A Dubai resident has been accused of exploiting a vulnerability in a local bank's credit card payment system, leading to the embezzlement of Dh74,500. The incident took place on February 2 and 3, 2024, under the jurisdiction of Al Muraqqabat Police Station. The Dubai public prosecution has charged the Ugandan national, alleging that he used an unauthorized electronic payment method to illegally acquire funds. He is accused of manipulating a flaw in the credit card payment service provided by the bank through the messaging application WhatsApp.
According to court documents, the accused discovered a loophole in the bank's WhatsApp payment service, which allows customers to pay their credit card dues. The flaw involved entering a negative sign ('-') before the payment amount, which caused the bank's system to erroneously credit the same amount back into the customer's account, even if the account lacked the necessary funds. By exploiting this loophole, the accused made two transactions on consecutive days, entering the amount Dh74,500 preceded by a negative sign. Consequently, the bank's system credited this amount to his account.
The accused then promptly transferred the funds to another account at a different local bank and withdrew the money on the same day. The fraudulent transactions were detected by the victim bank's accounting and IT department, which led to an internal review of the accused's account. Upon discovering the unauthorized transactions, the bank officials reported the incident to the police. The man was then apprehended, and a white iPhone Pro Max 15, believed to be used in committing the crime, was seized from him.
During the investigation, an IT specialist at the victim bank testified that the flaw was discovered during a routine audit in February. The accused denied the charges, claiming his phone had been hacked on the dates of the transactions. He also argued that he believed the funds were transferred by someone with whom he had previous financial dealings. In addition to the criminal charges, the bank filed a civil lawsuit against the man, seeking Dh51,000 in damages. The court has referred the civil claim to the competent civil court for further deliberation, pending the final outcome of the criminal case.
