Cab App receipts

Lions_89

I recently returned for an overseas trip, about two weeks ago. While there I used a cab app to book a few cabs, all fine.

Today I woke up to find receipts for further cabs, obviously I am in the UK so it was not me booking these cabs. I phoned HSBC to cancel the card. It has been cancelled. But I do not understand how this occured as these cabs were paid for with Apple Pay, not a bank card. Apple forums keep saying it's not possible but I have it in front of me. I only have my phone and laptop and they are with me. Everytime you pay it asks you to confirm with Face ID, I did not do this. It even has the pick up and drop off addresses in the receipt and the name of the taxi driver, and car type. I have taken off my cards from Apple Pay. Has this happened to anyone else or can someone explain how it occured?

AmityNeon

What taxi service was used? You mention addresses, taxi driver name and car type on the receipt; what type of receipt is it and where did it come from? Do those receipts list the payment method and last four digits of the card used?

TadleyBaggie

AmityNeon said:

Do those receipts list the payment method and last four digits of the card used?

If Apple Pay is used, the card number presented to the merchant is not related to the actual card number, Apple generate a new card number per transaction. 

Neil49

What response have you had from Apple Pay? 

AmityNeon

TadleyBaggie said:

AmityNeon said:

Do those receipts list the payment method and last four digits of the card used?

If Apple Pay is used, the card number presented to the merchant is not related to the actual card number, Apple generate a new card number per transaction.

Device Account Numbers (DAN) are unique and generated per card registration on each device. While the DAN remains static, a dynamic security code is generated for each transaction. This dynamic code, along with the DAN, is used to verify the payment information. Banks and payment networks check the dynamic security code to ensure its uniqueness and association with the specific device linked to the provided DAN, ultimately approving the transaction when the verification is successful.

I would be surprised if the last four digits on the receipts (if they are shown) match the DAN of the card that was registered in Apple Wallet, because the DAN is useless by itself. Insufficient detail has been supplied for anyone to determine whether Apple Pay has somehow been compromised, hence the questioning regarding the taxi service and the receipts. Either the security of Apple Pay has been compromised in an exceptionally advanced attack of unprecedented technical sophistication, or there is another explanation.

Lions_89

AmityNeon said:

What taxi service was used? You mention addresses, taxi driver name and car type on the receipt; what type of receipt is it and where did it come from? Do those receipts list the payment method and last four digits of the card used?

It just says “Apple Pay”, it was an email receipt, but I confirmed it in the app. I can see the trips and transaction ID within the app. 

The app was signed into via “sign in with apple” I at no time entered my card details into the app, only selected Apple Pay. The app is called “Hala”. There is no card number shown. Obviously I have changed the password on my Apple account, but even if they had the password it still would
not have been possible as far as I know to use Apple Pay without some kind of verification. In addition I received no alerts my account was being logged into as I always do when I log in. 

Lions_89

Neil49 said:

What response have you had from Apple Pay? 

Apple say it’s nothing to do with them and to go to the bank.

PennyPincher67

That sounds like a pretty bizarre situation! It's good that you've already taken steps to cancel your card. Regarding the Apple Pay mystery, it might be worth reaching out to Apple Support directly. They may shed some light on any unusual activities or provide insights into how this could happen.

AmityNeon

Apple won’t be able to help unless it relates to your Apple ID/account. It is highly unlikely the security underlying Apple Pay has been compromised. I think the biggest vulnerability in recent memory was Visa cards with Express Travel enabled.

You asked HSBC to cancel the card. Have you asked them how the fraudulent transactions were authorised? They ultimately approved the payments and should have detailed logs and transaction data far beyond just ‘Apple Pay’.

There’s also the cab service. Have you asked them for further details regarding these fraudulent bookings? Do they pre-authorise for recurring or deferred charges? If it was just your card that was somehow compromised, you would not also be receiving detailed transaction receipts from Hala by email, and your Hala account would not have a history of these trips made by someone else.

penners324

Sounds like your Hala app has been hacked. 

Lions_89

HSBC were useless beyond cancelling the card. I don’t think the person on the phone knew what Apple Pay was as he kept asking where the card was.

i have messaged the cab app, they claim there has been no breech. Yet I can actually see another cab has been scheduled for later today. So I think the problem is the cab app and they are either hacked or up to something else. I’m curious to see what happens when the next cab is taken as the card is blocked no Payment should be processed. It states in the app they hold funds until trips are completed but I can’t see any monies have been held, but it might take a day or two to show up. And could they have held funds for two weeks!