What are the red flags of this scam?

You receive an unexpected one-time passcode from your bank — if someone posing as your bank then asks you to read it out, it is almost certainly a digital-wallet provisioning attempt • A fake checkout page or bank login page asks you to enter a code that arrived by text 'to verify the payment' — the OTP is actually authorising your card to be added to a stranger's phone • You receive a text saying your card needs to be re-registered for Apple Pay, with a link — real banks never send these • Your bank statement shows tap-to-pay charges from locations you have never visited, or from cities you have never been to • After getting a replacement card, fraudulent charges resume — the Automatic Billing Updater can push your new card details to a wallet the fraudster already provisioned

What should I do if this happened to me?

Never share a one-time passcode with anyone, even someone claiming to be from your bank. Your bank will never phone you to ask for this code. • If you receive an unexpected OTP, do not enter it anywhere and do not read it to anyone. Call your bank immediately on the number on the back of your card. • If you realise you may have shared an OTP and authorised a wallet provisioning, call your bank at once and ask them to block any digital wallets linked to your card. • Check your statement for small contactless charges at retailers far from where you have been. Report anything suspicious to your bank. • Banks are generally required to reimburse customers for unauthorised digital wallet transactions. Report it as soon as you spot it. • Report to Report Fraud at https://www.reportfraud.police.uk or call 0300 123 2040.

HIGH banking Last reported: 21 Sept 2026 Share

Someone adds your card to their Apple Pay or Google Wallet after tricking you into sharing a one-time passcode

Q: Is this a scam?

Yes. This is a documented scam pattern. Scammers phish your card details, then trigger an Apple Pay or Google Wallet setup on their device. Your bank sends a one-time passcode (OTP) to confirm the provisioning — the scammer poses as your bank and asks you to read it out. Once you share the OTP, they activate your card on their phone and spend freely.

Scammers phish your card details, then trigger an Apple Pay or Google Wallet setup on their device. Your bank sends a one-time passcode (OTP) to confirm the provisioning — the scammer poses as your bank and asks you to read it out. Once you share the OTP, they activate your card on their phone and spend freely.

Also known as: digital wallet card fraud UK, Apple Pay provisioning scam, Google Wallet fraud UK, card OTP hijack, mobile wallet card skimming

Already happened to you? Do this in the next few minutes

1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.

What to do right now

1 Never share a one-time passcode with anyone, even someone claiming to be from your bank. Your bank will never phone you to ask for this code.
2 If you receive an unexpected OTP, do not enter it anywhere and do not read it to anyone. Call your bank immediately on the number on the back of your card.
3 If you realise you may have shared an OTP and authorised a wallet provisioning, call your bank at once and ask them to block any digital wallets linked to your card.
4 Check your statement for small contactless charges at retailers far from where you have been. Report anything suspicious to your bank.
5 Banks are generally required to reimburse customers for unauthorised digital wallet transactions. Report it as soon as you spot it.
6 Report to Report Fraud at https://www.reportfraud.police.uk or call 0300 123 2040.

Red flags

⚠ You receive an unexpected one-time passcode from your bank — if someone posing as your bank then asks you to read it out, it is almost certainly a digital-wallet provisioning attempt
⚠ A fake checkout page or bank login page asks you to enter a code that arrived by text 'to verify the payment' — the OTP is actually authorising your card to be added to a stranger's phone
⚠ You receive a text saying your card needs to be re-registered for Apple Pay, with a link — real banks never send these
⚠ Your bank statement shows tap-to-pay charges from locations you have never visited, or from cities you have never been to
⚠ After getting a replacement card, fraudulent charges resume — the Automatic Billing Updater can push your new card details to a wallet the fraudster already provisioned

Already happened to you? Do this in the next few minutes

What to do right now

Red flags

Sources