FINANCE

Bank of China Mastercard Holders Hit by Apple Pay-Linked Fraud in Brazil

Published: Oct. 8, 2026 6:36 p.m. GMT+8

00:00

00:00/00:00

Listen to this article 1x

Some Bank of China Ltd. (601988.SH) Mastercard holders were hit by a wave of unauthorized transactions in Brazil after criminals obtained digital payment tokens linked to Apple Pay, Caixin has learned.

The incident highlights new risks in cross-border card payments.

Bank of China users were the main victims, with the lender intercepting nearly half of the illicit transactions, according to sources familiar with the matter. China Merchants Bank Co. Ltd. (600036.SH) and Agricultural Bank of China Ltd. (601288.SH) largely blocked the abnormal charges.

You've accessed an article available only to subscribers

Subscribe today for just $.99.

VIEW OPTIONS

Unlock exclusive discounts with a Caixin group subscription — ideal for teams and organizations.

Subscribe to both Caixin Global and Bloomberg - for the price of one.

Share this article

Open WeChat and scan the QR code

DIGEST HUB

Digest Hub

Back

Explore the story in 30 seconds

Unauthorized transactions hit Bank of China Mastercard holders in Brazil via Apple Pay digital tokens; Bank of China intercepted nearly half of illicit charges.
Mastercard and Bank of China closed vulnerabilities, reversed charges; risk stemmed from Brazilian payment processors' failures.
Criminals obtained 16-digit Apple Pay tokens; similar fraud hit Shanghai Pudong Development Bank in Sept 2025; AI complicates detection.

AI generated, for reference only

Who’s Who

AI generated, for reference only

What Happened When

2026：: Some Bank of China Ltd. (601988.SH) Mastercard holders were hit by a wave of unauthorized transactions in Brazil after criminals obtained digital payment tokens linked to Apple Pay; lender intercepted nearly half of illicit transactions, China Merchants Bank and Agricultural Bank largely blocked abnormal charges; Mastercard and Bank of China quickly investigated, closed vulnerabilities and reversed charges; source said risk stemmed from control failures at Brazilian payment processors; Apple said working with Mastercard and Bank of China; incident comes less than a year after Apple Pay began allowing Chinese users to link Visa and Mastercard; Brazil is a high-risk market; attack evolved from credential stuffing; criminals obtained 16-digit token; unclear method of use; AI rise complicates risk.

AI generated, for reference only