Digital wallet fraud rarely breaks the encryption that protects Apple Pay or Google Pay. Criminals attack the steps around it instead. They phish a card number and the one-time passcode a bank sends to verify it, load that card into a wallet on a phone they control, and then spend with what looks like a fully authenticated, tokenized payment.
Stored-value accounts face a related problem, since a hijacked login gives direct access to a cash balance. Securing these payment methods means tightening wallet enrollment, watching account behavior closely, and treating a wallet payment as a strong signal rather than proof that the real cardholder is present.
Why Digital Wallets Are Now a Primary Fraud Target
Wallets are where a growing share of the money moves. Worldpay’s 2026 Global Payments Report, published March 31, 2026, found that digital wallets accounted for 56% of global eCommerce transaction value and 33% of in-store value in 2025. In the U.S., wallets carried 40% of online spending. Fraud follows volume, and that growth has made mobile wallet fraud a priority for issuers and merchants alike.
Consumer fraud overall keeps climbing. In testimony to the Joint Economic Committee on March 25, 2026, the FTC reported that consumers filed 3 million fraud reports in 2025 and reported $15.9 billion in losses, up from just over $12 billion in 2024. Text messages were the most commonly reported contact method. That matters here because text-based phishing is the main way criminals collect the card details and passcodes needed to enroll stolen cards in a wallet.
The Regulatory Picture for Wallet Providers
Federal oversight of large wallet providers remains limited in the U.S. The CFPB finalized a rule in November 2024 that would have placed nonbank payment apps handling at least 50 million transactions a year, including wallets such as Apple Pay and Google Pay, under its supervision.
Congress nullified that rule under the Congressional Review Act, and the President signed the resolution in May 2025. That leaves card network rules, issuer policies, existing consumer protection laws such as the Electronic Fund Transfer Act, and each company’s own risk program as the main guardrails.
How Digital Wallet Fraud Works
Most digital wallet fraud follows the same sequence: steal card data, get past the issuer’s enrollment check, then cash out before the victim or the bank notices.
Provisioning Fraud: Phished Cards Loaded Into Wallets
Security journalist Brian Krebs reported in February 2025 on how China-based phishing groups turn phished card data into Apple and Google wallets. Victims receive texts about unpaid tolls or missed deliveries, enter their card details on a fake payment page, and are then told their bank will send a one-time code to verify the charge. That code is actually the bank’s verification for adding the card to a new wallet.
Once the victim types it in, the card is loaded onto a phone the criminals control. Krebs also described criminal sellers offering phones preloaded with several stolen wallets each.
Why the one-time passcode is the weak point
An SMS code confirms that someone has the code, not that the cardholder intends to add a wallet. When the message does not clearly say it is for wallet enrollment, victims have no reason to suspect it. Issuers can close much of this gap with in-app approval for new enrollments and code messages that name the wallet and device being added. Merchants and their customers also benefit from learning how to spot a phishing scam before anyone hands over a code.
NFC Relay and Ghost Tap Cash-Outs
In November 2024, mobile security firm ThreatFabric described a cash-out method it named Ghost Tap. Criminals holding a stolen card enrolled in Apple Pay or Google Pay relay the tap-to-pay signal through a server to money mules, who make in-store purchases far from the criminal’s location. Each purchase is small and appears to come from the same enrolled device. Therefore, the activity can stay under fraud thresholds while the total climbs. ThreatFabric pointed to resellable goods such as gift cards as a likely target.
Account Takeover of Stored-Value Accounts
Stored-value fraud usually starts with a stolen login (also known as account takeover). Criminals use phished credentials, passwords reused from other breaches, or SIM swaps that redirect text-message codes to their own phone.
Once inside, they can drain the balance, add their own funding source, or spend the balance at merchants that accept that wallet. Gift card and loyalty balances are exposed in a similar way when the only protection is a card number and PIN.
Digital Wallet Scams That Reach Merchants
Some digital wallet scams target shoppers through fake storefronts. In November 2025, Krebs reported that Google had sued the alleged operators of Lighthouse, a phishing-as-a-service platform tied to the same groups. Its fake shops collected card details at checkout and then asked shoppers for a bank code, which was the code needed to load their card into a criminal’s wallet. Real merchants feel the effects later, when wallet payments made with those enrolled cards come back as fraud disputes.
How Apple Pay and Google Pay Protect Card Data
Both wallets are built on tokenization, and both are harder to exploit at the point of payment than a plastic card. Their weak points sit elsewhere in the process.
1. Tokenization Replaces the Real Card Number
Tokenization swaps the card’s primary account number for a device-specific substitute. When a card is added to a wallet, the issuer or its token service provider creates that substitute and ties it to one device.
Merchants receive the token rather than the real card number. As a result, a breached merchant database or a skimmed terminal yields data that cannot be reused on its own. Google explains that with device tokens, only the issuing bank and the card network hold the actual card number during a purchase.
2. Apple Pay Security Features
Apple calls its token a Device Account Number. According to Apple’s Apple Pay security overview, the issuer creates and encrypts that number, Apple cannot decrypt it, and it is stored in the Secure Element, a certified chip isolated from the operating system. The number is never stored on Apple servers or backed up to iCloud.
Each purchase also carries a transaction-specific dynamic security code that the issuer or payment network can check to confirm the payment came from that device. Strong Apple Pay security at the transaction level is the reason criminals focus on getting their own device enrolled instead.
