How did a scam text gain access to my Apple Pay without clicking anything?

It’s not a breach. You need to read the articles I linked to below so you learn about phishing and Social Engineering. The only serious part is you got emailed or messaged and responded to scammers.

These messages and emails have been going around since July 2024 and have been widely reported in here in multiple Apple Support communities, Facebook, Instagram, TikTok, YouTube etc.

“Never answer suspicious phone calls or click on messages claiming to be from Apple. Instead, contact Apple directly through our official support channels.”

”To report a suspicious SMS text message that looks like it's supposed to be from Apple, take a screenshot of the message and email the screenshot to reportphishing@apple.com.”

You can report phishing at these links and most importantly your local law enforcement.

• Identify legitimate emails from the App Store or iTunes Store.
• FTC Complaint Assistant
• FBI’s Internet Crime Complaint Center

Learn about how not to be a victim of Social Engineering.

Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Apple Support

A text cannot gain entry to your Apple Wallet or use Apple Pay without your Face ID or Passcode. It just cannot happen. A dynamic token needs to be generated which requires Face ID or Passcode.

I wonder if you were actually talking to your bank or the scammers. Did you use the number printed on the back of the card? If not, how did you contact BOA?

If your iPhone is compromised it’s not related to Apple Wallet or Apple Pay. Apple Wallet and the payment information are stored in The Secure Element. The payment information does not include your actual card number, security code or expiration date. What is stored, in encrypted form, is a dynamic payment token issued by your bank. A new code is created only after a payment has been initiated by use of Face ID or passcode. A text message cannot access that area of your iPhone.

The Secure Element is its own SOC (System on a Chip) and shares nothing with iOS, except same power supply. It has its own CPU and memory. SE runs Java and a text on iOS can’t leap from iOS to the SE. Even if it could, the information is encrypted and only your bank has the key to decrypt payment information from the token.

So, other than everything you claim has happened through your device is impossible, what would you like to know? Would you like me to explain 256 bit encryption your bank uses is used by every major bank in the world? If the encryption was hacked, it would be major news and yet not a single source is reporting this.

The resolution is that your iPhone is not hacked. The text you received was from scammers and if you have suffered any loss it’s because you replied to the text.

But continuing with your claim of hacking needs some proof from your end. Please provide some evidence that you were hacked. Lacking proof I have serious doubts about the veracity of your story and claim of hacking.

No one here works for Apple. You missed reading the information about these communities when you joined. We’re all fellow users, just like you. Apple hosts the communities and provides moderation to keep the communities safe and insure everyone follows the rules. Apple Support does not participate here or even read the comments. Link is below to official Apple Support.

The goal here is to insure you, your iPhone is safe. We’ve done that. If you don’t like the style of my writing, that’s fine, I get it. Try understanding the content. Your goal was to understand and several of us have explained how your iPhone is not hacked and Apple Pay is safe. You asked the question, “How did a scam text gain access to my Apple Pay?” I’ve explained how that’s not possible. You’ve made false accusations. Do you take responsibility for that? If you’re standing by your comments above then I question the truthfulness of your statements. You need to provide more details, a screenshot of the text or something. You claim to be panicking about a phone hack and I’ve explained how it’s impossible. Rather than satisfied and relieved you attack the messenger when you don’t like what he tells you.

CONTACT OFFICIAL APPLE SUPPORT

If you’re in the US please call  1-800-MY-APPLE or outside the US, consult the support articles below.

Contact Apple for support and service - Apple Support

Genius Bar Reservation and Apple Support Options - Apple

Official Apple Support

shida130 wrote:

LOL yes they literally can access your wallet from a text message. it just happened to me (again thank goodness my bank/company was quick to block them. & this is terrifying that Apple doesn’t know or is aware of this.

and yes, I was literally speaking to my Bank, that I work for (on the wealth management side). I also rushed to Verizon wireless today because I’m completely concerned now about them gaining access like they did & they told me the same thing that they see these text & they are aware of this issue. So it seems that only Apple isn’t aware.

If that were possible, we’d all be buried in those messages.

Since you have access to your own organization’s IT support, ask them about phishing and scams, too.

shida130 wrote:

LOL yes they literally can access your wallet from a text message. it just happened to me (again thank goodness my bank/company was quick to block them. & this is terrifying that Apple doesn’t know or is aware of this.

and yes, I was literally speaking to my Bank, that I work for (on the wealth management side). I also rushed to Verizon wireless today because I’m completely concerned now about them gaining access like they did & they told me the same thing that they see these text & they are aware of this issue. So it seems that only Apple isn’t aware.

Nope. This is simply not possible. Even if a message somehow opened the wallet app (it didn't) it would be unable to authenticate any transaction without your. intervention.