Scam victim

Moseleygirl

I, very stupidly, feel victim to a scam text and gave my credit card details. I sorted it out and cancelled my card before any money was spent luckily but was told an Apple Pay had been set up on my card. 

I've just seen a text message sent last night with a pass code to activate Apple Pay on my card and then a text confirming activation. I didn't do it so does this mean the scammers have access to my text messages or even my phone?

Nasqueron

If they got the passcode from the text only, then potentially, though equally could be they tried that and switched to an email registration. Make sure the card is blocked / frozen if your app allows that as firms can get the new card details automatically. Go back to your bank and advise of this further development

Moseleygirl

I'm not sure what you mean by my app. I clicked a link in a text message & filled in a form online, which I soon after realised was a scam. I phoned my credit card first thing this morning & they've cancelled my card & will send a new one. What's worrying me is that there's a text message on my phone with a passcode to activate Apple Pay, followed immediately by a text message confirming activation. I can't see how the scammer could get the passcode without going through my phone but how can they do that?  Can they have remotely installed a link to my phone?  Do I need to contact my phone provider?

Both text messages seem to come from my bank, which is why I'm wondering how a scammer could have got the activation code sent to my phone. Should I be worried?

Nasqueron

Moseleygirl said:

I'm not sure what you mean by my app. I clicked a link in a text message & filled in a form online, which I soon after realised was a scam. I phoned my credit card first thing this morning & they've cancelled my card & will send a new one. What's worrying me is that there's a text message on my phone with a passcode to activate Apple Pay, followed immediately by a text message confirming activation. I can't see how the scammer could get the passcode without going through my phone but how can they do that?  Can they have remotely installed a link to my phone?  Do I need to contact my phone provider?

Both text messages seem to come from my bank, which is why I'm wondering how a scammer could have got the activation code sent to my phone. Should I be worried?

The app on your phone for your bank provider - most allow you to freeze the card like if it's lost to stop spending. 

The phone was sent a message, the scammer has obviously got access to this or changed the method and did email verification instead and the messages were delayed so appeared to come together. It's not impossible if you click on a link to install software but you'd normally have to agree to this e.g. face ID in Apple store

born_again

Moseleygirl said:

I'm not sure what you mean by my app. I clicked a link in a text message & filled in a form online, which I soon after realised was a scam. I phoned my credit card first thing this morning & they've cancelled my card & will send a new one. What's worrying me is that there's a text message on my phone with a passcode to activate Apple Pay, followed immediately by a text message confirming activation. I can't see how the scammer could get the passcode without going through my phone but how can they do that?  Can they have remotely installed a link to my phone?  Do I need to contact my phone provider?

Both text messages seem to come from my bank, which is why I'm wondering how a scammer could have got the activation code sent to my phone. Should I be worried?

They have used your card details to try & set up apply pay. 
Just check with you bank to make sure Apple pay is not set up at their end.

Moseleygirl

My bank said Apple Pay has been set up but the bank cancelled it and my card. 

Re Nasqueron's message- my email wasn't involved. Note did I do anything on a bank app. I clicked on a link in a text message and poor info on online in a browser. That's why I'm concerned how they got access to a verification code sent by text to my phone. Tho it had my bank name on the text, it didn't come from my bank. I just want to know if there's any way a scammer can access texts in my phone to get a verification code, which appears to have been used to activate Apple Pay 

maxximus75

For extra safety, make sure you change all of your passwords (not all to the same one), banking, email, iCloud, etc

sausage_time

With Apple accounts can you see what devices you are logged into?  I know Google supports this, and you can log out of any you don't recognise for example.  And of course as suggested above change all passwords, and turn on two factor authentication on all accounts that support it.

Moseleygirl

I don't have an apple account. I use Android on a Samsung phone. I'm very grateful for everyone's help. I did spend quite a long time in a call with Samsung technical support but he could not answer the question and how he scammer could have seen the Apple Pay verification code that was sent in a text to my phone. They must have seen it as in less than 1 minute after the code was sent, smiths text was sent confirming verification was successful. 

The only thing I can add is that the texts seemed to come from my bank but there was no phone number attached when we checked the details. Samsung help thought this might mean the texts were from the scammer rather than my bank. Seems a bit odd that they would send those kind of texts. 

Does anyone have enough experience with scammers to know whether or not the original text with the link that I clicked on could have somehow given them access to be able to read the text message with the verification code? 

sausage_time

Sorry, I assumed because the issue involved Apple Pay you were an iPhone user.  I can't think what else to suggest here - I don't know Apple Pay and how they verify cards being added.

Moseleygirl

Thanks. The verification code should have come from my bank, not Apple (who aren't involved in this).  I just want to know how the scammer could have got that code, which was sent to my phone