The text message looks harmless enough. A small toll charge. An unpaid parking ticket. A shipping fee for a package you half-remember ordering. The amount is trivial — $6.55, maybe $11.35 — designed to feel too minor to question but urgent enough to act on. You tap the link. A polished website loads, complete with familiar logos and reassuring design. You enter your card details or, worse, add a new card to Apple Pay at the scammer’s direction.
And just like that, your financial life belongs to someone else.
This is the Apple Pay scam, and according to new data, it has already targeted roughly 56% of Americans — approximately 146 million people — with the rate of attack accelerating sharply in 2025. The scheme doesn’t exploit a flaw in Apple’s technology. It exploits trust, urgency, and the human tendency to resolve small problems quickly. It is, by several measures, the most effective consumer fraud operation running in the United States right now.
ConsumerAffairs reported in late April 2025 that a survey of 1,044 Apple Pay users found 18% had already fallen victim to the scam, with financial losses averaging $1,246 per person. Among those who lost money, 38% reported losses between $500 and $1,000, and 28% lost between $1,000 and $5,000. These aren’t rounding errors. They represent serious financial damage inflicted through a combination of social engineering and the speed at which digital payment systems move money.
The mechanics are deceptively simple. Fraudsters send phishing messages — via SMS, email, or even phone calls — impersonating trusted entities like toll agencies, delivery services, banks, or Apple itself. The messages contain links to counterfeit websites that mimic legitimate payment portals. Victims are prompted to enter credit or debit card information, or in some cases, to add a card directly to Apple Wallet on a device the scammer controls. Once a card is provisioned on the attacker’s phone, they can make contactless purchases in stores, withdraw cash, or initiate transfers — all before the victim realizes anything is wrong.
Apple, to its credit, has published detailed guidance on recognizing these attacks. The company’s official support page on phishing and social engineering lays out the warning signs clearly: unexpected messages asking for personal information, URLs that don’t match the company they claim to represent, requests that create a sense of urgency, and solicitations for Apple ID passwords or verification codes. Apple states plainly that it will never ask users to provide their password or two-factor authentication codes via text, email, or phone. The company also advises users to never share personal data or security information and to enable two-factor authentication on their Apple accounts.
Good advice. But it’s not stopping the bleeding.
The problem is that the scams have grown remarkably sophisticated. The fake websites are nearly pixel-perfect replicas. The messages arrive from spoofed numbers that appear local. And the amounts requested are calibrated to slip beneath the threshold of suspicion. Who calls their bank over a $6 toll charge? Almost nobody. That’s the point.
ConsumerAffairs found that 40% of targeted users received scam attempts via text message, making SMS the dominant attack vector. Another 26% were targeted through email, and 16% through phone calls. The generational breakdown is telling: Gen Z respondents were the most likely to have been targeted, at 64%, while Baby Boomers reported the lowest targeting rate at 46%. But targeting and victimization don’t track neatly by age. Younger users, more comfortable with mobile payments and quick digital transactions, may actually be more susceptible to acting on a fraudulent prompt without pausing to verify it.
The financial fallout extends well beyond the initial theft. According to the same survey, 32% of victims reported that their stolen information was used for additional unauthorized purchases. Thirty-one percent experienced identity theft. And 30% found that their bank or card information had been compromised in ways that required account closures and replacements. The average victim doesn’t just lose money once — they enter a prolonged period of financial vulnerability.
Recovery is difficult. Forty-two percent of victims said they reported the fraud to their bank. Thirty-eight percent contacted Apple. And 31% filed reports with law enforcement. But the nature of digital payment fraud makes restitution uncertain. Banks may reverse unauthorized charges if they’re reported quickly, but transactions made through a legitimately provisioned Apple Pay card — one the victim technically authorized by entering a verification code — can be harder to dispute. The fraud sits in a gray zone between unauthorized access and social engineering, and financial institutions don’t always treat those the same way.
What makes this scheme particularly dangerous is how it weaponizes the infrastructure of legitimate payment systems. Apple Pay itself isn’t compromised. The tokenization and biometric authentication that protect transactions remain intact. But those protections assume the person setting up the card is the rightful owner. When a scammer tricks a victim into providing card details and a one-time verification code, the system works exactly as designed — it just works for the wrong person. The security model protects the transaction, not the enrollment.
This is a distinction that matters enormously and one that Apple’s support documentation addresses only obliquely. The company tells users to be suspicious of messages requesting personal information and to verify directly with the company in question. But the enrollment flow for adding a card to Apple Pay on a new device relies on verification codes sent to the cardholder — the very codes scammers are trained to extract through pretexting. A more friction-heavy enrollment process might reduce fraud at the cost of convenience. That’s a tradeoff Apple has historically been reluctant to make.
The scale of the problem has drawn attention from federal agencies. The FBI has repeatedly warned about smishing — SMS phishing — campaigns targeting toll payment systems and delivery services, noting a sharp increase in complaints beginning in late 2024 and continuing into 2025. The Federal Trade Commission has similarly flagged fake toll and shipping messages as among the fastest-growing categories of consumer fraud. But enforcement is hampered by the international nature of many of these operations, with phishing infrastructure hosted across multiple jurisdictions and money extracted through layered digital wallets that are difficult to trace.
So what should consumers actually do?
Apple’s guidance is a reasonable starting point: don’t click links in unexpected messages, don’t share verification codes with anyone, enable two-factor authentication, and verify requests by contacting companies directly through official channels. But the survey data suggests that awareness alone isn’t sufficient. People who know about phishing still fall for it when the message is well-crafted and the amount seems inconsequential.
Financial institutions are beginning to implement additional safeguards. Some banks now require in-app confirmation before a card can be added to a digital wallet on a new device, rather than relying solely on a one-time passcode sent via SMS. This approach shifts verification to a channel the scammer is less likely to control. Others are deploying real-time fraud detection that flags when a card is provisioned on a device in an unusual location or on multiple devices in rapid succession.
None of these measures are foolproof. The fundamental challenge is that social engineering attacks target human judgment, not technical systems. You can harden every protocol and encrypt every channel, and a well-timed text message about a $7 toll charge will still get someone to hand over their card number. The scam works because it’s boring. Because it’s small. Because it looks like exactly the kind of minor administrative friction that modern life is full of.
That ordinariness is the weapon.
For the 146 million Americans who have already received one of these messages, the advice is straightforward if unsatisfying: slow down. Any legitimate toll agency, shipping company, or financial institution will allow you to verify a charge through their official website or customer service line. No real entity will require you to act immediately through a link in a text message. And no one from Apple will ever ask you to read back a verification code.
The 18% who have already lost money know this now. The question is whether the other 82% will learn it before they get the next text.
WebProNews is an iEntry Publication