Credit card scam through Roadtolls texts - scammer loaded card onto payWave on their phone.

Please note this sub-forum does not provide professional finance advice. You should seek advice from a licensed financial advisor.

To post in this sub-forum you must have made 100 posts or have Trust status or have completed our ID Verification.

If investing please consider our affiliate link for new accounts: Sharesies.

Forums › Finance and wealth management › Credit card scam through Roadtolls texts - scammer loaded card onto payWave on their phone.

rugrat

3165 posts

Uber Geek
+1 received by user: 961

Lifetime subscriber

#324976 20-Jun-2026 04:16

https://www.nzherald.co.nz/nz/qingle-liu-jailed-for-role-in-89k-fake-nzta-road-toll-text-message-scam/HQXVUGU6TREXBMIQSEWLYMPK7Y/

I know an old scam, but what puzzles me is once they got victims card details from victim entering details in fake website, they were able to load the card onto their phone and use payWave.

‘Haven’t set one up in a while but certain when did there was 2 factor authentication and had to know more details then credit card number to set up, thought had to be done from internet banking also.

Wouldn’t think it possible for some random to set up there phone with payWave with just stolen card details.

"She used the stolen credit card details of two victims in two separate PayWave transactions to buy the designer items."

One person that lost their money only got half of it back from bank, though buying 9 iPhones didn’t trigger fraud detection. If that doesn’t look suspicious to a bank, I wonder what does.

I’m just surprised from story that someone can set up a fake payWave, just like that. So if someone sees your card details they can set up payWave?

1 | 2

556 posts

Ultimate Geek
+1 received by user: 970

ID Verified

Subscriber

#3504776 20-Jun-2026 08:51

I'm interested too.

Speculating, I would have thought the electronic card data held securely on either a smart phone or a blank card that was programmed with the victim's card details and used by the perpetrator for Paywave / NFC transactions would be an encrypted token issued by the card issuer and not include any human-readable information from the victim's card. The data stored on the phone would then have to be validated at each transaction attempt, per the PCI specifications. Setting this up would surely require some pretty specialised hardware and banking systems access.

Knowledge of the card's PIN number would be required too for transactions over the PIN-less ($200?) threshold. Perhaps the victims unwittingly entered that in a web form too.

Something seems a bit off, perhaps the media report is wrong.

Batman

Mad Scientist
30131 posts

Uber Geek
+1 received by user: 6312

Trusted

Lifetime subscriber

#3504788 20-Jun-2026 09:43

could be related to this hack

geek3001

556 posts

Ultimate Geek
+1 received by user: 970

ID Verified

Subscriber

#3504795 20-Jun-2026 10:43

Batman:

could be related to this hack

Interesting video.

The card issuer VP comments near the end about card fraud is interesting, card fraud per hundred dollars (presume US dollars and US stats), is only ten cents (0.1 percent) or two cents (0.02 percent) for the two fraud scenarios he mentioned.

If those rates are applicable here in NZ, where we are paying a one point something percent Paywave surcharge, that surcharge is certainly providing a revenue source to cover the cost of card fraud.

freitasm

BDFL - Memuneh
81371 posts

Uber Geek
+1 received by user: 42731

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#3504806 20-Jun-2026 11:31

As per OP, a lot is missing. Perhaps they didn't want to disclose how it was done to avoid copycats.

All the cards I've added to my phone required confirmation through the banking app, and one even asks for confirmation via the banking app, SMS, and email (all three, one after the other).

Very weird. Unless the scammers were in communication with the victim and asked the victim to "confirm the codes we just sent you".

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

LEGAL video, movies and TV download and streaming options in New Zealand

rugrat

3165 posts

Uber Geek
+1 received by user: 961

Lifetime subscriber

#3504807 20-Jun-2026 11:38

I saw that video a while ago. I turned express transit off after watching that, as it looks like that is what it is using. Express transit did work on Christchurch bus’s as when had it on, could hold watch near reader without fast double tapping button. After watching video rather have peace of mind, and just do fast taps on watch when boarding.

It looks like it is only Apple devices, as Android ones only allow express transit if charge $0.

Don’t think it is method used here, as victims device needs to be in range for each transaction, and it was done from people going to fake web site with only one transaction, but multiple were done later.

I’m thinking/hoping that there is an error in story, or the victims pressed confirm in the banking application when they shouldn’t have, something like that.

Batman

Mad Scientist
30131 posts

Uber Geek
+1 received by user: 6312

Trusted

Lifetime subscriber

#3504824 20-Jun-2026 12:29

How do i turn off express transit? Is it on the phone or on the bank?

Apple TV

Stream your favourite shows now on Apple TV (affiliate link).

rugrat

3165 posts

Uber Geek
+1 received by user: 961

Lifetime subscriber

#3504828 20-Jun-2026 12:37

Batman:

How do i turn off express transit? Is it on the phone or on the bank?

Go into wallet, tap on card. Then tap 3 dots top right. Select card details. You’ll then see Express transit Off/On. And express transit settings which I think let’s pick which card. I think by default it’ll be off, so the video may be wrong about it being on by default as from memory when I was experimenting with it I turned it on.

It’s on the phone.

Batman

Mad Scientist
30131 posts

Uber Geek
+1 received by user: 6312

Trusted

Lifetime subscriber

#3505369 23-Jun-2026 09:05

rugrat:

https://www.nzherald.co.nz/nz/qingle-liu-jailed-for-role-in-89k-fake-nzta-road-toll-text-message-scam/HQXVUGU6TREXBMIQSEWLYMPK7Y/

I know an old scam, but what puzzles me is once they got victims card details from victim entering details in fake website, they were able to load the card onto their phone and use payWave.

