Sankei Newspaper is reporting the first ever scam involving Apple Pay used to illicitly purchase 981 cartons of cigarettes worth almost 4.5 million JPY, approximately 40,000 USD.
According to Saitama Prefecture police, a group of three Chinese nationals purchased the cigarette cartons using two iPhones over a 10 hour period at a convenience store in Kawaguchi City, Saitama, totaling over 700 transactions between March 26 and 27. The single transaction limit was 20,000 JPY. Massive purchases by visiting Chinese tourists, known as ‘baku-gai’ (explosive buying), has been common and doesn’t raise concerns, though the trend is declining rapidly.
One member of the group was arrested and charged with fraud. Investigators believe the group used stolen credit card credentials and convinced the credit card company to send Apple Pay verification codes to different email addresses claiming the iPhone device owner had changed.
Security experts quoted in the article say that Japanese credit card companies need to be much more stringent authenticating card owners to avoid similar scams in the future.
As with most Japanese police reports details are pretty spare as the investigation is ongoing. It’s not clear from the article how the credit card information was obtained: a case of identity theft or some other means. Fault is clearly with the unnamed credit card company. There is not much Apple can do if credit card companies issue Apple Pay authorization codes without confirming identity.
Update 6/12: The Japan Times ran the story on June 3 from Kyodo New service. The English version is exactly the same as the Sankei Japanese one. It is interesting that the police knew the credit card data had been stolen but the credit card company apparently did not.