Teaching case. This case is a composite based on typical Nepali businesses. Names are withheld and the figures are illustrative, chosen to make the calculations realistic.

Overview

Spike in social‑engineering and SIM‑swap attempts forced a wallet provider to redesign flows. The goal: reduce successful fraud while preserving a fast checkout.

Background

Fraudsters called customers pretending to be wallet staff and asked for the OTP “to verify the account”. Others persuaded mobile operators to issue a replacement SIM card for a victim’s number (SIM swap), so that OTPs went to the fraudster. Once inside, they changed the PIN and moved the balance to other accounts within minutes. Each case harmed a customer, and news of the scams damaged trust in digital payments generally.

Controls Implemented

  • Risk scoring per transaction (amount, device, IP, velocity) with step‑up auth for risky events.
  • Device binding + push‑based approval replacing SMS OTP for high‑risk actions.
  • Transaction limits by tier (KYC level); cooling‑off periods after profile changes.
  • Customer education banners and in‑app tips; rapid takedown flow for reported scams.

Outcomes

  • Fraud loss rate down 60% in 3 months; checkout success preserved on low‑risk paths.
  • Fewer support tickets; clearer incident runbooks.

Lessons (Unit 4 lens)

  • Defense‑in‑depth beats single controls; tune thresholds to market behavior.
  • Education matters—social engineering bypasses pure tech controls.

The Numbers

  • Fraud losses before the changes: about Rs. 0.8 for every Rs. 10,000 of transactions.
  • A 60% reduction brings this to about Rs. 0.32 per Rs. 10,000.
  • Step-up checks applied only to about 3% of transactions (new device, large amount, recent PIN change), so 97% of payments stayed fast.
  • A 24-hour cooling-off period after a PIN or device change blocked most fast cash-out attempts.

Case Questions

  1. Which security threats from Unit 4 appear in this case? Explain how each attack works.
  2. Why is SMS OTP weak against SIM swap attacks, and how does device binding help?
  3. Explain risk-based (step-up) authentication. How does it balance security and convenience?
  4. Why does the case stress customer education even after technical controls are added?
  5. Draft three short in-app warning messages the wallet could show its customers.

Chapters covered

Use the unit notes below to review the theory this case applies in practice.