iPhone was cloned to hack Apple Pay to make unauthorized purchases

Yes, it's not possible to "clone" the iPhone. What could have likely happened is that someone signed into a new iPhone with your Apple account and restored from iCloud backup. This would however imply a two-factor authentication. I think you would have noticed that as one of your devices would have gotten a prompt about a sign-in attempt.

Now, assuming that somehow that was approved, in order to make purchases, the Apple Pay credit cards would have also needed to be confirmed and activated on the new device. This requires a confirmation with your bank, usually via text or phone call. This is also something that you would have noticed on your phone as it would receive a text or call from the bank.

All in all a very unlikely outcome.

Would you be able to share some more details please?

It was not "cloned":

• What card do you see the purchases on?
• It is the bank that authorizes a card to be added to a device?
• Are you sharing your Apple Account with anyone else or have you given your Apple Account password to someone else. You can view the devices using your Apple Account by going to Settings > [name on top], and scroll to the bottom to see the devices using your Apple Account. Using two factor authentication prevents another device from using your Apple Account unless you authorize with a verification code.

Information about your cards are tokenized and encrypted then stored in the Secure Element. The System on a Chip (SOC) has a separate processor, separate memory and is not connected to iOS in any way. It runs Java OS and it’s used by virtually every bank and electronic wallet and never been hacked or cloned.

https://en.wikipedia.org/wiki/Secure_element

Listen to Chattanoogan, he knows what he’s talking about. 😀

This is technically VERY unlikely, especially w/o an already compromised Device and/or Apple Account and/or Payment Method.

Care to provide any details?

That said, a legacy credit card compromised by any number of “traditional / tried-and-true” fraud methods may be fraudulently added to another AppleID and fraudulently used …

… albeit w/ your bank’s approval.

No. It wasn’t. Look for another explanation. This is a dead end.

BTW, congrats on approaching the well-deserved L8.

Restoring from iCloud backup does not restore credit or debit cards stored in the Wallet app.

Thank you, Chattanoogan!