Digital Wallet Fraud: Methods, How It Works, and How to Prevent It

Your debit or credit card can remain safely tucked in your wallet, but its data can move to someone else's phone with just one code you share. This is the essence of digital wallet fraud (digital wallet fraud): criminals do not need to steal your device; they only need to convince you to hand over your card details and verification code. 

Once the card is enrolled in the criminal's digital wallet, payments go through like ordinary transactions. This article summarizes the most common digital wallet fraud methods, why this fraud is hard to recognize, and the preventive steps you can take now. 

Key Takeaways

• Digital wallet fraud generally starts with phishing or social engineering that tricks victims into sharing card details and one-time codes.
• Tokenization secures card data, but it does not ensure that the wallet user is the legitimate cardholder.
• Never share OTP codes, check the list of digital wallets in your banking app, and immediately report suspicious transactions.

What Is Digital Wallet or e-Wallet Fraud?

Digital wallet fraud occurs when someone pays through a digital wallet using credentials they are not authorized to use. 

According to Stripe, criminals can add stolen card details to their own wallet, exploit tokenized card credentials, or take over the victim's wallet account to access stored payment methods. 

The wallets referred to here are services that store debit and credit cards, such as Apple Pay, Google Pay, and Samsung Pay, which Fraud.com cites as examples.

Read Also: BIS Reveals New Potential for XRP Ledger for the Digital Financial System

Tokenization replaces the actual card number with a random code that is useless if stolen. However, Stripe emphasizes that tokenization does not ensure that the person using the wallet is the legitimate account holder. 

The gap lies in the card enrollment stage. If criminals manage to bypass this stage, the payment carries valid tokens, cryptograms, and biometric authentication, making it look just like a legitimate transaction.

The same vigilance applies to all digital financial accounts, including crypto asset accounts. If you want to invest through an OJK-licensed platform, open an account at Bittime and apply the same security habits from the start. 

Image: Generated by AI

Common Digital Wallet Fraud Methods

Phishing and OTP Code Theft

CommBank clearly describes the flow. Victims receive an SMS or email that appears to come from a bank, mobile operator, or government agency, then are directed to a fake site to enter card details. 

The system then sends a verification code (called NetCode at CommBank), and the victim is tricked into sharing it. With the card details and that code, the criminal enrolls the card into a digital wallet on their phone, tablet, or watch. According to Tieto Banktech, a card enrolled in the criminal's wallet can be used without a PIN.

Read Also: Popular Tokenized Stocks 2026: Technology Shares Become Investors' Favorite

Social Engineering

Criminals call while pretending to be bank staff, then claim the victim's digital wallet has been hacked. They exploit panic to make victims hand over passwords or verification codes, as in the example described by Stripe. Fraud.com adds that criminals also often impersonate customer service to gain victims' trust.

SIM Swapping

Criminals trick the mobile operator into moving the victim's phone number to their own SIM card. As a result, messages and calls containing one-time codes fall into the criminal's hands, and control over the victim's digital wallet can be taken over, according to Stripe.

Read Also: 10+ Best AI Coins 2026: Here's the List of Artificial Intelligence-Themed Cryptos! 

Malware, Fake Apps, Public Wi-Fi, and Device Theft

Fraud.com notes several other channels: malware that steals payment data, fake digital wallet apps or sites, data interception over public Wi-Fi, and device theft. Regarding stolen devices, Stripe notes that a combination of the phone and screen lock code is enough for criminals to misuse the victim's digital wallet.

Why This Fraud Is Hard to Recognize and How Banks Fight It

For merchants, transactions from a compromised wallet are almost indistinguishable from legitimate transactions, so disputes and chargeback only emerge later, according to Stripe. For banks, defenses must be put in place from the moment a card is enrolled.

Tieto Banktech developed a Token Enrolment Monitoring (TEM) system that compares each card enrollment attempt with the customer's habits, such as IP address, language, and location. 

If something seems off, the process is stopped and the bank contacts the cardholder. Based on the company's data, TEM alone stops 70 to 80 percent of digital wallet enrollment fraud attempts. Meanwhile, the digital wallet enrollment-related cases they handled rose 100 percent from 2024 to 2025.

