Scammers cannot easily steal your actual card numbers directly from Apple Pay due to tokenization, but they can trick you into giving them access to your account or authorize fraudulent transactions. Scammers typically use social engineering (phishing/vishing) to get 2FA codes or manipulate you into adding their device to your wallet.
Apple Pay provides extra privacy
Instead, Apple Pay uses a unique, one-time passcode whenever you make a purchase. This hides your sensitive account information. The merchant will only receive your name, email, billing, and shipping addresses, and anything else necessary to process the order.
When you use Apple Pay in apps and on the web, information necessary to process the payment is shared with the app or website. Your actual card number isn't shared with the merchant.
By sharing both your card details and the code, the scammer can enter your card details into a digital wallet on another phone, tablet or watch.
Apple Pay uses security features built-in to the hardware and software of your device to help protect your transactions. In addition, to use Apple Pay, you must have a passcode set on your device and, optionally, Face ID, Touch ID, or Optic ID. Apple Pay is also designed to protect your personal information.
A card skimmer is a device that's installed on card readers and can collect credit card numbers. Thieves can then recover and use the stolen information to make fraudulent purchases. In some cases, a skimmer is in the form of a tiny camera placed on a card reader.
Neither Apple nor your device sends your actual payment card number to the app. Apple retains anonymous transaction information, including the approximate purchase amount, app developer and app name, approximate date and time, and whether the transaction completed successfully.
The biggest risk associated with Apple Pay is someone stealing your phone and being able to unlock it. This concern typically arises only if you use a weak passcode, but because your device passcode can override biometric security, using an easy-to-guess code or sharing it with others puts your money at risk.
Use strong passcodes and Face ID/Touch ID
Apple Pay requires you to authenticate payments using biometrics (Face ID, Touch ID, or Optic ID) or your device passcode. This means even if someone has your device, they can't approve payments without your face, fingerprint, or passcode.
Apple Pay is the safest payment method to use. It doesn't provide card numbers to merchants and it doesn't store them on your devices or Apple servers. Apple Pay also requires authentication every time you pay, so no one else can use your device to make transactions unless they know your passcode.
If you were scammed on Apple Pay, immediately contact your bank/card issuer to dispute the charge, as they handle fraud for linked cards; for Apple Cash, report it via the Wallet app, but funds are hard to recover as it's like cash, so act fast, report to authorities (FTC, police), and secure your Apple ID, though refunds are difficult for accepted Apple Cash payments.
You'll know if your iPhone might be hacked by signs like rapid battery drain, overheating, excessive data usage, unfamiliar apps, or strange behavior like unexpected pop-ups, apps opening on their own, or contacts receiving odd messages from you, often indicating background processes or spyware. Check Settings > Battery for high usage by unknown apps, review Settings > Privacy & Security > Safety Check to manage app access, and look for unauthorized activity on your Apple ID.
Dispute the payment via Apple Support: If you decide to use Apple Pay, remember that the service does not include a buyer protection policy. In the event of a scam, consider contacting your bank first. Change your passwords: If your Apple Pay details have been compromised, you need to change them.
Private. Not plastic. Your physical card details are your business. And Apple Pay keeps those card details — card number, expiration date, and CVV number — hidden.
Go to Settings > Wallet & Apple Pay. Tap the card that you want to remove. Tap Remove Card.
The Apple Pay system itself has never suffered a hack, but if your device is compromised through phishing, weak passcodes, or malicious apps, someone could potentially use it fraudulently. That's why it's essential to secure your device with strong authentication and keep your software up to date.
Apple Pay is safer than using a physical credit, debit or pre-paid card. Face ID, Touch ID or your passcode is required for purchases on your iPhone, Apple Watch, Mac or iPad. Your identity isn't shared with merchants and they don't see your actual card number. And your card numbers are never stored on Apple servers.
If someone that you don't know, or whose contact information you don't recognize, contacts you via phone, email, on a messaging platform, or on a social media platform and asks you to send money via Apple Cash, don't make the payment — even if the person claims to be someone that you know.
Scammers use phrases that create urgency, fear, or excitement, demanding immediate action like "Act now!" or "Don't hang up," and often involve requests for gift cards or Bitcoin, combined with threats of account compromise or promises of huge rewards (e.g., "You've won!") to bypass logic. Key tactics include isolation ("Don't tell anyone"), emotional manipulation (love bombing, family emergencies), and unusual requests to move money in specific ways (Bitcoin ATMs, secret accounts).
If you shared your credit card or banking information with a scammer, then call your financial institution to let them know. They will follow a fraud procedure that might include helping you change your password, or closing your old account and opening a new one. The latter may require new credit and debit cards.
When you bank or shop on public Wi-Fi networks, hackers can use keylogging software to capture everything you type, including your name, debit card account number and PIN. That is why it is important to be careful online by always using secure websites with private Wi-Fi when shopping or banking.