How to stop and refund unauthorized Apple purchases on a friend's Android device?

I am not following that fully but my first take on it is these are scam/phishing messages.

Criminals are getting very good at imitating Apple messages. Start here about recognizing phishing and scams —> Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Apple Support

Read this article about identifying real App Store and iTunes Store emails --> Identify legitimate emails from the App Store or iTunes Store - Apple Support Sometimes the only indication in an email is very subtle. Have a look at this thread. Someone registered an Apple ID with my em… - Apple Community It can be very hard to tell from an email alone if it is authentic. The best way to check is to use an independent way through Apple's own resources to confirm what the communication claims. Scams (e-mail, text messages, and phone calls) are getting very good at closely imitating true Apple communications. Always be cautious. These support articles have some guidelines:

More information about scams:

Apple Cash --> Avoid scams when you use Apple Cash - Apple Support

Gift Card Scams --> About Gift Card Scams - Official Apple Support

If you are uncertain about a message and a resource provided in that message, do not click on any links in the message. Use an actual apple.com resource to independently verify what the message is claiming, or use an Apple device feature such as Settings or an Apple app. To ask Apple, start at this web page: Official Apple Support If you wish to investigate links, this post by contributor MrHoffman describes how you can do that —> "Keep your Apple Account safe and secure"… - Apple Community (the link takes you to the end of the post so scroll up a bit).

- Do a web search for any telephone number being provided. See if it is listed on an actual real apple.com web page as a contact method.

- Apple won’t warn you about disabling an account. You will find out when you try to sign in.

- Phishing emails may include account suspension or similar threats in order to panic you into clicking on a link without thinking. They may report a fake purchase in order to infuriate you into rashly clicking on a false link to report a problem.

- Apple e-mails address you by your real name, not something like "Dear Customer", "Dear Client", or an e-mail address* However, having your actual name is not proof this isn’t phishing. Compromised databases may have your name and address in them.

- Apple e-mails originate from @apple.com or @itunes.com but it is possible to spoof a sender address. "Apple email related to your Apple ID account always comes from appleid@id.apple.com ." (From an older version of: About your Apple Account email addresses - Apple Support )

- Set your email to display Show Headers or Show Original to view Received From. Apple emails originate from IP addresses starting with "17.".

- Mouse-over links to see if they direct to real Apple web sites. Do not click on them as this just tells the spammer they have a working e-mail address in their database. If you are unsure, contact Apple using a link from the Apple.com web site, not one in an email.

- Apple will not ask for personal information in an e-mail and never for a social security number.

- Scams frequently have bad grammar or spelling mistakes.

- Apple will not phone you unless it is in response to a request from you to have them call you.

* Exception: I got email saying my ID is expired! Does… - Apple Community

“If you receive a suspicious link to a FaceTime call in Messages or Mail, email a screenshot of the link to reportfacetimefraud@apple.com. The screenshot should include the phone number or email address that sent the link.”

Scam messages are frequently about charges that are not real. They are used to scare you into thinking you have been charged for something so you then sign into a fake "Apple" web site, thereby providing the scammer with your account information. They can then use that to make real purchases, or try to take over your account. If they do go so far as to make real purchases and they use your credit or debit card, you need to contact your bank about card fraud. That has nothing to do with Apple.

If instead they use your account balance, well, there is nothing you can do about that other than regard it as having learned a life lesson to not fall for scams.

In either case where you have provided them with your account information, deal with the compromised account:

Read this document if you think your Apple Account has been compromised. --> If you think your Apple Account has been compromised - Apple Support

For iOS 15 or earlier, if you want to see if anyone else has access to your device or accounts, click here --> Checklist 1: Limit device and account access - Apple Support

For iOS 16 or later see how Safety Check on iPhone works to keep you safe. Safety Check for an iPhone with iOS 16 or later - Apple Support

Use the information in this document to check your Apple ID device list to find where you're signed in --> Check your Apple Account device list to find where you’re signed in - Apple Support

Related materials:

Personal Safety User Guide

Personal Safety User Guide - Apple Support

> open the Table of Contents and review the articles

A document with general information about security and your Apple ID --> Security and your Apple Account - Apple Support

Contact Apple for help with Apple ID account security. This page provides country-specific Apple Support contact information ➞ Contact Apple Support - Apple Support

luchezar52 wrote:

Hello.

My friend’s operator on his android, send’s him some messages that he purchased from apple sale “Apple ***”. What could this mean and how i can stop the payment and get my money back and who’s id is. They did this many times.

Who is getting these messages? You? Or your friend? It's quite possible these are scam messages. The first thing to do is to check the account the messages say is being billed to see if that's really happening.

luchezar52 wrote:

Okay thanks, but how can he get his money back

If you are just seeing a scam message, there has been no money deducted from any account. I assume that would have been the first thing that was done to check the account. What was seen there? To dispute any fraudulent charge, they are the ones you would also need to contact.

luchezar52 wrote:

Okay thanks, but how can he get his money back

If your friend checks his account and the funds are actually transferred out, he needs to contact the bank that issued the credit or debit account. Merchants are not generally responsible for fraudulent transactions if they follow the network operator’s guidelines for accepting card payments.