Cab App receipts

Lions_89

Another cab has been been completed and paid for according to the cab company. Again by Apple Pay. I received another email receipt and I can see the journey in the app.

flaneurs_lobster

Just to be clear, have deductions been made from your bank account that you have not authorised? Are you seeing these transactions in Apple Pay (I don't use Apple, is this an available feature?). 

eDicky

I'd guess that the breach does lie with the cab company and their app, perhaps yours has been cloned somehow, because if anyone was able to hack the Apple Pay system they would hardly use it just for a few cab rides...

km1500

yes to me it sounds like the cap app is the culprit

born_again

Can you remove payment details from App?


That would be a good place to start. Or remove link to bank in Apple Pay.

[Deleted User]

The Google equivalent generates a virtual payment card number and it remains the same until changed by the issuer or you manually remove it. However, a unique token is generated per transaction.

If Apple does something similar, it sounds like they've retained and reused that virtual payment card number.

Lions_89

flaneurs_lobster said:

Just to be clear, have deductions been made from your bank account that you have not authorised? Are you seeing these transactions in Apple Pay (I don't use Apple, is this an available feature?). 

I don’t know yet as it takes a few days to show up on the bank. I don’t have the card in Apple Pay anymore. 

Lions_89

born_again said:

Can you remove payment details from App?


That would be a good place to start. Or remove link to bank in Apple Pay.

No, the details were never added to app in the first place. You just select Apple Pay when you book the cab and press pay. 

AmityNeon

Lions_89 said:

flaneurs_lobster said:

Just to be clear, have deductions been made from your bank account that you have not authorised? Are you seeing these transactions in Apple Pay (I don't use Apple, is this an available feature?).

I don’t know yet as it takes a few days to show up on the bank. I don’t have the card in Apple Pay anymore.

Did you see them listed under Latest Transactions before you removed the card? Pending transactions show up immediately. HSBC also list pending card transactions (with descriptions) and reduce your visible/available balance immediately, both online and in the app. It's been 48 hours now, and still nothing?

If the only evidence of a fraudulent Apple Pay transaction is from Hala who won't even acknowledge there is a problem despite evidence of (presumably unauthorised) booking activity on your Hala account, then this has nothing to do with Apple Pay or HSBC. Everything points to this cab service.

What have you actually told Hala? They should have a trove of internal logs considering the detailed receipts you shouldn't have even been receiving. Did they claim all bookings, those from over the past two or so days as well as two weeks ago, were made through your Hala account (via Sign in with Apple) on your device? It certainly doesn't seem like you're the one paying, regardless.

Lions_89

The mystery has been solved. On arrival at the country I was given a tourist SIM card. I registered the cab app with this SIM card mobile number. When I left the country this number was given to another tourist who also registered on the app. The SIM card is linked to your passport number. So gets switched off when you leave. 

All transactions I have seen were a mirror of the other person and their cabs, but no money was taken from my account. The cab company confirmed this and stated the account runs by the mobile number not my email address. A shocking set up but at least I have not lost any money, it has caused a lot of hassle. They advised me to change the email to a disposable email and then log out and delete the app. Apparently an email address is not required to register I just put on in. Most register just the mobile Number, and multiple accounts can be on the same number. Obviously GDPR doesn’t exist there. Their system was emailing me receipts for that mobile number but not my account. What a nightmare. I have never heard anything like it.