Someone added my credit card to their iPhone wallet, how do I prevent that?

This is an interesting thread.

I too find it difficult to believe that your card could be added to another wallet given the built-in cross-checks involved in that process.

My own “suspicion” is that the fraudulent transaction across the street was actually a CNP (card not present) transaction - where the digits are manually typed-in - or else a cloned mag-strip “swipe” transaction.

And that that the “human” in the fraud department simply saw that you were enrolled in Apple Pay and imprecisely mis-spoke. (or else his display software simply couldn’t provide the granularity to accurately distinguish between transaction types)

I’d call them back and re-confirm how they distinguish between CNP, EMV (Chip), Tap-to-Pay (card based), Mag-Strip “Swipe” and ApplePay transactions.

Of these options, CNP and “Swipe” are the most vulnerable to fraud.

Adding to Jeff’s excellent reply and getting back to your initial question:

”Someone added my credit card to their iPhone wallet, how do I prevent that?”

It might appear that the most effective way is by adding it to YOUR wallet.

That combined with NEVER allowing a physical card - with all of your account details fully exposed AND containing an easily copied mag-strip - out of your sight.

I have two cards in my apple wallet in addition to the Apple credit card. I also physically carry them with me. We received notification on the same day by both card companies (Citi and Chase) they were flagged for suspicious purchases. Both cards had uber eats and a Lyft charge. Both charges were from south of Los Angeles and we live in Tennessee. Neither card had been used physically in the week before the charges. I had used one of the cards for an online purchase using the apple wallet the day before the fraudulent charges were attempted. Really curious. Cancelled both cards and changed passwords. Apple support said there is no way to add a stolen card to someone's wallet without my knowledge and that certainly makes sense...

When you use a credit card physically, the information can be skimmed off the magnetic strip or shimmed from the chip. These are the two most common methods of compromising your data.

Apple Pay uses only encrypted data. Only your bank has the key to decrypt the numbers/data associated with the transactions. The merchant and your iPhone have only encrypted data and no key.

Happy to answer more questions if you’d like.

Thank you for the reply…the odd thing is this happened to two different cards…implying both cards were used and then skimmed at the same…I reviewed all my statements and found I’ve never used these 2 cards at the same time or place…and both fraudulent charges were for the same thing (Uber Eats and Lyft)…and both credit card companies stated it was Apple Pay…I agree with Apple this makes no sense / is not possible, but the whole situation is baffling.

One of the safe guards of Apple Pay is the requirement of using Two Factor Authentication (2FA). This is the multi-digit code Apple sends to confirm it is you. If the owner/user is tricked into revealing a 2FA code several fraudulent activities could happen, including your Apple ID being compromised. If your Apple ID were compromised, cards can be added to your account and used for Apple Pay transactions. That requires a lot of coincidences.

rjgray60 wrote:

Thank you for the reply…the odd thing is this happened to two different cards…implying both cards were used and then skimmed at the same…I reviewed all my statements and found I’ve never used these 2 cards at the same time or place…and both fraudulent charges were for the same thing (Uber Eats and Lyft)…and both credit card companies stated it was Apple Pay…I agree with Apple this makes no sense / is not possible, but the whole situation is baffling.

Uber Eats and Lyft could have had their systems compromised. If it was a small intrusion, it may not yet have been noticed or, if it has, not yet announced to the public.

The questions originally asked in this post by McCallSL in May 2023 are very relevant:

“How did someone add my card to their Apple Wallet?”

"If I had already put the card in my own Apple Wallet, would its add to a different device have set off more bells?"

Despite all the answers provided, the questions remain and I share my experience here in the hope of rekindling the debate so that someone informed can shed more light on the subject. Here are the facts:

For each transaction made with my credit card, the card issuer sends me a text message informing me of the transaction amount and the merchant where the purchase was made. However, the day before yesterday, a similar text message informed me of a transaction that is unknown to me. I therefore concluded that it was fraud and contacted the appropriate services at Visa.

I was then informed that the transaction had been carried out by Apple Pay. As a security measure, my card was immediately blocked.

Subsequently I noticed that a few hours earlier, I had received an email from Visa, informing me that my card had been added to my Apple wallet! However, my card having already been added to this wallet for a long time, this email which I had unfortunately not seen before should have alarmed me, which tends to confirm that the fact of adding a card to your mobile wallet actually allows you to be notified before the fraud, which unfortunately I did not notice quickly enough in my case.

But it remains very unclear to me the fact that my card could have been added again to MY wallet by a FRAUDSTER! How is it possible ? Suppose that this fraudster has all the information on my card: number, expiration date and CVC, it still remains that there must be a verification code to be received from the card issuer to confirm its addition in the wallet, or some other double check, right?

I don't remember exactly the procedure Visa used when adding, just the fact that it was simpler with Visa than with my other cards.

The question therefore remains: how can a fraudster add MY card to MY wallet and use it? There, I'm lost...

Question:

Without revealing any personal info …

… was the compromised card from a BIG issuer (e.g. Chase, BoA, AmEx, …) …

… or from a smaller / local issuer ?

That “never in MY wallet” is big piece of this puzzle in my mind.

Thanks for including and amplifying it.

Very true.

I’ll keep looking for answers elsewhere then. None to be found here. Thanks.