‘Haven’t set one up in a while but certain when did there was 2 factor authentication and had to know more details then credit card number to set up, thought had to be done from internet banking also.

Wouldn’t think it possible for some random to set up there phone with payWave with just stolen card details.

"She used the stolen credit card details of two victims in two separate PayWave transactions to buy the designer items."

One person that lost their money only got half of it back from bank, though buying 9 iPhones didn’t trigger fraud detection. If that doesn’t look suspicious to a bank, I wonder what does.

I’m just surprised from story that someone can set up a fake payWave, just like that. So if someone sees your card details they can set up payWave?

found it

geek3001

556 posts

Ultimate Geek
+1 received by user: 970

ID Verified

Subscriber

#3505372 23-Jun-2026 09:22

Learn something new every day. Thank you for that video, it explains a lot.

I have never used the wallet function on my phone, so I went in to have a look.

I now learn that it is possible to manually enter a payment card's detail, subject to a security code issued by the bank (that arrives by SMS) and it's done.

I always thought that they had to be "pushed" into the wallet for want of a better term, from a bank's banking app. How wrong I was!

The security code to confirm the process should be sent through the bank's app, not by insecure SMS.

geek3001

556 posts

Ultimate Geek
+1 received by user: 970

ID Verified

Subscriber

#3505401 23-Jun-2026 11:08

Another thought, why is there no endpoint detection of some sort that means the card can only be added to the wallet on a phone that is known to be the card holder's property.

KiwiSurfer

1876 posts

Uber Geek
+1 received by user: 1136

ID Verified

Lifetime subscriber

#3505404 23-Jun-2026 11:18

I wouldn't read too much into the media - I've seen many times when they've just glossed over detail and summarised things in a way that makes zero sense to experts but is enough for the general public to get a high level understanding.

Very possible the phish was very sophisticated and involved capturing the victim's banking passwords gaining access to their banking app app and asking for codes etc to get around 2FA for setting up contactless payments. Can see why maybe the police/media may not want to expose how this happened in case of copycats hence the high-level description of what happened.

AliExpress

Shop now on AliExpress (affiliate link).

boosacnoodle

1555 posts

Uber Geek
+1 received by user: 1033

#3505421 23-Jun-2026 11:46

So you arrive at a scam, input your card details and mobile number, scammer adds the card to their Apple/Google Pay wallet, you get sent an SMS code for verification, then you give the code to the scammer who can then use your card account as they please.

Why the heck are card issuers still using SMS for MFA? It proves nothing and customers can be easily misled into handing them over, or can have their SIM hijacked in some way. They should have been abolished ten years ago.

The Banking Ombudsman needs to put out a policy that banks hold 100% liability when they rely on SMS "verification".

freitasm

BDFL - Memuneh
81371 posts

Uber Geek
+1 received by user: 42731

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#3505423 23-Jun-2026 11:51

boosacnoodle:

Why the heck are card issuers still using SMS for MFA? It proves nothing and customers can be easily misled into handing them over, or can have their SIM hijacked in some way. They should have been abolished ten years ago.

No different than a scam page saying, "You will soon receive a notification on your banking app. Please approve it to confirm your payment"

And done. Card added.

It's all on the user, not on the method, really.

The SMS method is bad if SIM hijacking exists. But that's not the case here.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

LEGAL video, movies and TV download and streaming options in New Zealand

boosacnoodle

1555 posts

Uber Geek
+1 received by user: 1033

#3505478 23-Jun-2026 15:14

geek3001:

Another thought, why is there no endpoint detection of some sort that means the card can only be added to the wallet on a phone that is known to be the card holder's property.

There is. It's up to card issuers to use that data - or not - and to determine if any other verification parameters are required.

I used to be able to verify ANZ Bank cards in Apple Wallet with just SMS but no longer - a phone call is now required, which necessitates full verification using "Voice ID" (which can probably be hacked with AI now anyway...).

geek3001

556 posts

Ultimate Geek
+1 received by user: 970

ID Verified

Subscriber

#3505483 23-Jun-2026 15:31

boosacnoodle:

geek3001:

Another thought, why is there no endpoint detection of some sort that means the card can only be added to the wallet on a phone that is known to be the card holder's property.

There is. It's up to card issuers to use that data - or not - and to determine if any other verification parameters are required.

I used to be able to verify ANZ Bank cards in Apple Wallet with just SMS but no longer - a phone call is now required, which necessitates full verification using "Voice ID" (which can probably be hacked with AI now anyway...).

That has always intrigued me, as I have had numerous instances of speaking with bank CSR's on the phone and as I have said to them, they have no idea if it's really me. So long as whoever they are speaking to can answer questions, they will proceed with processing the customer's instructions on the basis that they must be speaking to the customer. I upset one CSR when I deliberately gave an incorrect birth date and they accepted it. I had to correct them as they would have proceeded regardless.

I dare say AI voice "imitation" / synthesis is available now, or will be very soon. Some of the AI satire I've watched online has the satire target's voice done so well it actually sounds just like their satire target. I assume they have sampled the target's voice and captured phonemes from which they then synthesize the voice. Another reason to hang up on scammers and not speak to them lest the conversation they desire actually be a deliberate voice sampling exercise.

Banks may well have to return to bricks and mortar branches instead of continuing with closing them, as evolving technology makes it easier to impersonate people online who are not standing physically in front of you.

1 | 2