Apple’s launch-night checkout flow skipped a verification step that banks in Hong Kong rely on, and police there now count 130 complaints after pre-orders for the foldable iPhone Duo opened.
Buyers began posting screenshots on local social platforms over the weekend showing charge after charge for HK$34,998, a figure matching two 256GB handsets. Some cards were hit four or five times for orders the owner never placed. One customer said they stayed on hold with their bank for more than two hours without reaching anyone.
Francis Fong Po-kiu, honorary president of the Hong Kong Information Technology Federation, pinned the spike on Apple’s transaction handling. He said the company’s checkout deliberately drops 3D Secure one-time codes during high-traffic launches so the buying flow never stalls. That convenience, per Fong, leaves room for crews sitting on leaked card databases to run scripted bulk orders for resellable electronics.
The economics favor the criminals. Blocked or reversed transactions cost them nothing but a retry, so only a small share of attempted orders needs to ship for the operation to pay. Pending charges mean a card is authorized but not yet billed, since Apple only settles payment as stock leaves the warehouse.
Advice circulating among victims is blunt. Turn on instant transaction alerts in your banking app, switch off card-not-present payments if you do not need them, and call the issuer to freeze and reissue the card the moment an unfamiliar authorization appears.
Hong Kong police urged Apple to tighten safeguards around high-demand releases. The episode also reflects a wider exposure tied to stored card credentials, which the company’s own payment infrastructure keeps on file for repeat purchases.
