The message claimed $8,250 had already been charged through Apple Pay and warned that a duplicate $8,250 transaction would "auto-approve" in 35 minutes. It told Paul to call an 855 number, quote "Case CA-3321" and "verbally kill the pending charge." We partially masked the callback number so no one calls it accidentally.
The message looks chaotic, but nearly every phrase has a purpose. The sender uses dramatic wording, fake authority and a tight deadline to push Paul toward one action: calling the number in the text.
The message came from a number beginning with +44, the international calling code for the United Kingdom. Yet it claims to come from "Apple Pay Account Services" and tells Paul in Washington, D.C., to call a separate 855 toll-free number. A different callback number does not automatically prove fraud. However, an overseas sender directing a U.S. recipient to an unrelated support line should make you stop before calling.
The text uses the Apple Pay name several times and signs off as "Apple Pay Account Services." It also arrived as a blue iMessage with the word "Encrypted" shown beneath it. Those details can make the message feel official. However, encryption only means the message was protected while traveling between devices. It does not confirm that Apple sent it. The signature also sounds generic. It does not name Paul's bank, identify the card involved or provide an official Apple support channel.
The first line reads: "$8,250.00 APPLE PAY - 35-MINUTE DEADLINE". The message then claims $8,250 has already disappeared and warns that a duplicate $8,250 charge will be approved in 35 minutes. That raises the threatened loss to $16,500. The exact 35-mcxxcxxcxinute deadline feels calculated. It gives Paul enough time to call while discouraging him from checking Wallet, opening his bank's app or asking someone else for advice.
The message says Paul's Apple Pay account has "hemorrhaged" money. It calls the situation a "catastrophic fraud event" and claims his contactless limit has been "crushed" to $0. It later tells him to "verbally kill the pending charge." Those words sound dramatic because they are meant to produce fear. A legitimate financial alert would normally use clear terms such as charged, declined, frozen or pending. It would not describe an account as hemorrhaging money or ask you to kill a charge.
The first transaction allegedly happened at: "an agricultural processing surplus in Stockton, CA". The second supposedly involved: "a payday lending chain in Modesto". Neither phrase identifies an actual merchant. They sound specific at first because they include industries and real California cities. However, they fall apart when you look closer. A legitimate transaction alert would usually show the merchant's name. It would not rely on vague descriptions such as "agricultural processing surplus."
The sender claims Paul's contactless spending limit has been "crushed to $0." In the same message, it says the second $8,250 transaction is pending and "will auto-approve in 35 minutes." Those claims do not fit together. If the sender had already blocked contactless activity, why would another contactless charge automatically go through? The contradiction matters because it shows the message was written to create panic rather than explain a real account problem.
The message says: "Do not ignore this." It then orders Paul: "You must call." The sender provides a case number, tells him to "verbally kill" the charge and warns that the money will be "gone forever" if he fails to respond. It also threatens to blacklist his account and calls this his "only warning." That language gives Paul one supposed solution: call the number in the text. The message never tells him to open Wallet, check his bank's official app or call the number printed on his card. That is the biggest red flag of all. Every part of the message funnels him toward a stranger waiting on the other end of the phone.
Apple Pay users should verify suspicious charges through Wallet, their bank’s official app or the number printed on their card — not contact information in an unexpected text. Getty Images
Apple Pay users should verify suspicious charges through Wallet, their bank’s official app or the number printed on their card — not contact information in an unexpected text. Getty Images
The text serves as bait. The phone call allows the scammer to take control of the conversation. Once you call, the person may claim to see your account. They could ask for your name, card number or Apple Account email. Next, they may request a verification code and describe it as a way to cancel the charge.
A scammer could also ask you to install a remote-access app. That would let the person view your screen or guide you through financial transactions. Some callback scams eventually instruct people to transfer money into a "safe" account. Others claim they sent an oversized refund and demand that the extra money be returned.
The FTC warns that fake support agents may seek remote access, steal card information or convince people to move money. CyberGuy previously heard from another person whose Apple Pay scam text nearly led to a $15,000 loss. In that case, the caller used personal information and pressure to keep her on the phone while she drove to her bank.
Do not call the number in the text. Instead, check through channels you already trust:
Open the Wallet app on your iPhone.
Select the credit or debit card involved.
Tap the Transactions tab.
Review the latest activity.
Open your bank or card issuer's official app for the full account history.
Call the number on the back of the physical card if anything looks wrong.
Apple notes that Wallet may not display the complete transaction history for every card. Your bank or card issuer remains the best source for questions about an Apple Pay charge. Do not rely on a phone number from a text, caller ID or sponsored search result.
Before deleting the message, save a screenshot that includes the sender information.
On an iPhone:
Tap Report Spam or Report Junk under the message, depending on what appears.
Block the sender.
Delete the conversation.
Email the screenshot to reportphishing@apple.com.
Forward the unwanted text to 7726, which spells SPAM.
File a report with the FTC at ReportFraud.ftc.gov.
Apple recommends emailing screenshots of suspicious Apple text messages to its phishing address. It also lets iPhone owners report junk directly inside Messages. For more ways to handle messages like this, see our guide on how to protect yourself from tech support scams.
Hang up as soon as you suspect fraud. Then take action based on what you shared:
You only called: Block the number and watch for follow-up calls or texts. Scammers may now know that your phone number reaches a real person.
Click here to read the web article (VERY LONG)
You provided a card or bank number: Contact the financial institution through its official app or the number on the card. Ask it to secure the account and review recent activity.
You shared an Apple Account password: Change that password immediately. Confirm that two-factor authentication remains enabled and review the devices connected to your Apple Account. Apple recommends changing the password right away when information may have been entered into a scam site or given to a scammer.
You gave away a verification code: Contact the affected company immediately. Never approve an unexpected login request.
You installed remote-access software: Disconnect the device from the internet. Remove the remote-access software, then run a full security scan using strong antivirus software. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com. If the scammer may have seen your financial information, contact your bank from a different trusted device.
You shared your Social Security number: Place a free credit freeze with Equifax, Experian and TransUnion. Continue monitoring your credit reports for unfamiliar accounts.