Which? has warned of a new wave of fake text messages that tell recipients their Apple Pay has been temporarily suspended and that they must re-register their payment details to restore it1. The consumer body published the warning on 25 August 2026, saying the messages are convincing but entirely fake1.
According to Which?, the scam works when the recipient clicks through and enters their long card number, CVV number and billing address on an online form, believing this will get their mobile wallet working again1. Which? says the wallet was never broken, and that the details are instead given to a scam website monitored in real time by criminals1. The fraudsters then enter the card details into a device they control to set up a new wallet, which triggers a push notification or one-time passcode on the victim's phone; approving it sets up the fraudsters' wallet rather than their own, allowing them to spend the money1.
Which? describes two other versions of the same approach. In some cases the message gives a phone number for a scam call centre where fraudsters ask for card details, and in another variant fake shopping sites or social media adverts offer fake bargains1. Which? says the outcome is the same in each case1.
"A wave of these texts have been reported to Which? in recent months through our Scam Action and Alerts Facebook group and our Scam Sharer Tool."
Which? says Apple Pay, along with Google Wallet and Samsung Pay, lets people upload card details to a digital wallet on a phone or tablet, which can then be tapped on a card reader to pay in shops, and used to pay on some websites and apps without manually entering card details1. Which? advises never clicking the links or phone numbers in these messages, and says problems with a digital wallet can usually be resolved in the phone's settings1. It adds that anyone in doubt can call 159, run by Stop Scams UK, to be connected with their bank's fraud team1.
Why it matters for households
The messages target people who use a digital wallet, and the details requested are the ones needed to add a card to a wallet on another device: the long card number, the CVV and the billing address1. Because the passcode or push notification that follows is a genuine message from the card issuer, a household that has approved it may not realise a second wallet has been created until spending appears on the card1. Which? does not state in the article how many texts have been reported, how much money has been lost, or which banks or card issuers have been affected; those figures have not been reported1. The warning covers fake messages about Apple Pay specifically, though Which? notes Google Wallet and Samsung Pay are also digital wallet services1.
What happens next
Which? has not announced any further steps, deadline or change of process in the article1. It continues to collect reports through its Scam Action and Alerts Facebook group and its Scam Sharer Tool1. Households dealing with a suspected phishing, vishing or smishing message can find general guidance in our scams and fraud section, including what is involved in claiming a refund from your bank after a push payment loss and how changed bank details on an invoice are used in payment redirection fraud.
FCA Warning ListCheck whether a firm is authorised before you deal with it
Financial Ombudsman ServiceFree, independent help when a complaint about a firm is not put right
Citizens AdviceFree advice on money, consumer and legal problems in England and Wales
MoneyHelperFree, impartial money and pensions guidance, set up by government