Police urge Apple to fix security after 110 reports of fraud over iPhone Duo

When iPhone Duo pre-orders opened online in Hong Kong at 8pm on Friday, customers began reporting unauthorised credit card purchases. Police treated the reports as suspected cases of obtaining property by deception. The incident matters because it repeated a similar fraud problem linked to an earlier iPhone launch.

The largest reported transaction was HK$229,788, equal to about 12 iPhone Duos. More than 110 reports involved cards issued by different banks. Police said the transactions totalled HK$4.6 million. Apple said it was reviewing all current orders before processing them and would identify and cancel fraudulent transactions.

Police said Apple had introduced some fraud controls but had not activated 3D Secure. The Hong Kong Monetary Authority said four banks had notified it of related unauthorised transactions. Customers were urged to contact their bank, Apple and police promptly. No arrests had been made, and investigations continued.

The reported fraud involved more than 110 suspicious credit card transactions after iPhone Duo pre-orders opened in Hong Kong. Together, those transactions were worth HK$4.6 million. The figures show that the problem was not limited to one customer or one bank, since the cards came from different banks.

The most striking example was a charge of HK$229,788. Police said that amount equalled the price of about 12 iPhone Duos. The transactions were being listed as suspected cases of obtaining property by deception. Four banks notified the Hong Kong Monetary Authority about related unauthorised transactions.

The incident followed an earlier iPhone 18 Pro series fraud investigation. Police were still examining 1,572 suspicious transactions from that launch, worth more than HK$31 million. No arrests had been made. Apple said it was reviewing current orders and would cancel those identified as fraudulent.

3D Secure, or 3DS, is an additional authentication arrangement for online credit card payments. Its purpose is to help verify that the person making a purchase is the legitimate cardholder. That matters because stolen card numbers and other details may otherwise be used to place orders.

The article does not describe every 3DS step. In practice, the card issuer or payment system may ask the customer to confirm the purchase through an additional check, such as an in-app approval. The bank or authentication service then tells the merchant whether the transaction passed that check.

Police said 3DS could have helped prevent the Hong Kong fraud reports, while HSBC said it could add protection. However, the merchant decides whether to apply it. Apple did not activate 3DS for the iPhone Duo pre-order, despite repeated police calls. The authority urged wider use after the earlier incident.

Police wanted Apple to activate 3D Secure because unauthorised transactions had already appeared during an earlier iPhone launch. After the iPhone Duo pre-order opened, more than 110 new reports involved HK$4.6 million. The repeated pattern raised concerns that existing controls were not enough.

3DS adds an identity check during an online card payment. That check can make it harder for someone with stolen card details to complete a purchase. Senior Inspector Lo Chun-kong said Apple had improved its fraud risk model and transaction monitoring, but had still declined to activate 3DS after multiple police requests.

Police said Apple’s decision left the door open for criminals and criticised the company for not proactively assuming corporate responsibility. The Hong Kong Monetary Authority also urged Apple to use 3DS more widely. Apple said it was reviewing orders and would quickly identify and cancel fraudulent transactions. No arrests had been made.

Unauthorised charges can create immediate problems for customers, including repeated transactions and uncertainty about whether they owe the money. Banks must investigate reports, identify fraudulent or duplicate payments, void them, and guide customers through refunds. HSBC said affected customers would not be responsible for repeated transactions.

The article gives a concrete example from Friday night: some HSBC transactions were duplicated. The bank said its system would automatically arrange cancellation, expected to take one to two days. Customers could also suspend their cards through the mobile app or by calling the bank. Apple said it was reviewing every current iPhone Duo order before processing it.

The Hong Kong Monetary Authority said that when a merchant does not use or temporarily suspends extra authentication, the merchant must bear liability and financial loss for unauthorised transactions. Apple therefore faces cancellation work and potential losses. Banks and customers must also report, verify and resolve the cases.

3D Secure is not the only protection mentioned in the article. Apple had already reviewed and modified its internal fraud risk model and strengthened transaction monitoring. These measures can help flag unusual orders for checking. The company also said it would review current orders before processing them and cancel those identified as fraudulent.

The Hong Kong Monetary Authority referred to additional arrangements such as in-app authentication. Banks can also let customers suspend cards quickly, investigate suspicious activity, void repeated charges, and guide customers through refunds. HSBC offered card suspension through its mobile app or by phone and said it would identify and cancel repeated transactions.

These controls do not remove the need for fast reporting. Police urged customers to contact their bank, Apple and police when they saw suspicious transactions. Francis Fong said launch-time network congestion and response delays could cause a website to resubmit requests. Banks generally cancel duplicates after verification, while merchants may carry losses without extra authentication.

An online card payment begins when a merchant sends a transaction request through its payment system to the cardholder’s bank. The request contains the purchase amount and card information. The bank checks whether the card can be used and whether the payment passes any extra authentication or fraud checks. It then returns an approval or refusal.

If approved, the merchant can continue processing the order, while the payment is later completed between the merchant and banks. If the same request is sent twice, two charges may appear. Francis Fong said network congestion and delayed system responses during launches can cause a merchant website to resubmit requests. Banks generally cancel duplicates after verification.

If a customer did not authorise a charge, the customer reports it to the bank. The bank investigates, may void the transaction, and guides the customer through a refund or dispute. In this case, Apple was reviewing orders, while HSBC said it would identify and cancel repeated transactions.