How fraudsters manage to add your Avant or Revolut card to their Apple or Google wallet

Brendan Burgess

Brendan Burgess

Founder
Messages
58,536
A good explanation here

www.bitdefender.com

Card added to Apple Pay without permission? What to do

Card added to Apple Pay without permission? Learn how wallet provisioning fraud works, what warning signs to check, and what to do immediately.
www.bitdefender.com www.bitdefender.com

How criminals can add your card to a wallet they control​

Santander UK is warning that it has seen fraudulent Apple Pay and Google Pay setups. One documented pattern starts with a fake shopping site: the victim enters card and personal information, then receives a genuine one-time passcode. The victim thinks the code confirms the purchase, but it actually authorizes the criminal to register the card in their digital wallet.

A typical sequence is:

  1. The criminal obtains card details through phishing, a fake checkout or another compromise
  2. They try to add the card to a wallet on their device
  3. The issuer requests extra verification, and the criminal tricks the cardholder into sharing, entering or approving it
  4. Once the wallet token is active, the criminal can attempt purchases from that device
 
So the fraudster sets up a fake site with attractive bargains.

The customer enters their credit card details on the site.
The fraudster says we will issue you a OTP which you must enter to confirm the process.
The fraudster starts the process of adding the card to their own wallet.
Avant sends an OTP to the customer
The customer inputs the OTP on the fake site.
The fraudster now has the OTP and uses it to add the card to the fraudster's wallet.

Avant sends a text to the customer to say that their card has been added to their wallet.
Most will ring Avant immediately and stop the card.
But some customers will think that this genuine message is a scam message and ignores it or deletes it
 
A simpler fraud tactic

www.theguardian.com

Digital wallet fraud: how your bank card can be stolen without it leaving your wallet

Fraudsters use phishing to steal card details, which fund a spending spree using Apple Pay or Google Pay
www.theguardian.com www.theguardian.com

The fraudster has your credit card details and phone number
They ring you pretending to be from your bank.
They ask you about two suspicious transactions which you don't recognise
They say that they will send you an OTP
(In the meantime they set up your card on a wallet and Avant sends you the OTP)
You tell the caller the OTP and they add your card to their wallet
 
You must log in or register to reply here.
Back
Top