Unauthorized charges on my Apple Wallet

This exact scenario has just happened to me, I live in Brisbane , 9 unauthorised transaction happened in Sydney , bank says as I entered the OTP which I did a month before to add my card to my wallet on my iPhone and a month later these transactions happened which I didn’t make . No one has my credit card it’s in my wallet at all times and no one has access to my iPhone . The total spent is $2,350 and the bank won’t refund me . I don’t know what to do, what did you end up doing ? There is clearly an issue with adding your credit card to your phone wallet and using Apple Pay .

Do you use your physical credit card to make any other purchases? Purchases made with the Credit Card can still show up in the Wallet even if Apple Pay was not used to make the charge. In this case anyone that has your card numbers can make unauthorized purchases and they will still show up in the Wallet app. You bank should issue a refund for any unauthorized purchase.

View your account balance and full transaction history in the Wallet app - Apple Support

The relevant portion in this article is:

Once you've successfully connected your account, you'll be able to see your current account balance and your full transaction history, including purchases that weren't made with Apple Pay.

zazap67 wrote:

No one has my credit card it’s in my wallet at all times and no one has access to my iPhone .

No one needs physical access to your credit card. You can swipe your card at a gas station terminal that has a card skimmer installed and your card will then be compromised along with your PIN if used. There is no question that you used the OTP password when the card was added to the Wallet, but you will not get the OTP password with transactions that follow, so it may be a little misleading to claim that you authorized those purchases with the OTP Password.

You have not posted the exact description of the charge, so it is unable to determine if the charge was processed by Apple or one of the many scam charges that claim to be from Apple. Through investigation done by the bank/Apple, they are able to determine the device and verification method used to authorize the charge. We also do not know if you have verified the charges using this link to find information on your Subscriptions and Billing. You will also find links there to contact Apple directly.

Subscriptions and Billing - Official Apple Support

sahad229 wrote:

Same for me. Bank said apple pay is secured contactless payment. No way to link card to device without OTP. So dispute rejected and visa also rejected for the same.

For follow up and to track down the reason:

• Was the bank able to tell you what phone number they sent the OTP to?
• Have you logged into your bank website to verify your contact information to rule out it has been compromised?
• Does your bank currently use two-factor authentication to view your account on the website?
• Are you currently able to receive SMS messages? Try having another person send you a SMS message and shut off WiFi and Cellular Data on your device to make sure it is received as SMS.
• While I would understand your hesitation, I would be curious to know if you add the new card (I assume they issued you a new one) to your Wallet, if you get a OTP.

Apple Pay cannot be hacked, and even it could. Your actual card number is not kept there on any way. That's the entire point of the Wallet App and Apple Pay.

If an OTP verification was sent, it was not from your own Wallet app, someone else added your card or required verification somewhere else, since it was already been verified and added to your Wallet App and would not need to do so again.

If you shared your card with someone then check with them.

While it may have been added to an Apple Wallet, it was not the one on your own device.

Someone may have gotten a hold of your actual card, and added it to a Wallet App on a different device. No hacking involved. Just someone with access to your Card.

There's very little to do from your side if this was the case, except blocking your card, though not sure what happens when your bank issues a new one, as normally they would update the existing one in Wallet automatically.

I think further investigation into this is required, but assuming it was a hack and blaming Apple without any proof is not the way to do this.

You really need to start by finding out where or who added the card and required the OTP.

Or how this transaction occurred?

Can you see the transaction in your Wallet App under the card in question?

Or did you see it somewhere else? Like your Banks app, or your card's statement?

I had same experience. my credit card is linked to an Apple wallet and OTP for the credit card is coming to my another device. So it's impossible to get card info and OTP from one device.

But, I had fraud transactions of huge sum from another country, that I never been before. when I complain to bank, they say transactions happened using Apple pay and not able to chargeback.

I am 100% sure, I didn't shared OTP to anyone through call or any phishing website. Still its mystery how they are able to add card in apple pay and make payments.

This really depends on the bank. When a card is added to Apple Wallet app, some banks require additional verification, which can be in the form of a phone call, text, or email. The bank picks the verification method and uses contact information in their files.

Does your bank require additional verification? If so, do you know which method they use?

Yes, My bank has 2 options, use SMS(text) or call Bank for additional verification, After all these incidents, I discovered that I received an SMS for Apple Pay enrollment. However, I neither shared the OTP with anyone nor noticed it on the same day.

My phone was with me all the time as well.

I am not sure, The Bank has some issue with verification if a card has already registered with an apple wallet and someone tries to link to a new device it just adds without verification.

Same for me. Bank said apple pay is secured contactless payment. No way to link card to device without OTP. So dispute rejected and visa also rejected for the same.

Yesterday i updated bank app, then i found there was 8 malicious transactions on my card. 5 are rejected on same time. 3 approved transactions of AED 27000. I never received any alert from bank when transactions got declined. If i get, i could have been alerted and block the card.

Also i got call from the bank when first approved fraud transaction happened and i told them it is fraud and they blocked card. While i am in call 2 more transactions happened.

If they contacted merchant on same time, they could have cancelled transaction.

Even i got transaction after i blocked the card(a week after), bank declined this transaction.

Still i am thinking how someone got my OTP. I crosschecked any malware running on my iphone. I couldnt find any.

Only suspicious app is telegram. I read somewhere that telegram allows to tun bot on your device, which could compromise the device security.

There’s possibly your compromise, bank website password. Does the bank use 2FA (OTP) to allow you to access website or app?