Compensation Policy

Under Article 29-2, Paragraph 1, Item 5 (*1) and Article 31, Item 4 (*2) of the Cabinet Office Ordinance on Fund Transfer Service Providers: our policy on compensating losses arising from unauthorized transactions in connection with our fund transfer service, and other related measures, together with the measures we take to communicate this policy (Administrative Guideline II-2-6-1)

1Measures relating to the following matters of the compensation policy

AWhether and to what extent we compensate the victim for loss arising in each specific scenario where loss may occur, depending on the nature of the fund transfer service, and any conditions attached to compensation

(1)Account takeover and impersonation

• Credentials stolen through phishing: a fake email or social-media message impersonating us leads the user to a fake site, where their ID, password and one-time passcode (OTP) are captured in real time and used to log into the account.
• Password-list attacks (credential stuffing): ID/password lists leaked from other services are used to automatically try logging into our service, taking over the account.
• Theft or loss of the phone or device used for payment: the device is stolen or lost while unlocked, or with biometric lock improperly bypassed, and whoever ends up with it transfers the balance to another account while the app remains usable.

(2)Abuse of the top-up process

• Unauthorized top-up and use via a linked bank account: an attacker uses someone else's bank account details (account number, PIN) obtained unlawfully to link that account to the app and charge or withdraw funds through it.
• Unauthorized top-up and use via fraudulently registered card details: someone else's card details, obtained through channels such as the dark web, are registered to the app, charged up to its limit, and cashed out via transfer to a different account.

(3)Targeted scams and social engineering

• Transfers induced by fake investment schemes or romance scams: using social media or dating apps to build a false sense of affection or familiarity, or investment ads impersonating public figures, the user is misled into repeatedly sending large sums from their own account to a scammer-designated account.
• Transfers made via phishing sites: a phishing site, under the guise of "security verification" or "confirming the recipient," misleads the user into following on-screen instructions that direct a transfer to the attacker's account.

(4)Misuse by close relatives, and related disputes

• A close relative of the user (including family, friends, or a partner) operates the user's account, resulting in high-value charges or other use of the account.
• An employee with transfer authority, acting within their role at a corporate user, deliberately bypasses internal approval processes and diverts funds to a personal account or one used for money laundering.

(5)Where the user bears gross negligence

(6)Compensation where (5) does not apply

• That said, where responsibility for an incident under (1)-(3) falls within the remit of a payment brand or issuer as the responsible party, the compensation scope or determination under that brand/issuer's own terms of service will take priority.
• Matters concerning our terms of service, the compensation scope and determinations under each brand/issuer's terms, and this compensation policy are published on our website.

BThe compensation procedure

(1)Reporting deadline and method

• A user who has suffered, or fears they may suffer, loss falling within scenarios (1)-(3) above through deposits, use, or transfers relating to their account (referred to below as "unauthorized use") must complete the following within 30 days of the date the unauthorized use occurred.
• Notify us promptly of the incident through our designated contact form, or our dedicated phone line (03-6279-4570).
• File a police report for the unauthorized use at the nearest police station, and report the case reference number (or an equivalent certificate) issued by the police to us without delay.

(2)Submitting supporting documents

• Following the report under (1) above, the user must, on request, submit identity-verification documents, evidence of the unauthorized use (such as communication logs or screenshots of the app), and any other documents or information we determine necessary for our investigation, by the date we specify.

(3)Investigation and compensation

• On receiving the user's report and supporting materials, we investigate the facts together with relevant parties (the payment brand/issuer, partner financial institutions, the police, and others as needed). Where the investigation confirms the user qualifies under this policy's exemption criteria (i.e., no gross negligence), we compensate the direct loss caused by the unauthorized use, up to any compensation cap we have set, using the method we determine.

(4)Duty to cooperate

• The user must fully cooperate with any investigation or procedure carried out by us or a public authority such as the police to determine the cause of an incident, identify the perpetrator, or recover the loss. If the user refuses to cooperate without reasonable grounds, we may withhold compensation or seek repayment of compensation already provided.

CHow compensation is shared between the fund transfer business and partner services where we provide a connected service (including who acts as the party compensating the victim)

Note: for the matters set out in this Section C, Article 29-2, Paragraph 1, Item 5, and Article 31, Item 4 of the Ordinance do not require us to disclose to users the full content of our contractual arrangements with partner services on this point — but they do require, at minimum, that users be informed of who acts as the party compensating the victim.

• Where unauthorized use occurs through our service integrations, we and Alipay or WeChat Pay jointly investigate the cause, and compensate affected users as set out below.
• Where the incident stems from an issue on the Alipay or WeChat Pay side — such as a leak of authentication credentials on their service — compensation follows that service's own terms.
• Where the division of responsibility is clear and the incident is found to originate in our own system, we act as the compensating party and cover the user's loss.
• Where the cause or the division of responsibility cannot be clearly determined, and the incident involves both services, we and Alipay or WeChat Pay respond jointly to compensate the user promptly, and agree the cost-sharing split between us through consultation.

DContact point for compensation enquiries, and its details

So that our compensation terms are easy to check, we publish the content of this policy on our website, and accept enquiries through the contact point below.

Dedicated phone line: 03-6279-4570

ECriteria for publicly disclosing an incident

(1)When we decide to disclose

Taking into account the nature and scale of the impact, we disclose an incident promptly where we judge that any of the following applies:

• The unauthorized use risks spreading to affect multiple users (secondary harm), making a public warning necessary.
• Sharing information about the method used would help others avoid or prevent similar incidents.
• The total loss or number of affected users is judged significant enough to have broader social impact.

(2)What we disclose

When disclosing, we take into account the privacy of victims and other parties, and any impact on an ongoing investigation, and share the following:

• A summary of the incident and when the unauthorized transactions occurred
• The number of cases and the total loss (including estimates)
• The method used, as far as confirmed
• The compensation procedure and contact point for affected users
• Findings on the cause, and steps taken to prevent recurrence

(3)How and when we disclose

• Once we have reviewed the incident and confirmed the facts, we disclose promptly, with the aim of preventing secondary harm and alerting users.
• We publish the information on our website and, after reporting to and coordinating with the relevant authorities as needed, issue a press release to inform the media.

2Measures for informing users and others of the fund transfer business of this policy

①Users

• When a user enters into a contract with us, we obtain their agreement to a contract and terms of service covering Sections 1.A-E above, and publish the same on our website.

②Non-users (where Article 31, Item 4 applies)

(Is this policy made available in a way that a person other than a user of the fund transfer business — who may bear a loss if an unauthorized transaction occurs — can also readily learn of it?)

Because our service connects partner stores with the National Tax Agency and Customs (including the tax-refund system), and refunds the consumption tax after departure to the user via the Alipay or WeChat Pay payment system, loss may in some cases arise for someone other than the user themselves. For this reason, we state that this policy also covers non-users in our terms of service (set out in Article ○○) and on our website (see: ○○).

If you have any questions about this policy, or a specific matter you'd like to discuss, please feel free to reach out through our contact form.