The only possibility i can think of is that the hacker probably checkout using credit card as the payment option instead of shopeepay. Cant recall whether is it lazada or shopee, either one of these platform do not send me OTP whenever i perform a topup or purchase directly using cc in their app, the transaction jst gets approved (referring to a saved/linked cc to the app)

Though i am not sure if there is a limit for purchasing directly via cc in shopee but if it follows the credit limit of the cc itself, then it could also be possible if TS' credit limit is above rm8k.

But then again, assuming hacker managed to perform rm8k transaction, the next line of defense should kick in as well, i.e. notice from the issuing bank. Typically for huge amount like rm8k, banks will notify/call/send sms to inform like "how much was just swipe using cc with ending num xxxx and pls call if you did not perform this transaction bla bla bla". And if the cc owner calls timely i believe most banks can stop/reverse this transaction.

This post has been edited by chichabom: Jan 13 2021, 08:26 AM