How was Apple Pay used on a stolen iPhone?

The passcode could have been observed/captured hours or even days before. That’s the most likely scenario.

However, if you want to pursue the Apple Pay was compromised argument, there are multiple recent threads on the topic. But to date, Apple Pay has never been hacked, there is not even a proof of concept of any theory on how it could be done. If you’d like me to detail how it’s virtually impossible and explain the technology and security features behind Apple Pay, I’d be happy to detail how it works.

Not just recorded, but no researcher has ever proposed a technology hack. Any compromise involves social engineering which involves learning passcodes, compromising people at the bank or the cellular provider and other means that involve human error. But the hardware and technology behind the system and process have never been compromised. Human error is another matter.

Online banks have a support team and they could have been social engineered into permitting use of the account. But this requires getting the passcode.

A photo has rarely (once?) been able to compromise Face ID. But a photo has been manipulated in software to compromise Face ID. It took the researchers hours to do and they never revealed the procedures used to unlock Face ID.

A blocked phone has never been compromised. When a phone is marked as lost using Find My, it’s locked.

This is well known scam. Many major media outlets have been reporting on it for the year or so. Here is a video by the Wall Street Journal.

https://youtu.be/gi96HKr2vo8?si=eExTVet3szLdtzLR