NZ Wallet Scam: Why a $4,800 Chargeback Failed

Q: Can I dispute a purchase made through a digital wallet?

Sometimes. It turns on the facts, the network rules and timing — including whether goods were already supplied by merchants unaware the card was compromised. Report immediately and dispute in writing.

The short answer: a New Zealand consumer lost $4,800 after fraudsters used his card details and a one-time passcode to add his card to a digital wallet — and the ombudsman held that his provider was reasonable not to refund him. A passcode can enrol your card in a wallet, not just approve one payment, so never enter one unless you are certain the request is genuine — and report it immediately if you suspect a scam, before the wallet is used.

What happened in the FSCL case

New Zealand's Financial Services Complaints Ltd (FSCL) published the case in its October 2026 warning, "Beware of fraudsters using one-time passcodes to add cards to digital wallets", alongside its 2025/26 Annual Report. The same case was reported by Inside Retail on October 28, 2026, as scam disputes hit a record high. The consumer, named "Tom" (name changed for privacy), clicked a link in a text message that appeared to be from NZ Transport Agency Waka Kotahi about an unpaid toll. He entered his credit card details and a one-time passcode — and, unbeknown to him, his card was added to a Google Pay wallet. Nine days later, three purchases totalling $4,800 were made at three stores using the wallet.

The scale behind the case is striking: FSCL investigated 532 disputes in its 2025/26 reporting year, the highest number in its history and a 49 percent increase on the year before, with sophisticated scams and fraud complaints rising. Tom disputed the three purchases with his card provider, saying he had not authorised them.

Why the chargeback was unavailable

The provider declined to refund Tom because the card had been added to the digital wallet using the correct authentication process, including the one-time passcode. Its terms and conditions required customers to protect their card details and one-time passcodes, and treated the use of a one-time passcode as authorisation. FSCL accepted Tom was the victim of a scam — but held that, while he did not intend for his card to be added to a digital wallet, the terms and conditions still applied.

The provider gave a second, practical reason a chargeback was not available: the purchases had been made through a digital wallet after the goods had already been supplied by merchants who had no way of knowing the card details had been compromised. FSCL also found the provider had not known the card details were compromised before the transactions occurred, and had acted promptly once suspicious activity was detected. In those circumstances, FSCL considered it reasonable for the provider not to refund the transactions. As a goodwill gesture, the provider refunded $207 in interest charges, which FSCL considered a fair outcome.

Note the nine-day gap, which FSCL singled out: there was more than nine days between the card being added to the wallet and the disputed transactions taking place. That gap mattered to the outcome — it was time in which the compromise could, in principle, have been spotted and the card cancelled before the wallet was used.

Why this is not a universal rule

This is one ombudsman case on one provider's terms, in New Zealand — not a rule that every wallet fraud claim fails. Whether a chargeback or refund is available depends on the card network's rules, the provider's terms, how the card was enrolled, and when the compromise was reported. In other jurisdictions, unauthorised-use protections may treat the same facts differently, and a genuinely stolen card with no passcode shared is a different case from one where a passcode was entered on a scam page. Do not read this case as "wallet purchases can never be disputed" — read it as a warning about what a passcode can authorise.

What to do if this happens to you

Stop and call your provider immediately if you think you entered card details or a one-time passcode on a scam website. FSCL's own advice is blunt: acting quickly may allow the provider to cancel the card or take steps to prevent any loss. Speed is the whole lesson of the nine-day gap.
Ask the provider to cancel the card and remove it from every wallet — not just to block one transaction. A card enrolled in a wallet stays usable until it is removed.
Never share or enter a one-time passcode unless you are certain the request is legitimate. Financial Ombudsman Susan Taylor's warning in the FSCL release is the sentence to remember: "A one-time passcode can also be used to approve actions such as adding your card to a digital wallet." If in doubt, contact your card provider directly — never through a link in the message.
Dispute in writing and keep the timeline. Note the date of the message, the date the card was enrolled (ask your provider), and the date you reported it. If the dispute is denied, ask for the reasons in writing and check the denial against our denied-dispute guide before escalating to your local ombudsman.

FAQ

Does entering a one-time passcode always mean I authorised the payment?

Not always — it depends on your provider's terms and your jurisdiction. In Tom's case, FSCL held that the provider's terms treated the passcode as authorisation, and that those terms still applied even though he did not intend to enrol his card in a wallet. That is a case-specific finding, not a universal law.

Can I dispute a purchase made through a digital wallet?

Sometimes. A chargeback may be unavailable where, as here, the goods were already supplied by merchants who had no way of knowing the card was compromised — but that turns on the facts, the network rules and timing. Report immediately and dispute in writing; do not assume the answer in advance.

What if I only just realised I entered a passcode on a scam site?

Call your card provider now, before any wallet purchase happens. Cancelling the card before it is used is far more effective than disputing purchases after goods have been supplied.