iPhone 18 Pre-Order Card Fraud:
1,209 Reports, HK$25m — Is Your Card Safe?

In Two Days, Reports Rose
from 700 to 1,209

The timeline starts on Saturday night. At 8pm on 12 September, Apple opened online pre-orders for the iPhone 18 Pro and iPhone 18 Pro Max. Shortly after the system went live, help requests began flooding social platforms and forums — most victims only realised something was wrong when their card issuer sent a transaction alert, showing an unauthorised purchase on the Apple online store.

The police figures escalated quickly. On 13 September, the electronic reporting centre received more than 700 reports involving about HK$14.7 million, the largest single case at around HK$114,000. By 5pm on 14 September, cumulative reports had reached 1,209, with total losses of about HK$25 million and the largest single case at about HK$130,000. The case is provisionally classified as obtaining property by deception, handled by the Police Cyber Security and Technology Crime Bureau, with no arrests so far.

Three details are worth remembering. First, affected cardholders held cards from HSBC, Hang Seng, Standard Chartered and other banks — not a single issuer — and some were charged more than HK$60,000. Second, a large share of the individual charges were HK$13,299, which matches the official price of the 512GB iPhone 18 Pro Max, suggesting the fraudsters targeted one high-priced model. Third, Apple’s China online store sold out its first batch within minutes, meaning a huge volume of genuine transactions was running at the same time — abnormal activity is far easier to hide inside that traffic.

The Issue Is Not a Breach —
It Is “No Verification”

After taking over, the Cyber Security and Technology Crime Bureau contacted the banks and Apple. According to preliminary internal technical checks on both sides, the systems were operating completely normally, with no sign of a hacking attack. That conclusion has practical meaning: your bank account or phone was not broken into — but once card data leaks, it can be used to transact directly.

The key finding was that the online pre-order process did not require a one-time password (OTP) or any other form of identity verification. In other words, payment could complete without the cardholder authorising it in real time, so anyone holding leaked card details could run large-scale unauthorised charges.

The Hong Kong Monetary Authority is clear on this: an individual merchant may, for operational reasons, not use or suspend additional authentication (such as in-app authentication or one-time passwords). In that situation, the merchant bears the responsibility and the financial loss for unauthorised transactions. That sentence is the heart of the case — the authentication duty sits with the merchant, not the cardholder.

As for where the card data leaked from, police are pursuing two lines: first, analysing whether affected cardholders had submitted the details on a common platform, or had previously fallen for phishing sites or SMS traps; second, tracing the identity and digital footprint of those who used the stolen data to place pre-orders. Police have requested detailed transaction records from the banks and Apple, and are in contact with the HKMA.

Five Steps to Stop the Loss
After an Unfamiliar Charge

On 13 September the Security Bureau reminded the public on social media to check credit card transactions proactively. If you find an unfamiliar charge, it advises five immediate steps:

1. 1. Lock or freeze the card in your banking app. If needed, report it lost and tell the bank clearly which transactions were unauthorised.
2. 2. Notify the merchant. Contact Apple customer service as soon as possible and ask them to stop shipment or cancel the order.
3. 3. Report to police. Bring your transaction records, SMS alerts and order details, and file online through the police e-reporting centre or at the nearest station. Keep the case number.
4. 4. Tell the bank you have reported it. Give the case number to your card issuer so it can freeze the amount and handle the disputed transaction.
5. 5. Keep every record. Bank reference numbers, staff names, call dates and times, merchant order details and the police case number — keep them all.

On timing for refunds, there are a few useful reference points. Apple Hong Kong told media that all orders received are reviewed before processing, that it is identifying and cancelling any fraudulent transactions as quickly as possible, and that fraudulent orders will not ship. HSBC, Hang Seng and Standard Chartered said they have opened investigations and will activate the chargeback mechanism as appropriate.

Because Apple intercepted the fake orders at the review stage, most charges remain in a frozen “pre-authorisation” state and have never actually settled. Under mainstream card-scheme arrangements, once the merchant cancels the charge the pre-authorised amount is normally released within a few working days and the credit limit restored in full (processing times vary between issuers). In addition, under the HKMA’s cardholder liability guidance, a cardholder who reports the card promptly and whose transaction is confirmed unauthorised does not bear the loss.

The key point: all of this protection depends on acting promptly. Freezing the card, filing the report and notifying the merchant versus waiting for it to resolve itself can produce very different outcomes.

Everyday Protection:
Six Things You Can Do Now

This will not be the last incident of its kind. Until the source of the leak is identified, daily habits are the only defence within your own control:

• 1. Turn on credit card transaction alerts or SMS notifications. Do not disable them because they feel annoying — in this case most victims found out through an alert.
• 2. Review statements and unsettled transactions regularly, and do not ignore zero-value unauthorised entries. Those can be a test run before larger charges.
• 3. Police advise never submitting card details on unfamiliar websites, and checking a site’s authenticity before buying.
• 4. For online payments, prefer merchants or e-wallets that use additional authentication — take the extra confirmation step when it is offered.
• 5. Avoid storing the same card on multiple shopping platforms, which narrows the impact of any single platform breach.
• 6. If you hold a high-limit card, ask your bank about online transaction limits or virtual card numbers to add another gate for online purchases.

If You End Up Paying:
What HK$13,299 on Minimum Payments Costs

This section is not meant to alarm anyone, but to point out a reality: if a disputed transaction ends up not being refunded in full, or while waiting for the refund the cardholder turns to revolving credit to settle the bill, the cost can be substantial. Using the most common amount in this case, HK$13,299, and an APR in the market range of 30% to 40% — around 35% for most card accounts — the outcome of paying only the minimum looks like this.

The minimum payment is structured as roughly 1% of the outstanding balance (minimum HK$50) plus that month’s interest and fees. On HK$13,299 at 35%, the first month’s interest is about HK$388 and the minimum payment about HK$521 — which reduces the principal by only about HK$133. Over the first 12 months you would repay about HK$5,918, of which about HK$4,407 is interest, leaving the balance above HK$11,700 after a full year of payments.

The comparison makes one thing clear: whether a disputed transaction is refunded is a procedural matter between the bank and the merchant; once revolving credit is used to cover it, the cost lands entirely on the cardholder. Rather than calculating interest afterwards, make sure you have enough of a buffer first. To see what your own repayment plan would cost in interest, use FinKit’s credit card minimum payment calculator; to review your overall income, spending and financial health at the same time, the personal finance analysis tool shows it all in one place.

Three Takeaways

1. System security is not the same as transaction security. Both the banks’ and Apple’s systems worked normally here; the problem was a payment flow that did not require cardholder confirmation. The practical lesson: do not assume encryption alone makes a payment safe — the question is whether each transaction was authorised by you.

2. Checking proactively is the cheapest step. Most victims here learned about the problem from an alert. Keeping transaction notifications on and reviewing unsettled items regularly costs far less than any post-incident remedy.

3. After an incident, speed is money. The sooner the card is frozen, the merchant notified and the report filed, the smoother the freeze and refund process — delay only makes the procedure more complicated.

Further reading: Clear Card Debt or Invest First? The Min Pay Trap, How Much Emergency Cash? 3 or 6 Months, Explained