Identity of Apple Pay sender/recipient

First off, she generally ins’t responsible for fraudulent transactions if reported to the issuer in a timely manner.

2nd, Apple is not involved in actual ApplePay transactions; is only briefly involved as a middle-man during card setup process.

The card issuer on the other hand has ALL of the info AND verified (albeit apparently improperly) that the “installing user” was legit.

Next, the card issuer has the authority, the tools AND the vested interest in tracking-down the fraudsters.

Best to leave any detective work to them.

Finally, the fact that the card WAS successfully “verified” possibly indicates identity theft thru avenues other than ApplePay.

DO make sure that her AppleID is fully secured:

If you think your Apple ID has been compromised - Apple Support

Then checkout the security of her email (if different from Apple) and other personal financial and personal details.

Re: “… which I’d imagine leaves a trail to the person responsible …”

It certainly DOES. Automated payment systems are usually GREAT at generating a rock-solid audit trail.

Although you might not be able to track it down yourself …

… her card issuer - now “on the hook” for the full amount - might well do so.

Your suspicions re: “her circle” are quite possibly valid as “Issuer Verification” generally would require some “inside knowledge AND access” to pull-off successfully.

Your mom’s geographic displacement could certainly provide a known window of unfettered physical access.