Apple Pay fraud - Apple Community (2024)

Jeff Donald

21,427 points

No, Apple Pay does not handle any funds/monies. Apple Pay does not approve or decline any transaction. Apple Pay cannot refund charges. Only your bank can do those functions.

Apple Pay is a more secure way of transmitting your account data between your bank and the merchant. Apple Pay did not commit fraud or swindle you.

Lev945

8 points

You can't report card being stolen until somebody tries to illegally use it, as before that you have no idea that somebody indeed have stolen your credit card details.

That is since the thief doesn't need to steal a physical card to be able to add to ApplePay, just general credit card information i.e. number, expiration etc. - information you provide for Internet and over the phone purchases.

Apple should increase the security of the ApplePay, and provide more information at least to card issuers, so that the person that adds card to the service won't remain anonymous, as there is no any valid reason for that.

Jeff Donald

21,427 points

You called the number on the back of the bank card or contacted your local bank to confirm it’s from your bank, correct?

You did not use a number from the text did you?

Where did the phone number you called come from?

MrHoffman

123,193 points

hwasun112 wrote:

I don't use Apple Pay. Someone stole my credit card. As soon as I received the payment text, I asked the credit card company to cancel the approval. However, the credit card company said it was difficult to cancel the approval because the payment was made through Apple Pay. Do you understand this situation now?

A stolen card should be immediately reported to the financial provider. Let the provider sort this. Apple Pay is irrelevant.

Lev945

8 points

I have quite some actual experience in IT and e-commerce as well, however I don't think that even the level of my experience is required for that matter.

The issue at hand is quite simple - ApplePay should gather and provide a lot more information, and then provide all that information to the credit card provider. It will then allow the credit card provider to both make more intelligent decisions as to the risk levels, as well as make it harder for the fraud to take place, and at the same time will make the investigations easier.

Yes, I don't know the exact details of how ApplePay works. But does it required at all to know what needs to be done? I don't think so, especially as the things that I'm talking about are really simple.

It's quite simple for ApplePay application to gather all the information I already mentioned, and it's quite easy modify the protocol so that all this extra information is provided to a credit card vendor. And while it could be possible to spoof some of that information, that will already require a lot more knowledge than an average lamer thief has, that just gets the stolen credit card info and types it into the ApplePay application.

Now lets consider what credit card company could do with that information vs. what it gets now (just card info plus phone model). Credit card company or the bank knows the cell phone number of the client, so an attempt to add the card using a phone with a different cell phone number could automatically block and require some manual steps, thus calling the credit card company. It may do the same based on the SIM related information, and IMEI of the phone itself. And it's just a tip of the iceberg of what could have been done, if Apple would implement this mechanism.

Should I speak about other more obvious and less obvious things? Like more easier investigations of the fraud if you have all the information? But just by adding these simple additions will make adding stolen credit/debit cards a lot more complicated, thus enhancing the security for everybody a great deal.

I also would expect Apple to be generally more approachable and helpful in the cases of the fraud, not just say that there is nothing that they can do, and that they hold no logs or audits of the attempted additions of the cards. I spoke with Apple's customer service and the general message was that it's my fault that somebody have stolen my credit card. The representative went as far as to tell me that she "never gives her credit card details over the phone". I understand that she never purchases anything over the phone nor pays her bills over the phone, but she seemed to be a bit confused by my argument that somebody can potentially steal the credit card details even from the server, so giving up on all phone call based services is not a solution either.

There is also a lot that Apple could do to track this fraudulent activity on their side and help catch the thiefs. After all there it's possible to perform correlation between the phone itself (by IMEI), AppleID, and ApplePay. It's possible to check if some phones i.e. have an abnormal number of cards being added and then removed/blocked. Then Apple could block such phones from using ApplePay, as Apple sits at the center of the information, not credit card company that only knows about it's own cards. I.e. credit card company could have made a lot more intelligent decisions if Apple would provide a lot more information, and that would help greatly, however only Apple sees that the same phone is used to unsuccessfully add cards from different credit cards providers.

Lev945

8 points

Phil0124

203,599 points

The text messages were not from Apple or Apple Pay.

Apple Pay will never send you a text message for any reason.

You are being scammed. Ignore the text messages and block the number it is not a real charge and they are trying to get you to pay them.

Apple Pay requires your interaction and approval to even being to work. There is no possible wya for it to happen without your knowledge.

click here ➜ Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support

Jeff Donald

21,427 points

>>So I spoke with the credit card security and Apple's customer service, which specifically claimed that they don't have any of the information, and I have no reason to go to the police as they won't release any information to any authority claiming that they basically don't have any as they don't collect it. Are you suggesting that Apple customer service is lying?<<

Im not suggesting anything. I don’t know who said what. But the fact is the bank has the information to identify the device.

