Apple Pay - great for scammers

[Trailhead]

It turns out Apple Pay is great for scammers....

Someone has got hold of my credit card number, entered it into their iPhone and hey presto they’ve got a contactless method of spending my money both on the high street and online. Which they have done. There was no requirement for the iPhone to authenticate it was me when the card was registered to the device!!!

The bank have been pretty useless, whilst they say they will refund me, they can’t block my account from Apple Pay in the future. What’s more, my new replacement credit card will automatically update in the scammers iPhone so issuing a new card is pretty pointless. I found this hard to believe but I’ve checked my own Apple Pay and it is indeed already showing the new credit card number that was issued a few minutes ago.

Apparently i need to speak to Apple and they are closed, will see how useful they are in the morning!

Surely the bank are losing millions on this as you don’t need to be sophisticated to commit this fraud.

Rant over!

[RobDickinson]

Typical apple genius.

They ran for years without checking site ssl certificates.

For a long time (still?) you couldnt tell your iPhone to forget an SSD so it would auto connect to any spammed fake wifi and drop you in st etc.

And people think they are secure.

[Trailhead]

RobDickinson said:

Typical apple genius.

They ran for years without checking site ssl certificates.

For a long time (still?) you couldnt tell your iPhone to forget an SSD so it would auto connect to any spammed fake wifi and drop you in st etc.

And people think they are secure.

Very annoying. There doesn’t seem anything I can do about this.

If Apple don’t play ball tomorrow, my only option is to permanently cancel my card. Or keep getting scammed.

[cay]

Strange, pretty sure when I registered my cards it asked for the CVC and a text message to confirm before it was activated.

Maybe it's an issue with your bank not requiring verification.

Also not true that new card will update, I had to add again when my card number changed.

[Rosscow]

They need more than just your credit card number. They need your name, expiry date and the 3 digit security code on the reverse.

Any new card will have a different 3 digit security number.

Left your wallet/card somewhere it shouldn’t be?

[Nickbrapp]

When I registered my Apple Pay I had to put in the code on the back, and then natwest text me to log into the app to authorise the use of the Apple Pay.

I’ve just changed my debit card too and had to manually change it, didn’t update automatically

Who do you Bank with

[Dogwatch]

Rosscow said:

They need more than just your credit card number. They need your name, expiry date and the 3 digit security code on the reverse.

Left your wallet/card somewhere it shouldn’t be?

Plenty of sites also want those details and store them with who knows what security.

[Trailhead]

cay said:

Also not true that new card will update, I had to add again when my card number changed.

It absolutely is true (with my bank). The card number on my iPhone has already updated to the card that is still in the post....

Awful security flaw.

[bga]

Dogwatch said:

Rosscow said:

They need more than just your credit card number. They need your name, expiry date and the 3 digit security code on the reverse.

Left your wallet/card somewhere it shouldn’t be?

Plenty of sites also want those details and store them with who knows what security.

If they are processing card payments then the security requirement are well documented https://www.pcisecuritystandards.org/

[Trailhead]

Trailhead said:

cay said:

Also not true that new card will update, I had to add again when my card number changed.

It absolutely is true (with my bank). The card number on my iPhone has already updated to the card that is still in the post....

Awful security flaw.

Took a call from the bank this morning, scammers went shopping with the updated bank details on Apple Pay! Thankfully the new card was blocked whilst in the post so the transactions failed (two different shops) and I now have a third card being sent to me.....

Mind boggling awful control procedures between the bank and Apple.

[jmorgan]

Dogwatch said:

Rosscow said:

They need more than just your credit card number. They need your name, expiry date and the 3 digit security code on the reverse.

Left your wallet/card somewhere it shouldn’t be?

Plenty of sites also want those details and store them with who knows what security.

Bank reckons that how my card was done, someone hacked a database with my details on. Someone buys the details and loads up on Apple pay, I would be checking all sorts of things to see what is compromised.

[mp3manager]

Worst 'I've got an iphone' thread ever.

This is exactly the reason why I don't have and will never have a smartphone.....far too smart for their own good with far too many security holes.

I'll stick to my Razr V3 ta very much.

[off_again]

cay said:

Strange, pretty sure when I registered my cards it asked for the CVC and a text message to confirm before it was activated.

Maybe it's an issue with your bank not requiring verification.

Also not true that new card will update, I had to add again when my card number changed.

^ This

Used it a bunch of times for simple and small stuff - works well (well I am in the US and its taken in a lot more places). But the system here means you get a message from Apple Pay (usually a sms / imessage thing) that a card has been registered, then you get a message from your issuing bank for the card AND then you get an email from Apple via the usual iTunes thing about a change to your account. Actually had 3 cards on my Apple pay - a credit union credit card, a Capital One credit card and an business Amex card - all three did the same thing.

Same works in reverse too, so you get the same when you de-activate a card, and the system should identify the same card on two different phones and block the second attempt.

I would be pushing back at your card issuer though - sounds like something is broken or they havent informed you of something. A replacement card maybe?

[p1stonhead]

Im sure apple pay requires a password to be texted to your phone to authenticate it being added to a new device?

Perhaps thats only with 'two factor authentication'? Turn that on from now on if you havent already.

[surveyor]

Do sites save the 3 digit security code? Most ask for me to complete it.

[sc0tt]

Halifax have 2FA when adding new cards. Who is your bank unless I missed it OP?

[Alucidnation]

I thought the limit was £30 and every 5 transactions required touch id or summink?

I don't use it so could be talking cobblers.

[p1stonhead]

No limit on Apple Pay in a lot of places now.

Every single transaction requires TouchID. OP had his card put onto someone else’s phone hence no problem with TouchId

[Alucidnation]

Ah ok thanks.

Appears op must have left all his card details exposed somewhere then.

[BoRED S2upid]

There is a requirement for your bank to authorise the card to be used on your phone. Mine does this by sending an activation code to the registered mobile. If your bank hasn’t done this I’d have a word and change bank pronto as it’s not just Apple there is android pay and even Fitbit now!