Police Receive Over 100 Reports on iPhone Duo Pre-Order Charges as Apple Reviews Suspect Transactions

Hong Kong police have received more than 110 reports of suspected credit card misuse linked to Apple's iPhone Duo pre-orders, involving about HK$4.6 million (around £439,000), according to figures reported by public broadcaster RTHK.

The complaints followed the opening of online pre-orders at 8pm on Friday, 16 October. Customers reported duplicate charges, failed orders that still generated payment alerts, and transactions they said they did not recognise. Police said the cases involved cards issued by multiple banks and had been classified as obtaining property by deception.

Senior Inspector Lo Chun-kong of the Cyber Security and Technology Crime Bureau said Apple had not activated 3D Secure (3DS) verification for the pre-sale, despite repeated police recommendations after a similar incident in September. Lo criticised the recurrence and urged Apple to introduce effective safeguards. His comments are the police assessment; investigators have not established that every reported transaction had the same cause.

Police Cite Missing Payment Verification

3DS is an additional online card-payment check that can require a cardholder to verify a purchase through a one-time password or a bank's mobile app. Police said the measure could help protect customers from transactions made using compromised card details.

The largest reported loss was nearly HK$230,000 (£21,987). No arrests had been made at the time of the police briefing on Saturday, 17 October.

Some customers said they had successfully ordered a phone but received alerts for multiple payments. Others said their orders had failed despite repeated charges, while some claimed they had not ordered an iPhone Duo at all.

One customer account described two charges of HK$34,998 (£3,345.70), totalling HK$69,996 (£6,691.41). Another user claimed five charges amounted to HK$174,990 (£16,728.52). These examples illustrate the complaints but are not a verified measure of overall losses. A payment alert or pending authorisation does not necessarily mean money has been permanently taken.

Apple and HSBC Respond

Apple said all current iPhone Duo orders were being reviewed before processing and that it was working to identify and cancel fraudulent transactions, according to RTHK. Police also said Apple had adjusted its fraud-risk model and increased monitoring staff after the earlier incident, although 3DS was not active during Friday's pre-sale. The company had not publicly detailed how many orders had been flagged or cancelled.

HSBC said it was aware of online discussions involving its credit cards. A spokesperson said customers would not be liable for duplicate transactions and that the bank would identify and cancel them.

Separately, HK01 reported that HSBC apologised to one of its reporters after a purchase made on 16 October was processed repeatedly. The bank described that specific incident as an operational issue and said duplicate authorisations would be cancelled automatically, potentially within one to two days.

The reports do not establish that every disputed charge involved HSBC or that duplicate processing explains all suspected unauthorised transactions. HSBC has advised customers with unauthorised transactions to contact the bank through its app or customer-service channels.

Similar Incident in September

The latest reports follow suspicious transactions during pre-orders for the iPhone 18 Pro and iPhone 18 Pro Max in September. By 17 October, police said they had received more than 1,570 reports relating to that incident, involving about HK$31 million (£2.96 million).

Police previously raised concerns about online purchases being made without additional cardholder verification. The similar timing and payment-security concerns make the earlier incident relevant, but they do not prove that all current reports have the same cause or that every complaint represents confirmed fraud.

The final number of affected transactions and their causes remain under investigation.

What Customers Should Do

Police have advised people who spot suspicious credit card activity to contact their card issuer, notify Apple and report the matter to police. Customers should keep payment alerts, order confirmations and correspondence, and ask their bank whether a transaction is a pending authorisation, a duplicate or an unauthorised payment.

The reports remain under investigation; police enquiries and Apple's review will need to establish which transactions were fraudulent and which resulted from duplicate processing.