Balance Inquiry Spike / Websuite API

Issue Raised

  • More than 61,000 inactive gift cards received balance inquiries through Website between July 28 and August 1.
  • The activity occurred even though the site should have prohibited balance checks on inactive cards.
  • The investigation remained outstanding more than three weeks after the original events.

Response/Resolution Requested

  • Complete and share the investigation findings.
  • Explain how the Websuite API was used and confirm the number of successful inquiries.
  • Provide recommended controls or actions to prevent recurrence. 

PTI Server Outage / Communications

Issue Raised

  • A PT1 server outage occurred on August 20.
  • Shell was alerted by the Shell App team, but RPG was not included in the outage notification.
  • August 24 Shell Canada shared they were also impacted by the outage (August 20).
  • The communication gap limited timely alignment across customer service and operations.

Response/Resolution Requested

  • Confirm that a root cause analysis will be completed and shared.
  • Add Jackie Gilbert and Lauren Clanton to future outage communications.
  • Improve incident reporting, communications and resolution confirmation.

Program Support

What Fraud Mitigation measures is Shift4 proactively taking to combat attacks the program has experienced in recent months? 

Examples:

  • Balance Transfer Velocity/Timing
  • SVA Retrieval & Registration Activity
  • Status on CVD implementation on digital

What other mitigation measures are being taken with other clients or that are in place in the industry?

Based on what the U.S. is experiencing with digital, is there additional measures that can be applied to Canada?