Irregular Apple Pay payments from current account

FredaGrey

I was very shaken to discover that, over a period of three days, £3.5k in Apple Pay payments was made to a cab company in a different city to my home address from my account. These were small transactions often overnight, minutes apart, and amounted to literally dozens of outgoings. My iPhone has Apple Pay on it via a recently issued Mastercard debit from Santander. I have Touch ID.

Even more weirdly, the merchant made refunds to the value of £2k in small sums. Sometimes the refunds arrived before the deductions were made which is baffling.

I logged with Santander who closed down the card and removed from my iPhone. But they insist it was me that made the payments and will not refund nor take responsibility for not spotting what was blatantly irregular activity when I have been with them for decades.

I have made a police report and have a crime reference number. Apple Pay simply refer you back to the card issuer judging by their UK support site. As the card has been cancelled by Santander I have no way to try to get a refund via the iPhone 'app'/Wallet.

The loss of the money is devastating financially as has not being believed by the bank. A formal complaint has been lodged after which the Financial Ombudsman will be contacted. I have read of the security issues with Visa and iPhone and wonder if it is also a Mastercard issue.

Is there anything else I can do to try to get recompense? The car company is no longer trading as a separate legal entity and is part of an umbrella group - is it appropriate that I contact them directly or even via a solicitor? I have no details for them or any bank details, just their name appears on my statement and, as said, Santander are unwilling to assist me.

I would be most grateful for any advice or suggestions. Thank you in advance.

born_again

It is not uncommon for a 3rd party to use your card details to set up their own Apple Pay account, which maybe also linked to a taxi app.

All you can do if they do not refund, is complain and go to FOS. Although often a complaint may mean they look a bit further into the issue.

FredaGrey

Thank you for your affirmative response. After a day of being disbelieved and fobbed off by the bank this is helpful. The bank insist I made the payments though declined to share what evidence they had for that assertion when challenged. Whenever I have made an Apple Pay payment I have received an immediate receipt via the Wallet app but none of these transactions have shown. 

eskbanker

FredaGrey said:

I logged with Santander who closed down the card and removed from my iPhone. But they insist it was me that made the payments and will not refund nor take responsibility for not spotting what was blatantly irregular activity when I have been with them for decades.

Santander are responsible for reimbursing you promptly unless they have reason to believe that you made the transactions, but the onus is on them to prove that you did authorise them, rather than you having to prove you didn't.

https://www.fca.org.uk/consumers/unauthorised-payments-account

It can only refuse a refund if:

• it can prove you authorised the transaction – however, your bank can’t simply say that the use of your password, card or PIN proves you authorised a payment
• it can prove you are at fault because you acted fraudulently or because you deliberately, or with ‘gross negligence’, failed to protect the details of your card, PIN or password in a way that allowed the transaction
• [...]

However, they can't realistically be held liable for not spotting in real time what you'd consider to be unusual transactions....

BeerSavesMoney

In order to set up Apple Pay you need your name, 16 digit card number, expiry date and 3 digits from the back. After this there is usually some form of verification such as approving it through a mobile banking app, automated phone call or text message.

I’d be interested to know how they managed to bypass all this!

I might be wrong but even after this I think all transactions need to be approved from the device with Face ID or Touch ID so sounds like they set up your card on their device?

Just to say if someone has managed this and set your card up on their device I’d be pretty concerned and would raise this with the bank as a complaint.

FredaGrey

Thanks very much for this. I have asked the bank to share or explain what evidence they have to support their assertion that I carried out the transactions but they have so far declined. I very much hope the complaints procedure resolves the matter.  As said, any payments I have authorised have appeared in my Wallet and these didn't.

FredaGrey

BeerSavesMoney said:

In order to set up Apple Pay you need your name, 16 digit card number, expiry date and 3 digits from the back. After this there is usually some form of verification such as approving it through a mobile banking app, automated phone call or text message.

I’d be interested to know how they managed to bypass all this!

I might be wrong but even after this I think all transactions need to be approved from the device with Face ID or Touch ID so sounds like they set it up your card on their device?

Just to say if someone has managed this and set your card up on their device I’d be pretty concerned and would raise this with the bank as a complaint.

This is why I am extremely concerned and baffled. There have been well-documented breaches of iPhone/Visa payments published late last year, and I am therefore wondering whether Mastercard is similarly insecure. All my transactions require Touch ID, nor have I had any requests to approve set-up on new devices. 

born_again

who is the merchant?

Santander will have access to Apple pay details which give phone details. I know as we have had a few cases where a young member of the family had set up using parents details. But got caught by the details on the Apple system.