[Scammed] Fraudulent charge on my Apple Pay account

I explained that in my post of October 11.

You used the card by swiping or inserting it into a transaction terminal. Thieves (scammers) insert what are known as as skimmers or shimmers into into the terminal/keypad and all the card information on the chip and or magnetic stripe are captured and in many cases sent over the internet to the scammer. In some case the skimmer has to be retrieved from the terminal by the scammer to retrieve the data.

Once the data is obtained/skimmed, it’s almost always sold on the Dark Web and sold multiple times. The fraudsters who bought the data then make counterfeit cards to use at merchants physical locations, enter into websites, open accounts with merchants and even add to Google Pay, Samsung Pay, and even Apple Pay.

So, a fraudster purchased you data on the dark web, enters the data on their iPhone and then opens an Uber account. Your bank, the one that issued the card, confirmed the card was legitimate, and thought it was you entering the data in an iPhone. They authorized adding the card to the fraudsters Wallet and also authorized the transaction(s) with Uber.

This happens everyday. Not once, not twice but is repeated thousands and tens of thousands of times every day. You don’t have to believe me. Go to YouTube and search skimmers, shimmers, credit card fraud and you’ll find thousands of videos explaining and documenting incidents of fraud similar to yours. Some of the videos are from the Secret Service, FBI and local police and TV stations.

What you’re experiencing is simple credit card fraud using skimmers. It has nothing to do with poor business practices of an independent business. Two unrelated incidents.

Please report the fraudulent charges with apple:

How to report a transaction issue or dispute a charge to your Apple Card - Apple Support

And your bank.

You can also report Vulnerabilities here:

Report a security or privacy vulnerability - Apple Support

I hope your bank can get on the issue 🙏

The Payment Network Operators (MasterCard, Visa, American Express, etc.) offer services to continue certain merchant services, such as subscriptions, when the card number is changed. MasterCard calls it Automatic Billing Updater (ABU), https://developer.mastercard.com/product/automatic-billing-updater-abu/. All the PNO’s offer a similar service. The only way for the charges to be stopped is to cancel the account and open a new account. Just have the number changed, is exactly what ABU is designed to update. The Reddit link you posted is exactly the same thing.

The issue is that these scam websites, as you describe them, are offering subscriptions. Subscriptions are an enforceable legal contract. This enables the merchant to keep the original token on file and when you update the card with a new number, the token is still enabled because of the subscription, a legal contract. I’m not sure where this notion of approving all charges is actually a requirement of some sort. You sign an agreement, start a subscription, you’re legally required to complete your agreement and the merchant is within their rights to enforce the contract and continue to bill you.

You didn’t provide enough details about the Uber incident to comment on what is causing the issue.

When you originally signed up for the subscription, the token the merchant received was a multi use token, because you agreed to a subscription. The merchant resubmits the payment token each month/year (whatever the terms of the subscription are), the merchant receives payment from your bank and the bank sends the receipt to your Wallet for display.

The subscription/payment is initiated by merchant, not Apple Pay. The merchant submits the token to his credit card processor and it travels to the bank for payment. Bank initiates payment and funds transfer to merchant bank. There are various stops along the way through various parties to record the transaction, verify information and deduct fees from the funds etc.

Whenever, you update the number, the ABU, updates the token automatically with the new number. Banks offer a push service for the ABU, so literally within seconds the subscription is updated with the new number. In many instances, the website (subscription) will test the new number and instantly generate a charge. This makes it look as though Apple Wallet is hacked. 

The issue with the merchant is between you and your bank. Apple has no legal standing to get involved. It has no direct knowledge of a crime. If you think a crime is being committed by the merchant report the fraudulent activity to the police. Apple cooperates with local police all the time. 

How does someone use >My Apple Pay<? If the physical card is swiped or chip inserted at a compromised transaction terminal the card details can be obtained by a skimmer.

Once the data is obtained the information can be sent via WiFi to the fraudsters. This information and information contained from recent hacks can be bundled and sold on the Dark Web. The data is then turned into counterfeit cards and/or added to electronic wallets for use with Google Pay, Apple Pay, Samsung Pay etc.

The device is then used to make purchases on websites offering Apple Pay.

I’ve been to the website you posted above. Any purchase is a subscription It states so in their help articles,

https://help.cerebrumiq.com/hc/cerebrum-iq-help-center%202/articles/1722840864-i-didn-t-authorize-a-subscription-or-recurring-charge

However, they don’t offer Apple Pay as a payment method. What makes you think Apple Pay was compromised by the website?

We’re having two different user experiences. I’m accessing the site on my iPad and Apple Pay does not appear as an option. Yet, it does show as an option on your iPhone. The cost on the iPad is 99¢ for 7 days and $19.99 a week thereafter. The help article I linked to above clearly explains the subscription component.

>As part of our subscription service, every user is required to have a subscription, and we'd like to notify you that our plan automatically renews post-trial unless canceled within the trial period.<

The article goes on to state that the 7 day trial must be cancelled 48 hours before the end of the trial. Many companies charge the subscription up front as a way of testing the card to make sure it’s good and then if the subscription is cancelled within the terms of the contract, charges are refunded. This is pretty standard business practice in that industry. Many of the apps on the Google Play Store and Apple App Store operate the same way.

The website on iPad shows a help page, https://help.cerebrumiq.com/. The 7 day trial is clearly marked as $1.47. I don’t see free trial anywhere as an option on your screenshot. I agree their business practices are sketchy, but I don’t see anything to indicate a scam operation.

What are you referring to here? >Spoke to my bank. They were also confused as to how the payment reflected on Apple Pay when I did not make the transaction.< You said you felt you were scammed on the website. Did you complete a transaction/payment or not. Sorry, but I’m missing something.

I get it that you have a major disagreement about the business practices of a merchant. It’s also become apparent you don’t understand how subscriptions work and the business practices of the merchant. But poor or deceptive business practices does not make a business capable of hacking or compromising Apple Pay, your iPhone or other accounts.

Please reread my posts on how merchants can use Automatic Billing Update to continue to bill for subscriptions when account numbers are changed. This isn’t a compromised account or hacked Wallet or iPhone. It’s a legitimate business practice offered by the Networks.

So, what you really may have is something going on with Uber and your Uber account. Have you worked with Uber to resolve your issue?