3. Google Pay Security Features
Google Wallet works the same way. Each card added receives a device-specific virtual account number, so the real card number is not stored on the phone or shared with merchants. Payments require the phone’s screen lock, PIN, or biometric check, and Google’s issuer documentation requires banks to support at least two verification methods for card enrollments that need extra checks.
How Stored-Value Accounts Differ
A stored-value account holds money itself rather than pointing to a card. Examples include PayPal, Venmo, and Cash App balances, prepaid cards, gift cards, and the store credit or loyalty balances merchants issue.
There is no Secure Element guarding the balance. Access usually depends on a username, a password, and whatever second factor the provider supports, and money sent out of the account to another user is often difficult to recover. The table below compares where each payment type is strongest and where it is most exposed.
Digital wallet and stored-value payment security reference
| Payment type | How data is protected | Most common attack path | Where disputes go |
|---|---|---|---|
| Apple Pay | Device Account Number stored in the Secure Element, a dynamic security code for each transaction, and Face ID, Touch ID, or passcode | Phished card details and one-time codes used to enroll the card on a criminal's device | Card issuer, under card network chargeback rules |
| Google Pay | Device-specific virtual account number plus screen lock, PIN, or biometric check | Phished card details and one-time codes used to enroll the card on a criminal's device | Card issuer, under card network chargeback rules |
| Stored-value accounts | Account login credentials and the provider's own authentication | Account takeover through phishing, reused passwords, or SIM swaps, plus scams that trick users into sending funds | The account provider's dispute or error-resolution process |
What Apple Pay Fraud and Google Pay Fraud Mean for Merchants
A wallet payment tells a merchant that the token was used on the device it was issued to. It does not tell the merchant who enrolled that device. When a fraudster has provisioned a stolen card, Apple Pay fraud and Google Pay fraud look like clean, authenticated transactions at checkout. Wallet abuse is one part of the wider eCommerce merchant fraud picture, and it calls for the same layered review.
Wallet Payments Still Lead to Chargebacks
Apple Pay and Google Pay send card payments through the same card networks as any other card transaction, so a cardholder who spots an unauthorized charge disputes it with their issuer. An Apple Pay chargeback follows the network’s dispute rules, and the merchant responds with evidence just as it would for a plastic card.
Liability for wallet transactions varies by network, region, and whether the purchase happened in store, in app, or online, so confirm the rules that apply with your acquirer. A consistent dispute management process improves the odds of recovering revenue, and MFJ’s guide on how to win a fraud dispute covers what evidence to submit.
Fraud Signals Worth Watching on Wallet Transactions
Wallet tokens hide some of the data merchants are used to seeing, so other signals carry more weight. Patterns worth flagging include:
- A new customer account placing a high-value first order with a wallet, especially for gift cards, electronics, or other resellable goods.
- Several orders from different accounts that share a device, IP address, or shipping address within a short period.
- Shipping addresses that do not match the wallet’s billing contact, or rush shipping to freight forwarders.
- Rapid repeat purchases just under your review threshold, which matches the pattern ThreatFabric described for relay cash-outs.
- Logins or account changes from a new device shortly before a wallet checkout.
Any one of these can be innocent. Combined, they describe a high-risk transaction that deserves review, and they fit into the broader steps for preventing credit card fraud that apply to every payment method.
Securing Your Own Stored-Value Programs
Merchants that issue gift cards, store credit, or loyalty balances run their own stored-value accounts and need the same protections a wallet provider does. Practical controls include:
- Require multi-factor authentication for account logins, and use app-based codes or passkeys instead of SMS codes where you can.
- Ask customers to re-authenticate before changing an email address, phone number, or payout method, or before redeeming a large balance.
- Rate-limit gift card balance checks so bots cannot test card numbers and PINs at scale.
- Alert customers to logins from new devices and to balance redemptions.
These controls belong in your overall merchant fraud protection plan, alongside the best practices to prevent eCommerce fraud that apply across every channel.
How Issuers Can Strengthen Digital Wallet Security
Issuers control the enrollment step, which is where most digital wallet fraud begins. Digital wallet security improves fastest when issuers take these steps:
- Score every new token request using device, location, and account history, and route risky requests to stronger verification.
- Replace or supplement SMS codes with approval inside the issuer’s own app, where the customer can see which wallet and device are being added.
- Write verification messages that name the wallet and device, and tell customers never to share the code with a merchant or caller.
- Notify cardholders as soon as a card is added to any wallet, with a quick way to remove it.
- Monitor newly provisioned tokens through their first weeks of use, since Krebs reported that criminals often let stolen wallets sit for about 10 days before using them heavily.
Merchants can support this work by sharing confirmed fraud cases with their acquirer and following MFJ’s steps to report credit card fraud when a stolen card shows up in their orders.
Close the Gaps Where Wallet Fraud Starts
Apple Pay and Google Pay are safer than plastic cards at the moment of payment, and stored-value accounts are only as safe as the login that guards them. The fraud that gets through comes from stolen enrollment codes, hijacked accounts, and payments that look trustworthy because they came from a wallet.
Issuers should harden enrollment and alert customers to every new token. Merchants should treat wallet payments as one signal among many, protect their own stored-value programs with strong authentication, and keep dispute evidence ready for the cases that still turn into chargebacks.
