Apple is not a bank and does not approve or decline transactions. Apple also cannot verify the card owners identity or verify a card added to an Apple Wallet app. The verification and authorization process is controlled by the bank and Payment Network Operator.
Your friend’s card details were probably skimmed at a transaction terminal or ATM. The card could also have been disclosed during a hack of a merchant. The information along with personal information is generally sold on the dark web.
Once the information is in the scammers hands they will frequently add it to an electronic wallet, such as Google Wallet, Apple Wallet, Samsung Wallet etc. In order for the card to be added to an electronic wallet the PNO (Visa, Mastercard, etc.) and issuing bank must verify and approve adding it. Once in a wallet the card can be used online or in person at merchant locations.
Your friend should report the fraud to his local law enforcement and the issuing bank. The bank approved the transaction, they will be responsible for any refund or credit to the account.