Hong Kong’s iPhone scam: how to protect your credit card from online fraud
More than 700 Hongkongers were shocked to discover that their credit cards had been used to place unauthorised orders for Apple’s new iPhone 18 Pro series handsets over the weekend. Although banks reassured victims they would not be charged as long as the cards were used with due care and the transactions were proven to be unauthorised, the incident still caused widespread concern over credit…
Over 700 Hong Kong residents discovered in recent days that their credit cards were used to purchase unauthorized Apple iPhone 18 Pro series devices. While banks assured victims they would not be held responsible for the charges, if the transactions were proven to be fraudulent, the incident sparked concern over credit card security among the public. IT experts offered advice on how to safeguard credit cards from unauthorized use.
According to the South China Morning Post, police received over 700 reports of credit card fraud totaling HK$14.7 million (US$1.87 million) over the weekend. Social media users reported unauthorized orders for the newly announced iPhone 18 Pro series, which began pre-orders on Saturday evening. Information technology experts suggested that Apple may have disabled multi-factor authentication to ease the purchasing process during the surge in demand, creating an opportunity for cybercriminals to exploit the situation.
Major banks in Hong Kong stated that customers would not be held accountable for the unauthorized transactions, provided the purchases were confirmed as fraudulent and the cardholders took necessary precautions. Apple confirmed they were reviewing all current orders to identify and cancel any suspicious transactions.
Three-D Secure (3D Secure) is an additional security measure for online payments that verifies the buyer's identity. The latest version of 3D Secure determines transaction risks using information from the merchant, browser fingerprinting, and the user's transaction history. While most legitimate transactions proceed smoothly without requiring customer action, higher-risk purchases may request a one-time password (OTP) or approval via mobile banking apps.
However, some merchants disable 3D Secure through their payment gateways to simplify the checkout process, leaving them solely responsible for any losses resulting from unauthorized transactions, according to the Hong Kong Monetary Authority (HKMA).
Experts believe the stolen credit card information had been exposed previously and held by fraudsters. Retail websites, which were not required to submit regular security audit reports, likely lacked proper encryption when backing up data, making data breaches more likely. Francis Fong Po-kiu, honorary president of the Hong Kong Information Technology Federation, warned that using proxy purchasing services on ticket platforms, where users transfer payment details to automated tools, poses significant risks.
Once personal details are leaked, credit card fraud could occur at any time. To protect credit cards, experts recommend avoiding direct use of credit cards on retail websites, storing payment credentials, or utilizing payment tools that link directly to cards. Instead, using digital wallets, such as Alipay, PayMe, or PayPal, is advised.
These platforms do not provide direct access to card information, reducing the risk of unauthorized use.
Written by urgent.news from South China Morning Post's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