Read Also: 10 Largest RWA Crypto Asset Tokenizations in the World

A phishing wave in late summer 2025 showed how this layered defense works. Around 3,000 cases were stopped at TEM with no losses, while 600 cases slipped through and resulted in transactions. 

Of that number, 300 transactions were stopped by Card Transaction Monitoring (CTM), and losses on the remaining 300 were partially mitigated. These figures come from Tieto Banktech's own service, so they are best read as an illustration of patterns, not industry statistics.

How to Prevent Digital Wallet Fraud

• Never share verification codes. Stripe reminds us that banks will not ask customers to read out an SMS code to add a card to a digital wallet. CommBank adds that PINs and passwords should not be given to anyone, including those claiming to be from the bank.
• Be suspicious of every link. Carefully inspect SMS or email containing links, even if the message appears in the same thread as an official company contact.
• Check the list of digital wallets in your banking app. Some banks provide a feature to review and remove unrecognized digital wallets, such as CommBank's Review digital wallets feature. Check whether your bank has a similar feature.
• Lock your device properly. Use a strong password, PIN, or biometrics, and always update apps and the operating system.
• Download from official sources. Install wallet apps only from official app stores and avoid public Wi-Fi when transacting.
• Enable notifications and monitor transactions. Transaction notifications help you catch suspicious activity faster.

Read Also: Legal Crypto Apps in Indonesia 2026: How to Check OJK-Licensed Platforms

Steps to Take If You Become a Victim

Contact your bank as soon as possible to block the card and remove unrecognized digital wallets, then change your passwords and PIN. After that, report the incident to Indonesia Anti-Scam Centre (IASC) via iasc.ojk.go.id. OJK also urges the public to beware of fake sites impersonating IASC.

The scale of digital fraud in Indonesia is quite large. From operating on November 22, 2024 to January 14, 2026, IASC received 432,637 complaints with total losses of IDR 9.1 trillion and successfully blocked funds worth IDR 436.88 billion, according to an OJK press release. 

As of April 29, 2026, the number of reports rose to 548,093 and blocked victim funds reached IDR 614.3 billion, as reported by investortrust.id based on an OJK presentation. It should be noted that this figure covers all types of digital financial fraud, not specifically digital wallets.

Conclusion

Digital wallet fraud exploits gaps in people and in the card enrollment stage, not in data encryption. Therefore, the most effective defense starts with simple habits: do not share verification codes, do not open links carelessly, regularly check digital wallets linked to your cards, and report immediately when you find unrecognized transactions. 

Banks and service providers continue to strengthen detection systems, but user vigilance remains the first layer.

Check the prices of Bitcoin (BTC), Ethereum (ETH), XRP, Solana (SOL), GRAM, and BNB as well as leading memecoin DOGE. You can trade directly on Bittime!

Bittime is a licensed Digital Financial Asset Trader (PAKD) platform supervised by the Financial Services Authority — where you can buy Bitcoin in Indonesia and hundreds of other crypto assets starting from IDR 10,000. The registration process is fast, secure, and can be started today.

Monitor the conversion USDT to IDR and the price movements of your favorite crypto assets in real time. Everything is available in one crypto investment app that can be downloaded for free on the Play Store.

Ready to start? Register now at Bittime and execute your investment strategy with a platform trusted by millions of users in Indonesia.

FAQ

Is a digital wallet safer than a regular card?

Generally yes, because tokenization and device authentication reduce risk, according to Stripe. Even so, gaps remain in the card enrollment stage and in user negligence.

Can my card be enrolled in a digital wallet without my phone?

Yes, if the criminal holds the card details and verification code obtained through phishing (CommBank). Therefore, verification codes must not be shared with anyone.

How do banks detect suspicious card enrollment?

One way is by comparing the IP address, language, and enrollment location with the customer's habits, as in the TEM system from Tieto Banktech. If something seems off, the process is stopped and the customer is contacted.

Where should I report if I become a victim of digital financial fraud?

Contact your bank first, then report to OJK's IASC via iasc.ojk.go.id.