No data breach despite unauthorised transactions on Fevo cards: EZ-Link

Following its detection of unauthorised overseas transactions made via the Fevo Mastercard prepaid cards, electronic payment system provider EZ-Link has clarified on Fri (3 May) that no data was compromised in the process.

EZ-Link, a subsidiary of the Land Transport Authority (LTA) and Mastercard Worldwide, added that the CEPAS cards were not affected.

Responding to queries from The Straits Times, EZ-Link said: “We would like to assure EZ-Link Cepas cardholders that the unauthorised transactions apply to EZ-Link’s Fevo Mastercard cards, and do not apply to all local EZ-Link Cepas cards used in Singapore for transit.”

It added that the suspicious transactions were “not a case of data breach” and that “No system was compromised”.

EZ-Link also clarified that it has issued refunds to the affected cardholders after alerting them to the unauthorised transactions, in addition to deactivating all affected cards and issuing replacement cards to affected customers for free.

In a statement on Friday (3 May) at 4.09 p.m., however, Fevo Prepaid Mastercard stated that ST had “erroneously reported” the incident as a data breach in an earlier version of the article published the same day at 10.20 a.m.:

The original version of the article was quoted in full by a Redditor on r/singapore on the same day at 2:18 p.m.:

Comment
byu/stforumtroll from discussion
insingapore

The ST article was then updated at 6:55 pm the same day.

Separately, Mastercard told ST on Fri that EZ-Link had notified the credit card payment provider of the unauthorised transactions, and that consequently, it has taken “urgent steps” to investigate and address the vulnerability.

“We continue to implement a multi-layered approach to maximise technology advancements to provide broader protection to our customers and cardholders.

“We also encourage cardholders to regularly review their account statements and activity, and call their issuing financial institution for assistance if they suspect unauthorised transactions,” said Mastercard.

Fevo is a transit card that doubles up as a payment card, and may be used on all public buses and trains, as well as for in-store and online purchases at at all EZ-link merchants and partners in Singapore and all Mastercard merchants globally.

It can also be used at Electronic Road Pricing (ERP) and parking gantries.