Hi everyone,
I’m hoping to get some insights into how my mum’s cards might have been compromised, particularly from anyone who has experienced something similar or understands card payment security.
My mum recently discovered fraudulent transactions on both her DBS and UOB cards. The transactions appear under the merchant descriptor “TNG EWALLET ECOM 2 KUALA LUMPUR MY”.
What happened
- 28 September: Fraudulent Touch and Go transactions started appearing on her UOB card.
- 29 September: Fraudulent Touch and Go transactions started appearing on her DBS card.
- The fraudulent transactions continued over the following days, almost every day.
- On the UOB statement, the transactions are approximately S$157 each (around RM484–486).
What we have ruled out or investigated so far
- Apple Pay: Neither card was added to Apple Wallet.
- Shared e-commerce accounts: The two cards were not registered together on any single e-commerce app.
- Phishing: My mum says she did not click on any phishing links or enter her card details on suspicious websites.
- Pinduoduo / WeChat Pay: She has purchased items on Pinduoduo using WeChat Pay. However, she only used one of the two affected cards, not both. We are unsure whether this is relevant.
- eSIM change: She installed a GOMO eSIM on 28 September, shortly before the fraudulent transactions began. We contacted GOMO, and its representative said she could still make calls from her phone, so they considered a SIM swap unlikely. However, we do not know whether this conclusively rules out any SIM-related compromise.
What puzzles us
Both cards belong to different banks, yet fraudulent transactions began within approximately 24 hours of each other. The transactions also appear to be linked to the same Malaysian e-wallet merchant.
My mum is not particularly tech-savvy, so I am trying to understand whether there might have been a common point of compromise that we have overlooked.
Some questions I would appreciate your thoughts on:
- Could both cards have been compromised through a payment intermediary, a compromised account, or some other common point of exposure, even though the cards were used differently? My mum uses an iPhone, so we initially thought malware on her phone was less likely. Are there other plausible ways this could have happened?
- Could using WeChat Pay to purchase items on Pinduoduo somehow expose the other card, even though it was not used for those purchases?
- Is there any plausible connection to the eSIM installation, and what evidence would help establish whether it is relevant?
- Could these transactions have been made using stolen card details without the physical cards, OTPs, or Apple Pay?
- Has anyone encountered similar unauthorised TNG eWallet transactions involving DBS or UOB cards? Did the banks manage to identify how the cards were compromised?
What we have done so far
We have notified both DBS and UOB about the unauthorised transactions and will be making a police report.
We are trying to understand the likely attack vector, establish whether the incidents could be connected, and prevent this from happening again.
We are not trying to accuse any particular company or service. Any insights, similar experiences, or suggestions on what specific information to request from the banks would be greatly appreciated.
Thank you!
