Apple Pay has established itself as one of the most used digital payment methods among users, thanks to its convenience and the security measures integrated into the Apple ecosystem. However, according to the ESET company, this popularity has also made it a common attraction for cybercriminals, who exploit users’ trust to launch common scams related to psychological manipulation and social engineering.
Apple is known for designing digital ecosystems with security and privacy as fundamental pillars. In this sense, Apple Pay incorporates advanced mechanisms such as biometric authentication and tokenization of card data, making it difficult to directly steal financial information. However, attackers rarely try to breach the technology, but instead focus their efforts on tricking the user into providing their credentials, verification codes, or even authorizing fraudulent payments.
“Criminals know that Apple Pay is perceived as a secure service and they take advantage of that reputation to give credibility to their messages. The problem is not in the platform, but in how scammers get the user to act in a hurry and without verifying what is happening,” explains Josep Albors, director of Research and Awareness at ESET Spain.
The most common scams associated with Apple Pay
ESET identifies five types of fraud that recurrently affect Apple Pay users and that aim to obtain money, bank details or access to the user’s Apple account:
- Phishing and smishing: messages, calls or emails that warn of supposed problems with the account, pending payments or refunds, and direct to false pages where personal and financial information is requested.
- Fraud on online buying and selling platforms: Fake buyers use stolen cards associated with Apple Pay to pay for products, subsequently causing chargebacks to the legitimate seller.
- Unsolicited or excess payments: The user receives an unexpected payment or more than the agreed amount and is asked to return the money by another means, which ends up resulting in an economic loss.
- False receipts or receipts: Manipulated screenshots that simulate a payment made to pressure the seller to send a product that has never been paid for.
- Fraudulent public Wi-Fi: Fake networks that imitate legitimate connections and redirect to fake portals to steal your Apple ID and password.
Warning signs that should not be ignoredHE
ESET reminds that there are clear signs that can help detect a scam attempt related to Apple Pay:
- Messages or calls that generate extreme urgency or fear so that you act immediately.
- Requests for access credentials, something that neither Apple nor banks ever ask for.
- Requests to return money received through alternative methods or gift cards.
- Requirements to ship a product before confirming actual payment.
- Unsolicited communications claiming to come from Apple or a financial institution.
How to protect against these types of scams
To reduce the risk of fraud, ESET recommends adopting a combination of precautionary habits and security measures:
- Activate notifications for all cards linked to Apple Pay to detect any payment instantly.
- Never share verification codes, passwords, or banking details, even if the message appears legitimate.
- Be wary of unexpected payments or requests for money back.
- Avoid using unsecured public Wi-Fi networks and prioritize secure connections.
- Periodically review the activity of your account and associated cards.
“Digital payment systems make our lives easier, but they also allow a scam to materialize in a matter of seconds. Stopping to check a message or transaction before acting is still one of the best defenses,” concludes Albors.
These types of scams aim to obtain money, bank details or access to the citizen’s Apple account.
For those who may feel they have been the victim of a scam related to Apple Pay, ESET advises acting quickly: contact the bank to try to block the payment, change the compromised credentials and report the incident to the appropriate authorities.
