How Phished Data Turns into Apple & Google Wallets
Summary: Security researcher Ford Merrill of SecAlliance described at the M3AAWG conference in Lisbon how China-based phishing groups use iMessage and RCS messages spoofing the U.S. Postal Service and toll operators to capture card data and one-time passcodes, then load stolen cards into Apple and Google wallets on phones they control. Merrill said the groups sell these loaded phones in bulk, offer an Android app called ZNFC that relays NFC tap-to-pay transactions from anywhere in the world for $500 a month, and that researchers observed nearly 33,000 unique domains tied to the groups in one year, which he estimated at about $15 billion in fraudulent charges.
Bottom line: Merrill's estimate of roughly $15 billion in yearly fraudulent charges rests on one-time SMS codes still being the default check for linking a card to a mobile wallet, and he said the groups now wait only seven to ten days before hitting the wallets hard.
Read the original at Krebs on Security ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026