Apple Pay: Bridging Online and Big Box Fraud
Summary: Krebs on Security reports that Apple Pay lets thieves use stolen online card data, known as CVVs, to buy high-priced goods in physical stores, because most banks enabling Apple Pay do little to confirm the customer holds the physical card. CVVs sell for about $1-$5 each and hijacked iTunes accounts for about $8, while dumps used for in-store fraud cost $10-$30, and Gartner analyst Avivah Litan and Droplabs' Cherian Abraham both fault banks for weak identity proofing and Apple for limited transparency.
What you should know: Banks absorb the fraud costs, and much of the Apple Pay sign-up fraud cited was tied to purchases of high-dollar Apple products at Apple's own retail stores - so the losses land on issuers while the card-not-present exposure widens as Samsung/LoopPay and MCX/CurrentC prepare to launch.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026