallet apps accepted at luxury counters. Losses in one disclosed ring exceeded NT$1 million across department stores and supermarkets before police seized devices used to relay SMS codes.
How the wallet-binding chain works
Scammers no longer need physical cards. Once they capture a number, expiration date, and verification code from a counterfeit payment page, they attempt to register the card inside a mobile wallet on a phone they control. The bank sends an OTP; if the victim approves without reading the embedded merchant name, the thieves can tap-to-pay within minutes.
CTBC’s weekend notice walks customers through three checks: currency must be New Taiwan dollars unless the cardholder is traveling; the merchant field should name a store the user recognizes; and repeated OTP requests within seconds are a red flag. The bank said it will slow or block bindings when fraud models score a mismatch.
Utility lures still dominate SMS fraud
Separately, Taipower reiterated that electricity reminders list account numbers and billing months without URLs. Criminal groups continue to spoof Taiwan Power logos in messages that urge immediate online payment. Card issuers asked shoppers to call Taipower’s 1911 hotline or dial 165 anti-fraud lines when a message includes a link.
Chargeback limits for victims
Credit-card rules can reimburse unauthorized wallet charges, but investigators warn that delays grow when victims approve OTPs themselves. Documenting the phishing link and filing a police report within 24 hours remains critical for dispute teams. For the holiday shopping stretch, issuers are pushing in-app notifications that show a map pin of the merchant attempting a bind— a feature several Taiwan banks turned on after mid-year fraud spikes.
Merchant liability talks
Department stores are negotiating chargeback splits with acquirers when wallet taps clear before fraud teams flag bindings. Industry lawyers said Taiwan’s Electronic Payment Act updates expected next quarter may clarify how quickly merchants must verify cardholder presence for high-value taps.
County and city agencies said they would post updated timelines on official websites after the long weekend, and urged residents to rely on verified hotlines rather than forwarded chat messages when planning travel or payments.