Card Fraud on iPhone 18 Pre-orders — What Now? Six Chargeback Steps + 3 Steps to Protect Yourself | Visa, Mastercard and AE Compared
YouTube title (Cantonese): iPhone 18預購被盜刷點處理｜3步自保＋匯豐恒生渣打退單，VISA MASTER AE常識攻略
Disclaimer | Personal experience, not professional advice
This is the host's personal experience, shared for general reference only. It is not investment, legal or financial advice. Procedures, liabilities and terms of banks, card issuers and merchants are always subject to the latest official announcements of the institutions concerned; contact your card issuer or a professional if needed.
- Treat any unfamiliar authorisation text as real: lock the card in your bank app immediately, then request an unauthorised-transaction investigation and report it to the police.
- This wasn't a bank system hack — it was old stolen card data plus merchants exempting extra authentication (3DS); when the merchant exempts it, the loss is more likely to land on the merchant.
- Credit cards don't settle instantly, so there's time for a chargeback; don't use high-limit cards on unknown websites.
What happened: cards hit on pre-order night, no OTP needed
The moment iPhone 18 pre-orders opened, loads of people got card-not-present payment texts showing Apple as the merchant, with amounts matching the official phone prices — some saw several charges in one night, a few approaching six figures. The common pattern: they hadn't successfully ordered or even tried, the card was long since added to Apple Pay, but the transactions were card-number, card-not-present transactions — no OTP, no app confirmation, no Face ID. Big V's reminder: if you've just received an Apple purchase text, lock the card in your bank app first, then come back and listen.
Why it went through without verification
The fraudsters already had the card number, expiry date and CVV, most likely from phishing pages, leaked databases or black-market data. At peak pre-order times merchants use dynamic risk assessment, and some transactions are exempted from SMS / OTP; all three banks said the same thing about 3DS — whether it's enabled is up to the merchant. Adding a card to a phone wallet requires verification, but a card-not-present transaction on the website using the card number can skip iPhone confirmation; many bank texts arrive only after the authorisation.
The six chargeback steps
One, lock the card first to stop new authorisations (freezing doesn't automatically cancel the transaction). Two, register the unauthorised transaction immediately, noting the time, amount, the text message wording and merchant name. Three, you must report it to the police — the report number matters. Four, the bank opens a case and raises a chargeback with the card scheme and the acquiring bank. Five, the merchant response period. Six, once confirmed as unauthorised, you don't pay. Three common misconceptions: a chargeback isn't credited the same day — it takes weeks; locking the card doesn't mean an automatic refund; and the merchant not shipping only settles the goods side — the money side still has to go through the bank's chargeback.
3 steps to protect yourself, and card habits
Treat any authorisation notice as real and freeze immediately; in one go, lock the card, request an investigation and report to the police, and screenshot every text and app record; afterwards, lower your online transaction limit and never enter your full card number on unofficial links. Big V's own habit: keep one low-limit card per bank just for online spending — don't take a high-limit card online for a few percent of rebates.
AE and PayPal vs Visa / Mastercard
AE and PayPal go all-in on protecting the customer and chase hard; Visa / Mastercard are relatively slower, and if the bank can't sort it out you can go to the card scheme directly. Compared with bank transfers and FPS, which settle instantly — once the money reaches the criminal it's hard to trace — the advantage of credit cards is the settlement time lag (T+1 or longer). The above is general knowledge shared in the video; actual procedures and liabilities are subject to each card issuer's latest announcements.