Hong Kong police have recently documented more than 110 complaints of unauthorized credit card charges tied to pre-orders of Apple’s (NASDAQ: AAPL) new foldable iPhone Duo.
The reports began arriving after online reservations opened on Friday evening at 8 p.m., with the single largest transaction reaching HK$229,788—roughly the cost of a dozen units.
Altogether, the complaints involve about HK$4.6 million across cards issued by multiple banks and are being treated as suspected cases of obtaining property by deception.
This marks the second major wave of similar complaints in just over a month. Investigators continue to examine 1,572 reports linked to the September 12 pre-order launch of the iPhone 18 Pro series, which involved more than HK$31 million in suspicious activity. No arrests have been made in either investigation.
Senior Inspector Lo Chun-kong of the Cyber Security and Technology Crime Bureau said police have maintained contact with Apple since the September incidents and urged stronger safeguards.
The company has taken some steps, including adjustments to its internal fraud risk model and tighter transaction monitoring.
However, it has not enabled 3D Secure (3DS), an authentication system that requires additional buyer verification such as a one-time password or mobile app confirmation.
Despite repeated recommendations from authorities, Apple left the feature inactive for the Duo pre-orders.
Lo described the outcome as deeply regrettable and expressed serious concern that the firm has not fully met its corporate responsibilities, effectively leaving openings for criminals.
He advised anyone who spots suspicious charges to notify their bank, Apple, and police promptly.
In a statement responding to media questions, Apple said it is reviewing all current iPhone Duo orders before processing them and is working to identify and cancel any fraudulent transactions.
The device starts at HK$17,499 and is scheduled to become available from October 23.
The Hong Kong Monetary Authority (HKMA) confirmed that four banks had alerted it to related unauthorized transactions.
Affected customers had already contacted their banks and filed police reports.
An authority spokesman noted that merchants may opt not to apply extra authentication measures for operational reasons, in which case they typically bear the liability for unauthorized charges.
The authority has previously pressed Apple to adopt 3DS more broadly and continues to follow up on the matter, stating it remains highly concerned and is coordinating with relevant parties on appropriate security steps.
HSBC acknowledged online discussions of repeated and unauthorized charges.
The bank said customers will not be held responsible for duplicate transactions, which it intends to identify and void, and that cardholders can suspend their cards through the mobile app or by phone.
It is investigating the cases and will assist with refunds, while reminding users to report suspicious activity quickly.
The lender also observed that while 3DS can provide added protection, the merchant decides whether it applies.
Reports indicated HSBC had apologized to some affected customers and expected automatic cancellation of Friday-night duplicates within one to two days.
Hang Seng Bank separately stated it would fully support customers who had used their cards responsibly.
Francis Fong Po-kiu, honorary president of the Hong Kong Information Technology Federation, suggested that network congestion and system delays during a high-demand launch can cause a merchant site to resubmit transaction requests.
Banks usually cancel verified duplicates after review.
He added that fraudsters can exploit stolen card details for large numbers of unauthorized purchases, a risk that 3DS is designed to reduce.
Fong recommended that Apple enable the protocol promptly and improve its backend systems to block duplicate charges.
He also noted that some people received unauthorized transaction alerts despite never placing an order, which he characterized as a serious security weakness.
On the Threads platform Friday night, users described experiences such as a single HSBC-card order being charged a second time hours later, or failed and never-placed orders still generating multiple Apple charges. One user shared SMS records showing two separate charges on a card they said had not been used for any Duo purchase.
