Mobile Wallet Push-Provisioning Scams

A mobile-wallet push-provisioning scam is a card-fraud technique that ends with your card living inside a digital wallet — Apple Pay or Google Pay — on a criminal's phone, spending your money by tap-to-pay. It has two stages. First the scammer obtains your card number, usually through an earlier phishing message, a fake retailer checkout, or breach data. Adding a card to a wallet then triggers your bank to send a one-time provisioning code to confirm the cardholder approved it — and that code is the whole game. So the scammer calls or texts posing as your bank's fraud department, claims suspicious activity, and asks you to "confirm your identity" by reading back the code that just arrived. The distinction that matters most is what that code actually authorises: it is not a login code or a transaction you are cancelling, it is your explicit permission to enrol your card in someone else's wallet. Once you read it out, the card is provisioned on the scammer's device, and every tap they make is treated by your bank as a genuine, cardholder-approved payment.

The attack chains two frauds. In the setup phase the scammer harvests card details — long number, expiry, and often the security code — from a phishing site, a spoofed delivery or bank text, or purchased breach data. They then begin adding the card to a wallet on their own phone. At that moment the bank generates a provisioning one-time code and sends it to you, the real cardholder, by SMS, email, or in-app message, to verify the enrolment. The scammer needs that code within minutes, so a call or text arrives almost simultaneously, timed to the code's delivery. Posing as the bank's fraud team, they describe an alarming but fake problem — a blocked transaction, or an attempted wallet setup "we need you to deny" — and instruct you to read back the number to verify your identity or cancel the charge. The framing inverts reality: reading it back completes the enrolment rather than stopping it. With the card now provisioned, they spend contactlessly in stores or online, often quickly and across several purchases, before you notice charges you never made on a card still physically in your pocket.

The scam exploits a genuine but unfamiliar security step. Most people have never added someone else's card to a wallet and don't know that a provisioning code even exists, so they can't recognise what they are approving. The code arrives from the bank's real number and carries real bank wording, which makes the follow-up "fraud department" call feel corroborated rather than suspicious. Urgency does the rest: a warning that your account is under attack pushes you to cooperate fast, and reading a number back feels harmless — passive, not like sending money. Crucially, the victim's own card never leaves their wallet, so nothing looks stolen, and the eventual charges are authorised transactions the bank initially treats as legitimate, which delays detection and complicates the dispute.

This is the fraud team at your bank. We've blocked an attempt to add your card to a wallet. To deny it, please read back the 6-digit code we just sent.

Security alert: a mobile wallet setup was requested on your card. Reply with the verification code now to cancel this request.

To confirm your identity and release the hold on your account, read me the code that arrived on your phone in the last minute.

We're seeing suspicious activity. Do not ignore the code we sent — read it to the agent now to protect your account.

Read the code's own message before you speak. Bank provisioning texts state plainly what they authorise — usually something like "use this code to add your card to Apple Pay / Google Pay" or "to set up a mobile wallet". If a caller is asking you to read back a code whose own text describes adding a card to a wallet, that caller is enrolling your card on their device, full stop. No genuine bank ever needs you to read a code back to them; codes are for you to enter yourself, never to recite to an inbound caller. Hang up on anyone pressuring you, then call your bank on the number printed on your card and ask directly whether any wallet-provisioning attempt is on your account. Treat the coincidence of a code and a simultaneous "fraud department" call as the scam itself, not two unrelated events.