Here is some of the information that is shared as quoted from the support article linked below.

>>Information that you provide about your card, whether certain device settings are enabled, and device use patterns—such as the percent of time the device is in motion and the approximate number of calls you make per week—may be sent to Apple to determine your eligibility to enable ApplePay. Information may also be provided by Apple to your card issuer, payment network, or any providers authorized by your card issuer to enable ApplePay, to determine the eligibility of your card, to set up your card with ApplePay, and to prevent fraud.<<

Apple Pay security and privacy overview - Apple Support

Apple doesn’t disclose all the information that is provided to the bank, so fraudulent users are prevented from learning the key details shared to the bank.

Lev945

8 points

Jeff Donald wrote:

>>So I spoke with the credit card security and Apple's customer service, which specifically claimed that they don't have any of the information, and I have no reason to go to the police as they won't release any information to any authority claiming that they basically don't have any as they don't collect it. Are you suggesting that Apple customer service is lying?<<

Im not suggesting anything. I don’t know who said what. But the fact is the bank has the information to identify the device.

They may have this information about your device, but not from ApplePay. If you install an application of your credit card company or a bank then they probably do have the details of the phone. They also have you cell phone number and a lot of other information.

But if ApplePay doesn't send the phone identifying information as part of the process to add a card, then there is no way for the card issuer to check and compare that information. Nor to easily locate the criminal.

Here is some of the information that is shared as quoted from the support article linked below.

>>Information that you provide about your card, whether certain device settings are enabled, and device use patterns—such as the percent of time the device is in motion and the approximate number of calls you make per week—may be sent to Apple to determine your eligibility to enable ApplePay. Information may also be provided by Apple to your card issuer, payment network, or any providers authorized by your card issuer to enable ApplePay, to determine the eligibility of your card, to set up your card with ApplePay, and to prevent fraud.<<

Apple Pay security and privacy overview - Apple Support

Apple doesn’t disclose all the information that is provided to the bank, so fraudulent users are prevented from learning the key details shared to the bank.

Usage patterns are much different from phone identifying information such as IMEI, phone number, AppleID etc.

Security department of my credit card company told me that Apple only provided them basic information about the phone, like it's model. That's not something that could be used to easily locate the criminal.

MrHoffman

123,193 points

hwasun112 wrote:

I was recently swindled by Apple Pay. I don't use Apple Pay. After receiving a text message saying that it was registered with Apple Pay, I received 20 payment texts for the same amount. I immediately applied for a card suspension at the bank. And I asked for the cancellation of the approval.However, the bank said it could not cancel the approval. I don't understand this situation right now Can Apple Pay cancel the approval?

That was a SMS fraud scam targeting you. Block the number, and move on.

Whenever you are presented with unrecognized payment messages or claims via Messages, SMS, email, telephone, or otherwise, verify the transaction directly with the entity involved; with your bank, with Apple subscriptions and billing info, or whatever the claimed organization. And use your own self-acquired, trusted, contact info for the verification, not contact info from the received message you are verifying.

Bad news here, too: sending telephone numbers, and sending email addresses, can be faked.

Apple Pay can and does send purchase notifications within its payment system. You’ll get the amount and the recipient. These are system notifications, and not SMS text messages. You can then verify the transactions occurred within Wallet app on iPhone, or within the Wallet settings on iPad. And if you’re nor using Apple Pay, you should find no matching transactions.

Jeff Donald

21,427 points

Apple Pay can’t approve or decline a charge. Apple doesn’t not send Texts when a transaction is attempted via Apple Pay.

Who are the texts from?

If you don’t use Apple Pay then it’s an attempt to get credit information from you. Do not call any numbers associated with the texts or reply to any of the texts. Just delete the texts. If you know how, block the number from texting you anymore.

Phil0124

203,599 points

If these are texts from your bank, then the issue is with your bank directly.

If your card was stolen and you reported it stolen to your bank, then they should have blocked it and no other charges should have gone through.

You cannot cancel charges made through someone else's Apple Pay even if they did use your card. You cannot control someone else's Apple account like that.

Yes, they can take a card and add it to their own Apple ID and make purchases, but it should only be possible if you did not report the card stolen.

If you reported the card stolen to your bank, it would not be possible to add it to Apple Pay at all as it would not verify once it was blocked by your bank.

Right now, the issue is solely on the side of your bank. They should to be allowing these charges to continue if you have reported the card as stolen.