Someone added my credit card to their iPhone wallet, how do I prevent that?

The questions originally asked in this post by McCallSL in May 2023 are very relevant:

“How did someone add my card to their Apple Wallet?”

"If I had already put the card in my own Apple Wallet, would its add to a different device have set off more bells?"

Despite all the answers provided, the questions remain and I share my experience here in the hope of rekindling the debate so that someone informed can shed more light on the subject. Here are the facts:

For each transaction made with my credit card, the card issuer sends me a text message informing me of the transaction amount and the merchant where the purchase was made. However, the day before yesterday, a similar text message informed me of a transaction that is unknown to me. I therefore concluded that it was fraud and contacted the appropriate services at Visa.

I was then informed that the transaction had been carried out by Apple Pay. As a security measure, my card was immediately blocked.

Subsequently I noticed that a few hours earlier, I had received an email from Visa, informing me that my card had been added to my Apple wallet! However, my card having already been added to this wallet for a long time, this email which I had unfortunately not seen before should have alarmed me, which tends to confirm that the fact of adding a card to your mobile wallet actually allows you to be notified before the fraud, which unfortunately I did not notice quickly enough in my case.

But it remains very unclear to me the fact that my card could have been added again to MY wallet by a FRAUDSTER! How is it possible ? Suppose that this fraudster has all the information on my card: number, expiration date and CVC, it still remains that there must be a verification code to be received from the card issuer to confirm its addition in the wallet, or some other double check, right?

I don't remember exactly the procedure Visa used when adding, just the fact that it was simpler with Visa than with my other cards.

The question therefore remains: how can a fraudster add MY card to MY wallet and use it? There, I'm lost...

That doesn’t explain your situation. A payment method can’t be added to an Apple device that doesn’t have biometrics or a passcode with Two Factor Authentication enabled. If you turn off your Face ID/biometrics or disable 2FA your payment methods are instantly removed.

Unfortunately, Apple Pay doesn’t prevent credit card fraud perpetrated the “old fashioned way.”

As far as the fraudsters being able to add it to THEIR Apple Wallet, it would be quite illuminating to know exactly what methods and criteria your issuer used for the “verification.”

(although I doubt if they would ever share it with you)

The problem is even worse than I thought. I accidentally left my credit card in a store. The same day I reported it to my credit card as lost/stolen.

This morning the REPLACEMENT CARD we haven’t even received was used in Apple Pay. Which means they added the original card to their own iTunes account yesterday and it retained the account info in iTunes even though the card had been cancelled.

Cancelling a card should automatically remove it from Apple Pay. Or Apple Pay does a check for validity with the credit card company each time a payment is attempted. Who knows, maybe they do this on a daily basis or something already.

Adding a card in Apple Pay should require two factor authentication through the credit card company to the cardholder, not just verification that the card is valid.

The real solution is around the corner. Visa announced Tuesday changes to their cards starting in 2026. Basically, they become like Apple Card Mastercard. There will be no numbers printed on the card, front or back and eventually no magnetic stripe or chip. They will rely on services like Apple Pay and Tap-To-Pay. But it’ll give the option to choose whether to use debit or credit card or set preferences, like transactions under a set amount will be debit charges etc. You’ll even be able to switch after the transaction is completed.

Mastercard has already announced that starting in 2026, no more magnetic stripes.

I am not able to add any helpful information, but I experienced everything exactly as you did, but I have always had a passcode and fingerprint lock on my iPad. So it did not protect me at all from exactly what you experienced. I’m hoping to find more answers. I now have set text notification alerts that inform me of everything happening on every single mode of payment: Amazon, Apple Pay, 2 credit cards, bank, debit card, PayPal. But someone used my credit card number via Apple Pay on their phone to charge over $7,000 before I found out. They had quite the fun spree.

I would guess that somehow the encrypted info was hacked online. With my own recent fraud issues, I believe my card was skimmed and then added to the thief’s Apple Pay. But if you had 2 cards compromised in that way, I believe your card info was stolen online somehow. As consumers, we are assured this cannot happen, but I don’t see any other way it could be happening.

Teens took pictures of four of my credit cards at the gym. ( broke into my locker) put them in Their apple pay. Took cabs, bought 1000 dollars worth of stuff apple tealky needs to protect this better. Only name of apple account should tske their name only cards.

This just happened to me at the gym. 5 cards, scanned used 3000 worth of charges on four different cards through the crooks apple wallet. Shouldn't allow other peoples cards to be entered in their wallets. And if they do they should be able to arrest these pukes! It should be very easy. And apple needs to stop this from happening.

One of the mods must have wiped it out. It was a really long post and all bullet points. His solution was 2FA. He said Apple needed to require it and I pointed out Apple did require it to setup Wallet App and Apple Pay.

Jeff Donald wrote:

One of the mods must have wiped it out. It was a really long post and all bullet points. His solution was 2FA. He said Apple needed to require it and I pointed out Apple did require it to setup Wallet App and Apple Pay.

Just me being sarcastic.... ;-)

Question:

Without revealing any personal info …

… was the compromised card from a BIG issuer (e.g. Chase, BoA, AmEx, …) …

… or from a smaller / local issuer ?

That “never in MY wallet” is big piece of this puzzle in my mind.

Thanks for including and amplifying it.

Link was missing from copy & paste. Sorry.

Legal - Apple Pay & Privacy - Apple

Very true.