Level 1

12 points

Credit card used in Apple Pay compromised

Is there any way this could happen without Apple Pay being vulnerable?

Situation:

Family member 1 (FM1) received Apple Pay notice that charge was declined / rejected at a business 800 miles from their physical location.
Bank (Chase) reports
- that FM1's device / digital wallet was used for the transaction.
- the card is registered with 3 phones, as expected

My understanding of Apple Wallet is that it is tied to the hardware, so cloning isn't possible.

What else could have happened? My first thought was that the maybe someone social engineered getting the card registered to their phone but that would have resulted in a 4th device being registered with Chase.

This has me fairly concerned....this should not be possible.

[Re-Titled by Moderator]

Posted on Dec 6, 2024 8:32 AM

Top-ranking reply

LaSuperChula

Level 1

21 points

Posted on Dec 7, 2024 10:09 AM

Jeff,

I contacted my CC fraud department and they indicated there was no SEID attached to the transaction. They also clarified that it was an online transaction and a MANUAL ENTRY. They also indicated that the CC number used was the number issued to my device’s Apple Pay which is different than my actual physical card number. The reason it was declined was because the address and CVV entered manually did not match.

I have recently made at least 3 online purchased for Christmas on reputable sites using the APPLE PAY Option. My guess that someone can access the CC number on their end or in transit and attempted a manual entry.

I will not be using APPLE pay for now. Sticking to PayPal. Never had issues with that.

View in context

Similar questions

49 replies

atrocktop Author

Level 1

12 points

Dec 7, 2024 10:39 AM in response to Jeff Donald

Yes, read your question and I understand the banking sector's confidence in the transaction security.

Mulitple representitives said the transaction was classified (manual, digital wallet). I think this is a terminology difference rather than a functional difference.

Isn't this moot? We see the transaction in the wallet. It was done at a POS, through the Apple payment infrastructure. If all apple pay transactions are considered card present, and we see the transaction rejected as shown below, then it follows that it should be classified as card presnet, in your terms, right?

FYI: just so you know where I'm coming from, I have 25 years experience (15 as an executive) in operations, technology, and cybersecurity at an NYSE listed finanical services firm (not a payments processor).

Dec 7, 2024 10:55 AM in response to atrocktop

How many POS terminals do they manually enter a transaction? You really thinks Buc-Ee does a manual transaction at a POS? What does a manual transaction require? It requires a physical card? Show me on your iPhone the Apple Pay data your bank encrypted.

If what you’re saying is true, consider the ramifications, your bank’s encryption was broken. The Secure Element on your iPhone was compromised. The SE uses ISO standards developed by your former industry.

https://en.wikipedia.org/wiki/Secure_element

Is this what you’re really saying? If so, you just single-handedly threw out decades of security. You’re basically saying your banks encryption is compromised. Is that right?

I too have a background in financial industry. I know what PNO’s have for data and what banks have. I’ve never seen an Apple Pay manual transaction. It’s never happened.

Dec 7, 2024 11:06 AM in response to atrocktop

My writing style comes across as harsh many times. I’m sorry if you took it as accusatory or harsh. It was not my attention.

I understand that you’re seeking transparency and accountability in your situation. I want that too.

I hope you have a great rest of your weekend!

Dec 17, 2024 6:50 AM in response to atrocktop

I understand. In fine print, under user name, is who the comment is directed towards. Unfortunately, the community forum software does not support @. My comment and the other poster were directed towards drader0528. Sorry for any confusion.

atrocktop Author

Level 1

12 points

Dec 17, 2024 8:13 AM in response to Jeff Donald

@ Jeff Donald - I am still chasing the SEID with Chase and am finally hopeful that I will eventually get it. Unfortunately, since I had the wallets de-linked as a precaution, it made the research much more difficult.

atrocktop Author

Level 1

12 points

Dec 17, 2024 8:53 AM in response to Saegzz

@ Saegzz - That was my early thought too, but it isn't supported by the facts.

Chase confirmed (multiple times) there were 3 devices linked to the card, as expected. If someone linked the card to another device / wallet then there would have been 4 digital wallets and that was not the case.

Jan 9, 2025 9:13 AM in response to Phil0124

Just received a phony Apple Pay transaction charge notification with a phone number to call that’s one digit different from Apple’s support number. No such transaction appears on my credit card activity list, so I know it’s a scam. Appreciate your warning.

Jan 9, 2025 10:31 AM in response to jerseycarl49

jerseycarl49 wrote:

Just received a phony Apple Pay transaction charge notification with a phone number to call that’s one digit different from Apple’s support number. No such transaction appears on my credit card activity list, so I know it’s a scam. Appreciate your warning.

You're most welcome. Glad it helped.

Saegzz

Level 3

506 points

Dec 6, 2024 9:18 AM in response to Phil0124

are we talking about Apple Cash, Apple Card or using term Apple Pay to describe either or. I use Apple Pay regularly and always receive a notification regarding a transaction

Dec 6, 2024 9:23 AM in response to Saegzz

Good point. Do the notifications you receive call them Apple Cash or Apple Pay?

atrocktop Author

Level 1

12 points

Dec 6, 2024 10:01 AM in response to Phil0124

It is Apple Pay.

By "Notice" I should have said "shows declined transaction"

atrocktop Author

Level 1

12 points

Dec 6, 2024 10:17 AM in response to Mac Jim ID

I'm requesting a screenshot now, but since the card was removed from his digital wallet I'm not sure he can get to the transaction.

atrocktop Author

Level 1

12 points

Dec 6, 2024 10:26 AM in response to atrocktop

Unfortunately, he just confirmed it isn't available because Chase de-authorized his digital wallet.

Dec 7, 2024 6:52 AM in response to LaSuperChula

Did you read all the posts in the thread you posted in? It’s been fully explained in several posts. I’m happy to answer any additional questions.

Dec 7, 2024 10:15 AM in response to atrocktop

atrocktop — please read my last post. A manual transaction cannot be an Apple Pay transaction. Apple Pay transactions are classified as card present.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Credit card used in Apple Pay compromised