Someone added my credit card to their iPhone wallet, how do I prevent that?

The bank that issues the card has to approve adding the card to Apple Wallet. Apple doesn’t approve or deny adding the card except in a few cases, such as wrong card information, newly created Apple ID and few other cases. Apple provides information about the device, and the persons Apple ID Account, etc. Fraudsters bypass Apple Pay security by downloading and using the banks mobile app or website.

Hi, welcome to the Apple Support Community. I’m happy to assist/explain the 8 month old post you’re responding to.

Please re-read the original post (the one you’re responding to). Please let me copy and paste it for your convenience;

>>the only time my credit card has been used where it physically left my hand. The store with the fraudulent purchase was literally across the street from the restaurant.<<

The Original Poster clearly stated he gave the card to a merchant (first time the card ever left his possession) and a few moments later a fraudulent charge was made at a merchant across the street. However, because a support member at his bank said it was through Apple Pay, it had to be Apple Pay’s issue. Do you possibly see the support person was poorly trained, or the Original Poster misunderstood what was said, or the support person deliberately lied to avoid any responsibility and push the issue off on Apple? There’s a dozen other things that could be wrong in the assumptions being made by the OP.

So, moving forward to your issue. What would you like to have explained so that you fully understand how Apple Pay works and can feel confident in the security of the system?

When you use a credit card physically, the information can be skimmed off the magnetic strip or shimmed from the chip. These are the two most common methods of compromising your data.

Apple Pay uses only encrypted data. Only your bank has the key to decrypt the numbers/data associated with the transactions. The merchant and your iPhone have only encrypted data and no key.

Happy to answer more questions if you’d like.

One of the safe guards of Apple Pay is the requirement of using Two Factor Authentication (2FA). This is the multi-digit code Apple sends to confirm it is you. If the owner/user is tricked into revealing a 2FA code several fraudulent activities could happen, including your Apple ID being compromised. If your Apple ID were compromised, cards can be added to your account and used for Apple Pay transactions. That requires a lot of coincidences.

My situation...

April 10th, noticed charges on my credit card pending that I didn't make. Closed card with bank and they replaced it with a new card. Automatically placing that card into my apple wallet.

Today, I noticed 5 much larger charges were pending on my account. (same account, different card)

Went to bank again. I also noticed when I shut card off on my bank app, it showed my card was attached not only to my phone but to some other persons random phone! My bank did not automatically add my new credit card onto my apple pay this time. I am not sure if I will ever add it again except I use that to pay for my itunes and storage.

I went back through my emails and see my bank sent an email saying my phone was added to that apple pay account way back in February.

I'm just puzzled if it is my bank where they got the information, my email (which is the same for bank and apple) or apple pay. So frustrating!!

Banks certainly investigate and aid law enforcement in their efforts to apprehend those involved.

Banks want to make it as easy as possible for their cardholders to add their credit and debit cards to electronic wallets. Unfortunately, in the rush to lower customer friction, they bypass security features that Apple has in place by directly using bank websites and mobile apps. Very few banks require 2FA to login to accounts using their website or mobile app. For example on American Express allows me to add 2FA to the their mobile app on my iPhone. Most don’t show you the devices and electronic wallets that your card has been entered into.

I seem to have the same problem. Two cards that are in my wallet had fraudulent charges (one card had one, the other card had three) on the same day and all for the same amount, allegedly paid for with an Apple wallet. The card with 3 charges was in a safe in my house and is only used for a few recurring charges. Seems to me like the bad guys may have had a little jump in their technology enabling them to skin from a wallet. I don’t see another explanation, but I’m not an expert. Amex made me call Apple to see if they could tell whose wallet the charges came from (or at least if they could confirm it wasn’t mine) but Apple said they don’t have that capability.

Those are indeed huge improvements.

Especially removal of the mag strip!

I always tell folks that best way to protect a legacy card on ApplePay is to NEVER pull the physical card out of your wallet.

The bottom line is that no-one here can say if Apple has the kind of triggers you assume. Since we’re just users like yourself and not Apple employees or official Apple support, we don't have any insider knowledge.

This exact thing happened to me today, hence why I’m on this forum trying to figure out how this happened. I got a call from AMEX asking about “a purchase I just tried to make at a duty free store using my Apple Wallet in Dublin Ireland.” So my question is exactly the same as yours “how was someone able to put my card in their Apple Wallet?” I am in possession of my card. How did they get all of my information. I don’t even know how to now keep myself safe because I don’t know how they got the information. AMEX suggested “maybe my Apple Wallet was hacked or maybe my iPhone was hacked” is that even possible??? It was strange when I checked my Apple Wallet to see if any purchases were made I noticed that my AMEX card had a little sentence under the card that said “this card cannot be used” how and when did that happen? Who do I contact to see when my AMEX card was disabled (not removed, just disabled) from my Apple Wallet? What’s strange is when I installed my credit cards I had to contact the bank, but yet some random just was able to load my card without having to contact my bank?🤦🏻‍♀️

I have two cards in my apple wallet in addition to the Apple credit card. I also physically carry them with me. We received notification on the same day by both card companies (Citi and Chase) they were flagged for suspicious purchases. Both cards had uber eats and a Lyft charge. Both charges were from south of Los Angeles and we live in Tennessee. Neither card had been used physically in the week before the charges. I had used one of the cards for an online purchase using the apple wallet the day before the fraudulent charges were attempted. Really curious. Cancelled both cards and changed passwords. Apple support said there is no way to add a stolen card to someone's wallet without my knowledge and that certainly makes sense...

Thank you for the reply…the odd thing is this happened to two different cards…implying both cards were used and then skimmed at the same…I reviewed all my statements and found I’ve never used these 2 cards at the same time or place…and both fraudulent charges were for the same thing (Uber Eats and Lyft)…and both credit card companies stated it was Apple Pay…I agree with Apple this makes no sense / is not possible, but the whole situation is baffling.

rjgray60 wrote:

Thank you for the reply…the odd thing is this happened to two different cards…implying both cards were used and then skimmed at the same…I reviewed all my statements and found I’ve never used these 2 cards at the same time or place…and both fraudulent charges were for the same thing (Uber Eats and Lyft)…and both credit card companies stated it was Apple Pay…I agree with Apple this makes no sense / is not possible, but the whole situation is baffling.

Uber Eats and Lyft could have had their systems compromised. If it was a small intrusion, it may not yet have been noticed or, if it has, not yet announced to the public.