HSBC and Hong Kong Banks Face Fraud Liability in iPhone 18 Presale Card Breach

Hong Kong police received over 700 fraud reports on September 12 and 13 after iPhone 18 Pro presale opened, with unauthorized charges totaling HK$14.7 million. HSBC, Hang Seng Bank, Standard Chartered, and Bank of China Hong Kong confirmed they are investigating and will refund customers for unauthorized transactions. Lawmakers say merchants may have disabled 3D Secure authentication to accelerate checkout speed, shifting liability to the merchants themselves.

The scale of the fraud attack

Police logged 700 reports in two days, averaging HK$21,000 per case, with the largest single fraud reaching HK$114,000. Victims reported credit card charges appearing in Apple Store transactions they never authorized. Some cardholders discovered multiple unauthorized charges on a single card, with cumulative losses exceeding HK$60,000 before banks intervened. No arrests have been made and investigators are still tracing transaction flows and delivery arrangements.

Why merchants may have disabled security checks

Lawmaker Wu Jie-zhuang told radio on September 14 that merchants likely suspended 3D Secure (3DS) authentication to reduce checkout delays. Each 3DS verification adds 30 to 40 seconds per transaction, extending to one minute on slow networks. Apple and other merchants may have used dynamic risk assessment to bypass 3DS for some or all transactions, creating a window for fraudsters to process orders without cardholders confirming them via one-time passwords or mobile banking apps.

Banks step in, merchants face the bill

HSBC, Hang Seng, Standard Chartered, and Bank of China Hong Kong confirmed they will investigate disputed transactions and refund customers who used cards responsibly. Apple stated all orders are reviewed before processing and fraudulent transactions are cancelled in the backend system. The Hong Kong Monetary Authority ruled that merchants who disable authentication must bear the financial loss from unauthorized transactions, not cardholders.

What customers should do now

The Security Bureau urged cardholders to check transaction records immediately and freeze cards immediately through banking apps or by phone. File dispute claims with their issuing bank and contact Apple to cancel suspicious orders before shipment. Since phones have not shipped, funds remain in bank accounts, limiting actual losses. Wu advised customers to watch for phishing sites and never enter card details on unfamiliar websites.

Final Thoughts

The fraud attack exposes a gap between security and speed in online retail. Merchants who disabled authentication to reduce checkout friction now face full liability for losses. Customers with HSBC and other major Hong Kong banks are protected from financial harm if they act quickly.

FAQs

Disclaimer:

The content shared by Meyka AI PTY LTD is solely for research and informational purposes.  Meyka is not a financial advisory service, and the information provided should not be considered investment or trading advice.