Authorities in Hong Kong are investigating a sharp increase in suspicious credit card transactions linked to pre-orders of Apple’s new iPhone 18 Pro models, with losses reaching approximately HK$25 million. As of 5 p.m. on Monday, police reported 1,209 unauthorized transactions, up from around 700 the previous day, involving cards issued by multiple banks.

The surge emerged shortly after Apple launched pre-orders for the iPhone 18 Pro series on Saturday, prompting widespread reports on social media of unauthorized charges. Police have been coordinating with affected banks and Apple to address the issue.

Chief Inspector Chan Lai-yu of Hong Kong’s Cybersecurity and Technology Crime Bureau said initial investigations found that the online pre-order process did not require a one-time password (OTP) via SMS or any other form of authentication. This vulnerability allegedly allowed fraudsters to complete transactions without cardholder consent.

Authorities are examining whether the credit card details used in these transactions were obtained through prior data breaches, phishing scams, or shared on public platforms. Investigators continue to trace the digital footprints of suspects involved in the fraudulent orders, which have been classified under the offense of “obtaining property by deception.”

An Apple representative confirmed the company was reviewing all pending orders and working to swiftly identify and cancel those found to be fraudulent.

Legislator Johnny Ng Kit-chong commented on the situation, suggesting Apple holds ultimate responsibility for the incident while noting that the actual financial impact might be limited. Ng described the incident as unusual due to the high number of victims and the involvement of a major corporate platform. He speculated that hackers may have accumulated stolen credit card information over time, awaiting an opportunity to exploit it. Ng further suggested that Apple might have temporarily disabled multi-factor authentication for credit card transactions to maintain website stability amid high traffic, potentially enabling the fraud.

Some affected users reported that a single order attempt resulted in multiple unauthorized orders being placed. Ng attributed this to possible technical glitches on Apple’s platform rather than further credit card compromises. He emphasized that Apple should bear responsibility for any resulting losses, although he anticipated that most funds remained withheld since products had yet to be shipped.

Leading banks in Hong Kong reassured customers on Sunday that victims would not be held liable for unauthorized transactions once confirmed. Meanwhile, Francis Fong Po-kiu, honorary president of the Hong Kong Information Technology Federation, urged the public to remain vigilant against follow-up scams. He warned that fraudsters, likely in possession of personal details such as phone numbers and partial credit card information, might impersonate banks or law enforcement agencies, attempting to deceive victims into divulging additional data or authorizing false refunds.

The Hong Kong police continue their investigation as authorities work to assess the full extent of the breach and prevent future misuse.