New Zealanders are being urged to take extra care with one-time passcodes after a victim of a sophisticated scam lost $4800 when fraudsters used the code to add his credit card to a digital wallet.

The warning comes as Financial Services Complaints Ltd (FSCL) reports a sharp rise in financial services disputes and scam-related complaints.

According to FSCL’s 2025/26 Annual Report, the organisation investigated a record 532 disputes during the year, a 49% increase on the previous reporting period.

The report also highlights a growing number of sophisticated fraud and scam complaints.

One case involved a man, identified as Tom (name changed for privacy reasons), who received a text message that appeared to be from NZ Transport Agency Waka Kotahi about an unpaid toll.

Believing the message was genuine, he clicked a link and entered his credit card details with a one-time passcode. Unbeknown to him, they used the information to add his card to a Google Pay wallet.

Nine days later, three purchases totalling $4800 were made at separate stores using the digital wallet.

Tom disputed the transactions with his credit card provider, arguing he had not authorised the purchases.

However, the provider declined to refund the money, saying the card had been added to the digital wallet using the correct authentication process, including the one-time passcode.

The complaint was then referred to FSCL.

Financial Ombudsman Susan Taylor said FSCL accepted that Tom had been the victim of a scam, but the card provider’s terms and conditions required customers to protect both their card details and one-time passcodes.

“While Tom did not intend for his card to be added to a digital wallet, the terms and conditions still applied,” Taylor said.

“A one-time passcode can also be used to approve actions such as adding your card to a digital wallet. Never share or enter a passcode unless you are certain the request is legitimate. If in doubt, contact your card provider.”

FSCL found the card provider was unaware the card details had been compromised before the transactions occurred and had acted promptly once suspicious activity was detected.

The provider also told FSCL a chargeback was not available because the purchases had been made through a digital wallet after goods had already been supplied by merchants who had no way of knowing the card details had been compromised.

As a goodwill gesture, the provider refunded $207 in interest charges. FSCL considered that offer fair and reasonable.

Taylor said anyone who suspects they have entered card details or a one-time passcode on a scam website should contact their card provider immediately.

“Acting quickly may allow the card provider to cancel the card or take steps to prevent any loss,” she said.

The warning comes amid increasingly sophisticated scams that use fake websites, convincing apps and persuasive communications to trick victims into handing over sensitive financial information.