not necessarily have to setup / save card in shopee - ur phone number registered for shopee card and shopee acc same then should be fine

further info here

installment is tied to card not ur shopee acc so wont affect ur payment as long as there is no change to ur cc

-------

for the ipay88 leak scenario, u can look at it from this perspective

1. whether u use ur card or not, there's a chance that there's fraud to this (they can bruteforce combinations) as long as ur card is active
- usually for bruteforce / leak, the card would be used in NON 3D websites (which does not require OTP) such as airbnb (but airbnb have good fraud prevention models, at least compared to other companies). therefore no OTP
- but usually these kind of case, liability shift is to merchant cuz they are non 3d MID
- what u need to becareful of, is when the fraud is OTP verified (or aka 3D trx that requires OTP), cuz liability shift to cardholder

2. not just to shopee, but other 3rd party platforms as well, its not recommended to save ur card
- in case the website / platform data leak

3. will u still kena from ipay?
- only ipay can answer that, they can say that the problem have been solved now, but u cant guarantee it wont happen in future
- or they really solve it once and for all

4. so what can u do?
- be vigilant on what trx pass through ur card
- be aware of TAC requests
- do not ever share TAC
- report immediately should u detect unauthorized trx
- if u save card, ensure that its deleted (or u can email the website/company to delete ur data completely if u no longer plan to use their services in future)
- if u dun have usage for credit card limit withdrawal for cash, lower ur credit limit to a range that u can utilize comfortably
- if possible, set ur SMS TAC (if u havent active secure2u / other app bound verification), and set the SMS TAC alert minimum amount rm1
hope it helps and not too complicated

My statement is on 28th, coins credited on 30th.