Receipts attached 6 sources
Sources
-
Other source
Monday police complaint count
130 reports, approximately HK$5 million, largest complaint
-
Other source
Police account of repeated 3DS warning
Inspector Lo comments, lack of 3DS, Saturday no-arrest status
-
Other source
HSBC explanation to cardholder
Reporter firsthand duplicate authorization and bank response
-
Other source
September police case count
Police Commissioner Chow figures and account
-
Other source
Apple statement on order review
Apple response
-
Other source
Unauthorized-card transaction protections
HK$500 conditional limit and 60-day notice
Limits
The 130 complaints and HK$5 million are police reports, not confirmed fraud or final losses. HSBC identified some duplicate authorizations caused by its own processing; the share of each problem is not yet public. The photo shows an Apple Store in 2013, not this launch.
Corrections
No correction notes have been added for this article.
Police have logged 130 complaints involving about HK$5 million since iPhone Duo preorders opened. They had urged Apple to tighten payment security after a larger September incident. HSBC has also acknowledged a separate processing problem, leaving the share of actual fraud unresolved.
HONG KONG, October 19, 2026 — Apple’s new foldable iPhone Duo is supposed to show off what the company’s engineers can do. For some Hong Kong cardholders, the standout feature was getting a payment notification without ordering one.
Preorders opened Friday evening. Within hours, social media filled with complaints from people who said their cards had been charged repeatedly, sometimes for phones they never tried to buy. By 9 a.m. Monday, police had received 130 reports involving roughly HK$5 million in suspected unauthorized transactions. One case alone came to HK$229,788, enough for about a dozen of the new folding phones.
The amount isn’t the most troubling part. Hong Kong went through almost exactly this a few weeks ago, and police say they told Apple how to prevent a repeat. When the next iPhone went on sale, they say, the fix still wasn’t there. Cardholders were again left wondering who was using their credit cards.
A HK$31 Million Warning
In September, preorders for the iPhone 18 Pro series produced more than 1,500 reports of suspected card misuse, involving over HK$30 million in transactions. On September 29, Police Commissioner Joe Chow Yat-ming said officers had identified 1,503 suspicious cases and gotten every transaction canceled. According to Chow, the suspicious transactions were canceled before cardholders, banks or Apple suffered losses.
Police said the fraudsters exploited a checkout process that never asked for extra verification of the cardholder’s identity. Investigators described stolen card details, VPNs and dodgy delivery arrangements used to get the phones into criminal hands. Police asked Apple to review its transaction procedures before the next big launch.
That makes it hard to call this week’s episode a surprise. On Saturday, Senior Inspector Lo Chun-kong of the Cyber Security and Technology Crime Bureau publicly criticized Apple for not turning on 3-D Secure (3DS) despite repeated police recommendations. He called the recurrence “extremely regrettable.”
Police are investigating whether the September and October cases involve the same syndicate. Police reported no arrests in the latest case on Saturday.
The Security Measure Apple Didn’t Use
3-D Secure is not experimental. It lets the bank that issued a card verify an online purchase, usually with a banking-app confirmation or a one-time password. Depending on the risk of the transaction, the customer may not have to do anything at all. The idea is that knowing someone’s card number shouldn’t be enough to spend their money.
According to police, Apple hadn’t activated it for Friday’s launch. The obvious question is why.
The absence of 3DS does not, by itself, establish that Apple broke Hong Kong law or that every disputed transaction was fraudulent. Police have identified a security measure they wanted Apple to use; Apple has not publicly explained why it did not use it for this launch.
Responsibility looks different, though, when a company has been warned about a specific weakness, has already had a major incident, and then runs into a similar problem. Whether Apple had other safeguards in place, and why they failed to prevent the latest complaints, are still unanswered.
HSBC’s Admission Complicates the Picture
There’s another reason not to label every reported charge as card fraud. HSBC has acknowledged that some of the repeated payment authorizations came from an operational problem on its side.
Hong Kong 01 reported that one of its journalists preordered an iPhone Duo with an HSBC Red credit card and then received repeated transaction notifications. HSBC apologized and attributed the repeated processing of certain October 16 transactions to an operational issue, not unauthorized use of the card. The bank said the duplicate authorizations would be canceled automatically within one or two days, and that customers would not be responsible for them.
The difference matters. A purchase made with stolen card details is a fraud and authentication problem. A legitimate purchase that triggers several payment authorizations is a plumbing problem. Both are a hassle for customers, but they have different causes and different fixes.
It also means the HK$5 million figure needs careful handling. It is the amount tied to complaints under investigation, not HK$5 million in confirmed losses that nobody will get back. Nothing released so far says how many transactions were actually fraudulent, how many were erroneous authorizations, or how much money, if any, will end up lost. Police and the banks should publish that breakdown.
Who Bears the Risk?
The issue goes beyond Apple and HSBC. Hong Kong has spent years pushing electronic payments and promoting itself as a sophisticated financial center. That convenience rests on duller machinery: transaction authentication, fraud monitoring, payment processing that works, and a workable way to dispute a charge.
Cardholders do have real protection. Under the Code of Banking Practice, a customer who hasn’t acted fraudulently or with gross negligence, and who meets the reporting requirements, should generally be liable for no more than HK$500 of qualifying unauthorized credit-card losses. Customers are advised to report disputed transactions promptly, and no later than 60 days from the statement date.
That’s reassuring, but being reimbursed isn’t the whole story. A customer may still spend hours calling banks, replacing cards, watching accounts, disputing charges and waiting for phantom authorizations to clear. Even when the final loss is zero, the time and worry are real.
There’s also the question of incentives. If customers absorb the disruption while merchants and banks sort out disputed payments afterward, how much pressure is there to stop the problem from happening? “You’ll get your money back eventually” is not a satisfying answer.
Three Questions That Still Need Answers
Why didn’t Apple adopt the authentication police repeatedly recommended? Was it a technical limitation, a business decision, or confidence in other fraud controls? Apple has not publicly given a detailed answer to the police criticism.
How much of the HK$5 million is actually fraud? Police and banks should separate confirmed unauthorized purchases from duplicate authorizations, canceled transactions and other processing errors.
What changes before the next launch? Catching and reversing suspicious transactions is necessary, but preventing them is better. The public should know whether stronger authentication, transaction monitoring and checks on suspicious bulk orders are coming.
Apple has said it is reviewing iPhone Duo orders before processing them and working to identify and cancel fraudulent transactions. That is useful, but it responds to complaints that have already occurred.
September showed that police, banks and Apple working together could stop suspected fraud from turning into real losses. It also gave Apple advance notice of what could go wrong at its next launch. A month later, Hong Kong is investigating another wave of suspicious charges.
Apple’s engineers have spent years perfecting a phone that folds in half. Customers are entitled to ask why, after two launches in a row, the payment system keeps coming apart.