Hong Kong’s police force has gone public with an unusual accusation: that Apple left a fraud check switched off during a launch.
More than 110 reports of unauthorised card charges followed Friday evening’s pre-order opening for the foldable iPhone Duo, totalling about HK$4.6M. The largest single case reached HK$229,788, roughly a dozen handsets at list price.
A demand Apple has refused twice
Investigators say they have pressed Apple since September to turn on 3D Secure, the bank-side layer that challenges a buyer mid-transaction to prove they hold the card. Apple reviewed its risk model and tightened transaction monitoring after the first wave, but declined to enable the authentication step.
The same pattern hit the iPhone 18 Pro launch a month earlier: 1,572 suspicious transactions worth over HK$31M, still under investigation, with no arrests. Senior Inspector Lo Chun-kong said the omission left the door open for criminals.
Where liability lands
The Hong Kong Monetary Authority confirmed four banks had reported fraudulent charges and said merchants that skip extra authentication carry the loss themselves. HSBC said it would identify and void repeated charges and pointed customers to card-suspension tools.
Apple’s response avoided the authentication argument. The company said all current Duo orders are being reviewed before processing and that it is working to cancel fraudulent transactions quickly, a filter applied after the fact rather than a barrier in front of it.
What cardholders should do
Nothing here involves a compromised iPhone or a flaw in iOS. The exposure sits in the checkout flow, where a stolen card number redeems itself against a high-value, resellable product. Cardholders seeing unexpected charges should contact the bank first, then Apple and police, and watch for duplicate authorisations after any launch-day order.
