Your card information was not compromised because your cards were in your Apple Wallet or you used Apple Pay. The cards were possibly compromised when you swiped the card or inserted the chip into a scanner. Another possibility is you used your card online or at a merchant’s retail location and a data breach happened. Lastly, if you ever handed your card to a restaurant server etc. the card could have been compromised.
Apple Pay protects against all those occurrences. Your bank added a token on your iPhone and changed the card number and encrypted it. In other words the number, expiration date and security code on your card is not the same as used by Apple Pay.
When you tap to pay with your iPhone the token on your iPhone produces a one time use payment specifically for your payment. It cannot be used ever again and the merchant does not have the key to decrypt it. Only your bank has the key to decrypt the payment. Not even Apple or your iPhone has the key.
Your card numbers are not stored on your device or backed up to iCloud. So, if your card numbers were used with Apple Pay, it was your bank. Apple is not a bank and does not participate in approving your card for Apple Wallet. When the scammers entered your compromised details on their devices, it was your bank that approved adding your card details to the scammers Apple Accounts, not Apple.
I understand your frustration. But you need to recognize and understand the security risk and continue to use what banks consider the safest payment method, Apple Pay.
