Read More
The highly anticipated launch of Apple’s first folding smartphone, the iPhone Duo, has sparked widespread online purchasing chaos since preorders opened Friday.
ADVERTISEMENT
SCROLL TO CONTINUE WITH CONTENT
Scores of frustrated shoppers turned to social media to report that they were repeatedly billed despite failing to secure a phone, while some successful buyers claimed their credit cards were charged multiple times for a single order.
Francis Fong Po-kiu, the honorary president of the Hong Kong Information Technology Federation, explained today that the incident stems from technical server issues during peak traffic.
He also warned that Apple’s website currently contains a security loophole by not enforcing a double-authentication protocol, allowing opportunistic fraudsters to make unauthorized purchases.
According to Fong, the credit card issues surrounding the preorder launch fall into two distinct categories. The first is a billing duplication error caused by severe network congestion.
When thousands of users attempted to access the portal simultaneously, server delays led to repeated transaction requests being submitted either by the users themselves or the retail system.
Fong noted that under standard banking procedures, card issuers will generally review and cancel these pending double charges before they are officially finalized on monthly statements.
Security vulnerability exposes citizens to widespread credit card theft
The second and more concerning issue involves outright credit card fraud targeting people who never even attempted to buy the new phone.
Fong revealed that bad actors are exploiting the massive volume of transactions during the launch window to go on a spending spree using stolen card information previously harvested from phishing websites or database leaks.
Because Apple’s official platform does not mandate the use of 3D Secure (3DS) authentication—which requires cardholders to enter a one-time password sent via text message or approve the transaction in a banking app—fraudsters only need basic card details to complete purchases.
Fong urged Apple to close this security loophole by immediately implementing mandatory 3DS verification on its official platform to block fraudulent activities at the source, while also improving its backend servers to prevent double billing.
In the meantime, the IT veteran advised members of the public to regularly monitor their banking transactions.
Anyone who spots unauthorized charges should immediately contact their card-issuing bank to freeze their accounts and report the incident to the police.
