Earlier today I had a string of fraudulent "vinted" purchases against my AppleCard. The first two $17 and $35 transactions went through but the repeated transactions were bl ocked.
Apple doesn't provide a good dispute mechanism in the wallet app. I called Chase, which was deeply unhappy and even rude. They are probably getting a lot of these and clearly hoped I'd confess to some kind of past relationship with Vinted (which would somehow absolve them). It sounds like I'll be, quite grumpily, refunded.
The attacker almost certainly had my CVV number. Merchants are not allowed to store that, though a few probablu do. More likely. apparently, is an attack where a vendor I shopped at was infected with web skimmer like Magecart. (My only serious phishing attack recently was a clever one that used poshmark and it failed.)
I wonder if newer LLM-empowered attackers can do things like Magecart on a larger scale.
I now have a brand new number and CVV. There's an advanced protection feature for Apple Cards that randomly rotates the CVV and I've enabled that.
