How stolen Apple IDs allow hackers to steal money in Alipay and WeChat

iPhone users say their funds were used for unauthorized digital purchases

Reading Time:2 minutes

How stolen Apple IDs allow hackers to steal money in Alipay and WeChat

Published: 6:45pm, 12 Oct 2018Updated: 8:42am, 20 Sep 2019

This article originally appeared on ABACUS

WeChat Pay and Alipay have confirmed that the digital wallets of some iPhone users were stolen to buy games and other items from Apple’s App Store.

Chinese media say the breach affected at least 700 users in China, with some reporting losses of up to hundreds of US dollars. Victims say they’ve been receiving notifications at odd hours of the day, alerting them about transactions they don’t recognize.

Here’s how it happened.

In China, WeChat Pay and Alipay are included as payment options in Apple’s iTunes and App Store -- the same way that PayPal and credit cards are elsewhere in the world.

Alipay and WeChat Pay are so ubiquitous in China that Apple has chosen to include them as a payment alternative to credit cards.

That means once you select WeChat Pay or Alipay as your default payment method, money will automatically be deducted for purchases made via Apple ID -- whether you’re buying music, movies or apps.

Both Chinese companies say hackers are making unauthorized purchases through stolen Apple IDs. It’s unclear how they managed to steal the IDs in the first place, but Alipay said it’s asked Apple “many times” to look into how the thefts occurred, and WeChat also says it has been in contact with Apple. Apple did not immediately respond to our request for comment.