Scams via Apple Pay: this is how it works

Scams via Apple Pay: it’s possible. Criminals have succeeded in committing credit card fraud via Apple’s payment service. Google Pay and Samsung Pay are also vulnerable. The trick works via malware and for the time being no Dutch victims are known.

Scams via Apple Pay

More and more people are using contactless payment services, such as Apple Pay. Checking out is therefore a piece of cake, because you only need an iPhone, Apple Watch or Mac. Moreover, the system is very safe, because you have to approve payments by means of a PIN code or a scan of your fingerprint or face.

The system also has vulnerabilities, discovered Vice† The website gained access to conversations in Telegram (a competitor to WhatsApp) where criminals discuss a new form of credit card fraud via Apple Pay.

They link the victim’s card to their own iPhone, and then run off with the loot. The groups also offer malware to carry out the scam.

Malware is between customer and bank

The scams via Apple Pay happen in the following way. The bottom line is that the criminals sit between the bank’s control system and the iPhone. The moment the victim wants to activate Apple Pay on her or his iPhone, the issuer of the card sends an SMS containing an activation code. However, the code never reaches the victim as it is intercepted by the criminals’ malware.

Once the criminals have managed to link the victim’s credit card to their own iPhone, it is possible to make purchases. According to Vice, the scammers mainly buy gift cards and vouchers with the money. These are resold again to create an astray.

The method has remained fairly under the radar so far, as it is difficult to spot this scam trick. The fraud detection of credit cards does not always work when payment is made contactless.

Apple Pay credit card fraud stays under the radar

According to Vice, this is because less information is passed on to banks with contactless payments. On the one hand, this is good for the privacy of the customer, in this case the victim, but on the other hand it helps credit card frauds and Apple Pay scams.

In addition, the scammers deliberately make small purchases. That way, the credit card companies don’t quickly start ringing alarm bells, as is the case when a large amount of money is suddenly debited.

Apple declined to comment on Vice’s story. Google says banks are responsible for approving transactions. Samsung also points out the importance of checks.

More about Apple Pay

You may not always think about it, but your buying behavior says a lot about who you are. To ensure that this data does not just end up on the street, Apple does everything it can to make Pay as safe as possible. In the article below we explain exactly how the service works.

Further reading: How secure is Apple Pay? 5 questions and answers about the payment service