Koufu Eat app credit card services halted amid probe of unauthorised transactions

SINGAPORE: Credit card services on the Koufu Eat app have been halted due to reports of unauthorised payments late last year that were allegedly connected to the app.

Koufu, a local food and beverage firm, operates several food courts, eateries, and coffee shops across Singapore, as well as a food court in Macau. The Koufu Eat app allows users to see what’s available at the company’s eateries and pay for their meals using a PayLah account, DBS/POSB credit, or debit card.

CNA reported on Tuesday (Jan 28) that the credit card services have been disabled because of investigations being carried out by the police. Currently, Koufu Eat app users may only use their PayLah accounts when making payments.

According to Mothership, reports of the unauthorised transactions began as early as October 2024. Koufu reported the transactions to the police, who said they had investigated the matter.

On Dec 31, the company told Channel News Asia (CNA), “We received a few reports regarding unauthorised payment transactions in our Koufu Eat app.”

Reviews on the Google Play Store from Oct 26, 2024, showed app users expressing concerns. It was reported that the first user to flag the Koufu Eat app said that while they had inputted their credit card details, this did not show on the app. However, they received notification that their card had been added to Google Pay, after which they lodged a police report.

Other users said in December that their credit card had been used in fraudulent transactions after they added it to the app.

“Getting fraudulent transactions after adding my DBS credit card to the app,” wrote one on Dec 3.

“Not sure if it’s linked to this app or app is compromised. Just be alert,” another reviewer warned. CNA added that by the end of 2024, six reviews of a similar nature were posted.

Mothership quoted a spokesperson for Koufu as saying on Jan 1 that the app does not store customers’ credit card details because its payment gateway is via eNETS. Customers are directed to eNets when they are ready to pay.

After confirming that credit card services on the app had been disabled, Koufu told CNA that no security or data breach had been detected in initial investigations.

“Our app payment gateway is built to the security standards and by industry guidelines,” the company said. CNA also quotes NETS as saying there has been “no indication of any compromise of security controls,” though investigations into the issue continue. /TISG

UPDATE: Feb, 8, 2025

A spokesperson from Google has contacted The Independent Singapore to clarify the matter with the below statement:

“Google Pay is not integrated with the Koufu Eat app, so payment information is not passed between Koufu and Google Pay. Cards added to a third-party digital wallet are authorised by the issuing bank, not by the wallet itself. We are working with the other parties involved to investigate this issue.”

Read also: Koufu regrets diner’s ‘unpleasant experience’ of being barely-cooked eggs, unfriendly service