appConfigEntityId

bodyType

customContents

entityId

entityUuid

isVideo

articlePageQuery

article

articleSchemaContent

content

hooksArticlePageAdvertisementConfigArticle

hooksArticlePageFloatingButtonConfigArticle

appConfig

filter

json

liveArticle

Leopold Chen

More than 700 Hongkongers were shocked to discover that their credit cards had been used to place unauthorised orders for Apple’s new iPhone 18 Pro series handsets over the weekend.
Although banks reassured victims they would not be charged as long as the cards were used with due care and the transactions were proven to be unauthorised, the incident still caused widespread concern over credit card security.
The South China Morning Post asked information technology experts for practical tips on how to safeguard credit cards.
1. What happened?
Over the weekend, many social media users in Hong Kong reported that their credit cards had been compromised to place orders for Apple’s iPhone 18 Pro series, which opened for pre-order on Saturday evening.
Police confirmed receiving over 700 reports involving HK$14.7 million (US$1.87 million) in unauthorised transactions.
Experts and the Hong Kong Monetary Authority (HKMA) suggested that multiple-factor authentication might have been disabled by Apple to facilitate a smoother customer experience amid a surge in orders, creating a loophole for scammers to exploit.
Major Hong Kong banks said victims would not be held liable, provided the transactions were proven unauthorised and cardholders acted with due care.
Meanwhile, Apple said it was reviewing all its current orders to identify and cancel suspicious transactions.


2. What is 3D Secure?
3D Secure (3DS) serves as an extra security layer for online payments that helps authenticate the buyer’s identity.
It is used by major credit card organisations, including Visa, Mastercard, American Express and UnionPay.
With the latest version of 3DS, card issuers can determine transaction risks using information provided by the merchant, browser fingerprinting, and the user’s transaction history.
While most legitimate transactions are completed seamlessly without requiring customer action, higher-risk purchases may prompt buyers to enter a one-time password (OTP) or approve the transaction via their mobile banking app.
However, some merchants opt to disable 3DS through their payment gateways to streamline the checkout process.
According to the HKMA, when merchants bypass 3DS authentication, they must bear full financial liability for any losses resulting from unauthorised transactions.
3. How was the credit card information exposed?
Experts who spoke to SCMP believe the stolen credit card information had been leaked previously and held by fraudsters over time.
The data was likely compromised during purchases on retail websites that were not obliged to submit regular audit reports to authorities, and therefore might not constantly review their security features, they added.
“It is common for these retailers – or their processing platforms – to skip encryption when backing up the data. That is exactly how data leaks happen,” said Anthony Lai Cheuk-tung, director of cybersecurity firm VX Research.
Even if the data was encrypted during transmission, that protection might still be dropped when it reaches the database or is shared with contractors for maintenance, leading to risks of breaches, he added.
Francis Fong Po-kiu, honorary president of the Hong Kong Information Technology Federation, suspected some victims might have also used proxy purchasing services on concert ticket platforms, where users hand over full payment credentials to automated tools or agents to secure high-demand tickets.
“The problem is that you’re giving them every piece of your information. It’s not just your credit card details – you’re handing over your phone number, home address, passwords, everything. Handing over all that data during the process is extremely risky,” he said.
He warned that once details were leaked, credit card fraud could happen to anyone at any time.

4. What should I do if I spot an unauthorised transaction?
According to experts, the immediate first step is to suspend the compromised credit card through the issuing bank and file a police report concurrently.
Under a 2023 HKMA circular, all banks in Hong Kong are required to allow cardholders to instantly block cards via mobile banking apps. Alternatively, users can call customer service hotlines or visit a local branch.
It is also important to screenshot the unauthorised transaction, along with any supporting evidence showing it was physically or logically impossible for you to make the purchase.
For example, if someone uses your card to order a product in the United States, a screenshot showing a local Hong Kong transaction made just hours earlier can help prove your case, Fong said.
He added that most unauthorised charges could be successfully charged back if reported to banks and police promptly.
5. How can I protect my credit cards?
Both experts agree that consumers should refrain from using credit cards directly on retail websites, or storing their payment credentials on these platforms.
Instead, buyers should use digital wallets such as Alipay, PayMe, or PayPal when making online purchases.
Alipay is a payment tool by Alibaba Group, the owner of SCMP.
Payment tools that directly link to credit cards, such as Apple Pay and Google Pay, were also safer than using the cards directly, as the websites would not have direct access to card information, Fong said.


Hong Kong’s 5-year plan, policy continuity offer investors more stability, experts say

Hong Kong sets 5-year plan to double innovation spending, boost new industries

Hong Kong to offer ‘attractive’ merger deals for schools beyond those struggling

Hong Kong leader pledges building maintenance reforms after fatal Tai Po fire

Hong Kong society

Hong Kong’s iPhone scam: how to protect your credit card from online fraud

After a wave of unauthorised iPhone pre-orders hit Hong Kong buyers, major banks said victims would not be held liable, provided the transactions were proven to be unauthorised. Photo: Getty Images

Shoppers at the Apple Store in IFC Mall, Central. More than 700 Hongkongers have reported unauthorised credit card transactions for the new iPhone 18 Pro series. Photo: Sam Tsang

Number of suspicious credit card transactions involving iPhones surges to 1,209

Hong Kong police received more than 700 reports of unauthorised credit card transactions worth HK$14.7 million linked to pre-orders for Apple’s latest phone models. Photo: Sam Tsang

Lawmaker Johnny Ng said Apple should be accountable for losses caused by any platform glitches. Photo: Edmond So

Over 700 cardholders report unauthorised iPhone pre-order charges worth HK$14.7m

The pre-order rush for the new iPhone 18 Pro Max has led to some Hongkongers’ credit cards being used to make unauthorised purchases. Photo: EPA

The HSBC building in Central. The bank has launched an investigation into unauthorised credit card transactions linked to the coming launch of the new iPhone 18 on September 18. Photo: Karma Lo

News

Hong Kong

Law and Crime

In the wake of Hong Kong’s iPhone credit card scam, experts break down data security risks, 3DSecure and practical online shopping safeguards


In the wake of Hong Kong’s iPhone credit card scam, experts break down data security risks, 3DSecure and practical online shopping safeguards.


Hong Kong’s iPhone scam: how to protect your credit card from online fraud

.css-1c6uqr6{color:inherit;font-weight:inherit;font-size:inherit;font-family:inherit;line-height:inherit;overflow-wrap:break-word;}In the wake of Hong Kong’s iPhone credit card scam, experts break down data security risks, 3DSecure and practical online shopping safeguards

1. What happened?

In the wake of Hong Kong’s iPhone credit card scam, experts break down data security risks, 3DSecure and practical online shopping safeguards