Will subscription trap charge from new card in Apple Pay?

wrj_ipad wrote:

Yes they will be able to charge. I’m on my third BofA visa in less than a week. I was thinking it was BofA that automatically gave new card information to charging merchant/scammer. But I just read it is Apple Pay/Wallet that is allowing a subscription charge when credit card is changed. So that may mean even if I get a new card from a different bank and put it in the wallet the scammer will be able to charge. No wonder the banks charge 20% they have to so as to cover their fraud losses. The bank fraud group says they can’t stop merchant from getting new card info? But maybe that is because it is Apple giving out the information?

What you read is incorrect. Bank of America, like most all banks, use a Credit Card Updater to notify merchants of a change in your card information. Specifically for BoA, they use the VISA Account Updater (VAU). No subscription charges go through Apple Pay and it is not them that is giving the merchant your new information. The only thing Apple Pay does when you sign up for a subscription is give the merchant the unique token that your bank gave you, so the merchant can bill your bank. Those charges are directly billing the bank that issued your card and Apple Pay is not involved with any of those charged.

Those charges can be stopped by BoA, but that may require you formally disputing the charge and simply issuing you a new card number will just pass on that new number to the merchant, because they subscribe to the Credit Card Updater Service. You can read more about it here, and there is actually tons of information online. This example is for streaming services, but applies to any merchant that uses the service.

https://gizmodo.com/how-netflix-other-streaming-services-charge-you-forever-1851439725

It’s neither BoA or Apple. Apple will either do a Card on File transaction or use a Merchant Token (subscription token) depending on several factors. Both are forms of pre authorizing the use of the card by both the card holder and card issuer.

The Payment Network Operator (Visa, MasterCard, American Express etc.) will update the merchant with the new number. This is considered a convenience for the cardholder by the bank and merchant. I understand you’re unlikely to agree.

The merchant has no idea the transaction is fraudulent. Either method I described above is an automated charge and requires no merchant participation. If the declined charge(s) accumulate, the moment the card details are updated, the automatic billing will initiate the pre authorized payment.

The bank needs to revoke any Merchant Tokens they have on the iPhone. If the bank can’t directly revoke the Merchant Token, their Token Service Provider (TSP) can.

Removing the card from the Wallet has no effect on a pre authorized transaction.

It makes no difference whether you have the card added to your wallet. The merchant is not billing Apple Pay, they are billing your card directly with the unique token your bank gave you to send to the merchant securely.

The bank can block the transactions and simply issuing you a new card number is not likely going to prevent the charges. Banks use a Credit Card Updater that automatically gives merchants your new card information that allows any subscriptions to continue on the new card. Your bank knows how this works, although not sure about the representative you talked to. It may take you formally disputing the charge so it will not appear again.

Apple is not involved at this point, so they were correct in saying they are not sure if the charge will appear as that is now between your bank and the merchant. Anyways, your in good hands with Jeff Donald and didn't mean to jump in here, but wanted to give you a little information on what actually is happening.

Your Wallet has nothing to do with it. You can start a subscription with Apple Pay and that subscription will continue even if you remove your card from your Wallet. Nothing further goes through Apple Pay or your Wallet. Hopefully you got through to the fraud department that you wanted those charges blocked, otherwise they will continue. I do know first tier support issuing you a new card will not solve the problem, but their fraud department should be able to take the action needed for a resolution. What you experienced is nothing new and none of their representatives should be having any trouble resolving it.

Apple doesn’t have the data. Apple mostly uses tokenization, but could have some CoF transactions about. Some countries do not permit tokenization. These could be card on file transactions if they are from Cyprus and Armenia. But it’s one of the two methods I described in my prior thread.

“When you use a payment card, Apple may retain and automatically update your card number and billing information for future purchases, recurring transactions, or other uses you authorize. Apple may obtain this information from your financial institution or payment network, and also use it for fraud prevention and verification.”

“If you have enabled Apple Pay, Apple will also check whether any Apple Pay payment methods are eligible to be added as a payment method on file to your Apple Account and display those payment methods below Found in Wallet. When you conduct a transaction with your Apple Account, Apple may also check whether any Apple Account payment methods on file are eligible for Apple Pay. If so, to help safeguard your payment information, Apple may enable Apple Pay for that payment method. You can modify your payment methods at any time by going to Settings > [your name] > Payment & Shipping.”

Legal - Apple Account & Privacy- Apple

The part I made bold and underlined explains where the updated information comes from. The second part explains how tokenization of a card on file happens. But tokenization is not permitted in some countries and regions due to banking regulations.

You two sources are both correct. The updated card details comes first from bank or PNO. If a token is used, the information updates the token (Apple Pay) and the updated information is sent to the bank and they approve the transaction.

Tokens are not the property of Apple. Only the bank and Token Service Provider can delete the merchant token being used. Apple has no authority to delete the token.

OK, I don’t have my iPhone handy at the moment. I may need a screen shot. What do you see when you follow this path,

iPhone, Wallet > tap card > tap More Button (3 dots in a circle in upper right corner of screen) > what options are listed?

Yes they will be able to charge. I’m on my third BofA visa in less than a week. I was thinking it was BofA that automatically gave new card information to charging merchant/scammer. But I just read it is Apple Pay/Wallet that is allowing a subscription charge when credit card is changed. So that may mean even if I get a new card from a different bank and put it in the wallet the scammer will be able to charge. No wonder the banks charge 20% they have to so as to cover their fraud losses. The bank fraud group says they can’t stop merchant from getting new card info? But maybe that is because it is Apple giving out the information?

Well I’m now on my third card in a week. They sent me the third card today but I have been telling them the scammer is getting the new card info immediately. I have read two different explanations. One says the bank is giving merchant the new data another says it is Apple Pay. When I get this third card I won’t put it in the wallet. Then if the crooks charge again (first was from Cyprus, second from Armenia) I will know it is the bank. I just spent about 2 hours with three different groups of credit card fraud representatives and none of them knew how to stop this. I’m getting a card from another bank now. But will be nervous about using it in wallet as I’m not positive it isn’t Apple sharing the data.

I made a mistake. Please follow these slightly different instructions,

iPhone > Wallet > More button (upper right corner) > what options are available to select?