Can Apple Pay get hacked?

I didn’t even enter information lol I used Apple Pay on a website and they charged me multiple times two weeks later. No my stuff wasn’t stolen and added to another phone. It was the same website each time. I’m not sure why this is so difficult to understand.

I thought you might be interested in the article and YouTube video at the end of the article.

https://www.retaildive.com/ex/mobilecommercedaily/apple-pay-fraud-reflects-weakness-with-credit-cards-not-platform

As, the experts note <“Whenever a new channel is created, an opportunity for fraud is created along with it,” he said. “We have no indication that Apple Pay itself has been breached or its fundamental security technologies such as biometric authentication (TouchID) and tokenization (using one-time payment card information to prevent credit card theft) have been bypassed.”>

So basically Apple Pay is flawless but my card still got leaked magically in the process and it’s my credit cards fault. There is zero point of using it then. I also get notified when my card is linked to a device. So I already know that wasn’t the case.

Kylemcc10 wrote:

So basically Apple Pay is flawless but my card still got leaked magically in the process and it’s my credit cards fault. There is zero point of using it then. I also get notified when my card is linked to a device. So I already know that wasn’t the case.

There is nothing magical about your card getting leaked. Over 150 million credit cards have been leaked through breaches of internet merchants this year alone, many of them from a major AT&T breach, but also a United Health Care subsidiary. And T-Mobile last year. And any time you swipe a credit card there is a chance that the terminal has been compromised.

Bborz wrote:

And Apple knows your face, on your device, where you set up the card. Right?

i’m not trying to be cryptic.

No, Apple does not know your face. Your iPhone knows your face. Your biometric data remains exclusively on your device in encrypted storage on your phone’s processor chip.

Banks authorize devices, not a single person per se. The biometrics only authorize the specific device. Fraudsters add the compromised data to their device, the fraudsters face then authorizes the device to complete fraudulent transactions with your compromised data.

And right there is where the ecosystem needs Apple to tighten things down. Realizing that every potential solution creates another problem, but Apple Pay is not done evolving. The ecosystem has weaknesses that Apple as the primary player in the ecosystem could solve. Most technology solutions account for human air, because humans provide the unknown variables. Apple knows this. And yet this form and others are filled with people having the same issues.

What solution are you proposing? That a given credit card can only be installed on one iPhone, meaning that you and another family member could not each have the same credit card on their iPhones? Actually, years ago AOL would allow a credit card to be used with only one user account. Which created a lot of ill will.

But even then, that would not prevent a card thief from adding that stolen card to Google Pay, Samsung Pay, PayPal, or any other payment system. Or just using it online.

So what do you think Apple should be doing that they aren’t?

Read the flow chart I posted, again, for the most basic Apple Pay fraud scheme. It’s social engineering that fraudster are using. They are using against you, me and every other credit card holder. It’s the banks failing to require stricter verification of credit/debit cards. It’s bank support people falling victim of social engineering and allowing fraudsters to add your credit card information to their computer or iPhone. At best, this is only marginally an Apple issue. At worst, it’s the bank. You’re willing to fault technology, but why not the bank? Why isn’t anyone in this thread saying, I want the more secure technology and I’ll switch my bank and credit cards to be more secure? Or, is it the fear of technology that drives the consumer to banks just assuming a stone building must be more secure?

Let’s face it, if all this information is generally factual then I would want to go visit those small retailers and see if their audit trail really has those transactions. With the same card number and all with the same device ID it would appear more likely the fraud is within the bank system, even if it is being perpetrated by an outside unauthorized party. Otherwise it’s a clone phone and fast car!

Standard credit card fraud MO: Use a stolen card (you can buy a working card on the dark web for under $5) for a couple of small purchases. If they clear the card is good, so make a large purchase. I check my card accounts every day or two; a few months ago I saw a small charge, around $18. BUT my bank also sent me a text asking if I had made the purchase. When I said no they canceled the transaction and the card, and sent me a new card. How did the bank know? I suspect it was the “superman test”. The purchase was in a location that I couldn’t have gotten to from my current location unless I was superman. (It’s technically called a “velocity check”). That’s why the bank wants to know if you will be traveling.

the latest 17.5 update looks it plugged some serious vulnerabilities.

long story short, i received a ton of phishing SMS days before 17.5 came out, knew something was fishy and apple will respond. didn't click on any of the links and reported these SMS and sent to junk. probably the prized zero click variety because today i got 4 transactions from apple.com/bill that i did not authorize, 2 were approved 2 were declined. talked to the bank fraud team and canceled the card. they said more transaction kept coming through after the block. this happened to me last year somewhere around summer, same scenario different ios version with major security fixes.

so yes, apple pay can get hacked and if you have a good fraud team in the bank they should get you covered with disputes, cancelations, etc

Apple Pay cannot be hacked. Apple Pay is a way to use a credit or debit card for contactless payment. What CAN be hacked is the credit or debit card itself.

And apple.com/bill has absolutely nothing to do with Apple Pay. Apple.com/bill emails are ONLY for charges from Apple for iTunes and app store purchases, and refers to the card you have active in Settings/[your name]/Media and Purchases. You can choose a card you also use with Apple Pay, but even if you do it does not actually use Apple Pay.

What might have happened is your card was compromised (but not because it is registered in Apple Pay) and used fraudulently for a purchase somewhere (NOT from Apple). And you also got 2 routine subscription charges from Apple. If you happen to use the same card in both iTunes/App Store and Apple Pay the fraudulent charges would have locked your card, and the charges from Apple would have been declined.

And it’s also possible that the apple.com/bill were actually fraudulent and not from Apple→Avoid phishing emails, fake ‘virus‘ alerts, phony support calls, and other scams

Your card can be skimmed the first time you use it after getting it. Are you saying you never used this card to make any purchase from any merchant, either in person or online? Never used it in an ATM? Never used it to buy gas?

Did you read the link posted by Mac Jim ID?

never physically used credit, i physically use debit card for atm, debit for gas as most stations in my area dont allow credit, this credit card is only linked to apple pay and i only use apple pay at POS on a daily basis and dont use it for online shopping where it asks card number and CCV.

so unless apple pay can be skimmed like a physical card at POS, i don't know how it got used.

yes i've read the link.