Credit card used in Apple Pay compromised

Question

atrocktop Author

Level 1

12 points

Credit card used in Apple Pay compromised

Is there any way this could happen without Apple Pay being vulnerable?

Situation:

Family member 1 (FM1) received Apple Pay notice that charge was declined / rejected at a business 800 miles from their physical location.
Bank (Chase) reports
- that FM1's device / digital wallet was used for the transaction.
- the card is registered with 3 phones, as expected

My understanding of Apple Wallet is that it is tied to the hardware, so cloning isn't possible.

What else could have happened? My first thought was that the maybe someone social engineered getting the card registered to their phone but that would have resulted in a 4th device being registered with Chase.

This has me fairly concerned....this should not be possible.

[Re-Titled by Moderator]

Posted on Dec 6, 2024 8:32 AM

Reply

Answer 1

Dec 6, 2024 9:01 AM in response to atrocktop

Apple Pay does not send any notices regarding charges. Any emails or SMS messages you get regarding Apple Pay are always scams. Never real.

If a charge that had been made through Apple Pay, it would appear in the Wallet App on the FM1's devices only It would not send a notice.

There is no actual card info kept in Apple Pay, and Apple Pay requires biometric confirmation to execute a payment. So it's simply not possible to have it be hacked or compromised like that.

As such email or sms notice that purports to notify about an Apple Pay charge is a scam.

Reply

Answer 2

Dec 6, 2024 9:09 AM in response to atrocktop

Here is the test. Each Apple device with a Secure Element has an SEID number (Secure Element ID). It is unique and can’t be cloned. The bank can see the SEID that made the transaction. Ask them for the SEID that made the transaction.

Your SEID number is at this path,

iPhone > Settings > General > About < SEID number.

Reply

Answer 3

Saegzz

Level 3

503 points

Dec 6, 2024 9:18 AM in response to Phil0124

are we talking about Apple Cash, Apple Card or using term Apple Pay to describe either or. I use Apple Pay regularly and always receive a notification regarding a transaction

Reply

Answer 4

Dec 6, 2024 9:23 AM in response to Saegzz

Good point. Do the notifications you receive call them Apple Cash or Apple Pay?

Reply

Answer 5

atrocktop Author

Level 1

12 points

Dec 6, 2024 10:01 AM in response to Phil0124

It is Apple Pay.

By "Notice" I should have said "shows declined transaction"

Reply

Answer 6

Dec 6, 2024 10:09 AM in response to atrocktop

What do you see when you tap on the Declined transaction, and sometimes an additional tap to show the details?
Can you post a screenshot of that page without it showing any personal information?

Reply

Answer 7

atrocktop Author

Level 1

12 points

Dec 6, 2024 10:17 AM in response to Mac Jim ID

I'm requesting a screenshot now, but since the card was removed from his digital wallet I'm not sure he can get to the transaction.

Reply

Answer 8

atrocktop Author

Level 1

12 points

Dec 6, 2024 10:26 AM in response to atrocktop

Unfortunately, he just confirmed it isn't available because Chase de-authorized his digital wallet.

Reply

Answer 9

Dec 7, 2024 6:41 AM in response to atrocktop

I had the same issue happen to me over night. I received an Apple Pay notification of a declined transaction. I confirmed with my credit card that it happened through Apple Pay. My card has only been added to my personal iPhone and it did not leave my side overnight. How could this happen?

Reply

Answer 10

Dec 7, 2024 6:52 AM in response to LaSuperChula

Did you read all the posts in the thread you posted in? It’s been fully explained in several posts. I’m happy to answer any additional questions.

Reply

Answer 11

Saegzz

Level 3

503 points

Dec 7, 2024 6:54 AM in response to atrocktop

That’s not Apple Pay charging you. Whatever card you have linked to that account shows up in that cue. Tap on that charge and it will show you which card was charged.

Reply

Answer 12

Dec 7, 2024 7:32 AM in response to Jeff Donald

I did read all the posts. I did not see an explanation as you suggested. Can you refer the exact post you say has an explanation. It was not a sms text notification. In my Apple wallet I click the CC in question and there is a declined transaction listed. I did not make this transaction at 1am.

Reply

Answer 13

Dec 7, 2024 7:35 AM in response to LaSuperChula

Correct, a red decline means your bank or the PNO declined the transaction. What did the bank fraud department say when you contacted them?

Reply

Answer 14

atrocktop Author

Level 1

12 points

Dec 7, 2024 9:36 AM in response to Jeff Donald

@Jeff Donald

The bank fraud department said:

1) there are 3 devices with digital wallets (3 family members)

2) Family member 1's device / digital wallet (I questioned this point extensively) at a location 800 mile from his physical location.

3) The transaction was made at 5:45AM and I was told of the transaction being delined by the bank 45 minutes later and confirmed family members location.

This does not seem technially possible without something we all thought / were led to believe was 'impossible'

Reply

Answer 15

atrocktop Author

Level 1

12 points

Dec 7, 2024 9:38 AM in response to Saegzz

@Saegzz

Yes, this was the bank declining the transaction. The bank says the transaction was from the digital wallet associated with a phone I *know* was 800 miles from the point of sale.

We all think that means the phone needed to be presented at the point of sale terminal for near field communication of encrypted data. This doesn't seem possible BUT it happend.

Reply

Credit card used in Apple Pay compromised

Similar questions