Home / Shopping / Stop wallet scams
Scams & security · Updated 20 October 2026
How to stop scammers adding your card to Apple Pay or Google Wallet
General information only. This isn't legal or financial advice and doesn't take your objectives, financial situation or needs into account. SavySaver has no affiliate, referral or commission links on this page. See our disclosures.
Criminals can't usually add your card to their phone without a one-time code your bank sends to you. Almost every wallet scam is about getting that code. Know what a wallet code looks like, never hand it over, switch on your bank's alerts and app approvals, and check which wallets your card is linked to.
Step 1
Read the code message
If it mentions adding a card to a wallet or new device and you aren't doing that, stop. It isn't for "verifying a payment".
Step 2
Never share a code
Not with a caller, not with a website you reached from a text. Banks warn they won't ask for it.
Step 3
Turn on alerts
Use your bank app's notifications, wallet alerts and in-app approvals, and check linked wallets.
How the code trick works
A text says you owe a toll, a parcel fee or a fine (Linkt; Australia Post; ACMA). You enter your card details on a fake page. Behind the scenes, the phishing kit tries to add your card to a wallet on the criminal's phone, your bank sends a genuine code, and the fake page asks you to type it in "to verify the payment" (Krebs on Security). The phone-call version is a fake bank "fraud team" asking you to read out the code (Scamwatch).
UK Finance names codes socially engineered "to register digital wallets" as a leading cause of card fraud in the UK (UK Finance). In Australia, phishing losses reported to the National Anti-Scam Centre and partners were $97.6 million in 2025 (National Anti-Scam Centre).
Rules for one-time codes
- Read the whole message before using a code. A code to add a card to Apple Pay, Google Wallet or "a new device" is never for a toll, parcel or refund.
- Never read a code out to anyone. Hang up and call the bank yourself on the number on your card or in the app (ANZ; CommBank).
- Only enter a code for a payment you started on a site you typed in or opened from the official app.
- Don't pay tolls, fines or parcel fees from a text link. Open the official app or website instead.
Bank app settings to switch on
- Push notifications and in-app approvals. NAB recommends app notifications over SMS (NAB). CommBank verifies some online card transactions in its app rather than by SMS code (CommBank 2025).
- New-wallet alerts. CommBank alerts customers when a card is added to a new digital wallet (CommBank 2024). Check whether your bank offers the same and make sure notifications are on.
- Review linked wallets. CommBank's "Review digital wallets" feature shows which wallets your card is in (CommBank). Look in your own bank's card settings for something similar and remove anything you don't recognise.
- Card lock and transaction alerts. Turn on alerts for every card transaction or for amounts over a small threshold, so you spot fraud early.
Banks name and change these settings often, so check your own bank's app and security page rather than relying on a screenshot.
Protect your phone number
If a criminal takes over your number (a SIM swap or port-out), they receive your codes. Australian telcos must use stronger identity checks before porting numbers and for high-risk actions like SIM swaps (ACMA). Set a PIN or password on your mobile account and act fast if your phone suddenly loses service.
Why wallets are still worth using
Visa says tokenised credentials have a 39.4% lower fraud rate than non-tokenised ones (Visa). The weak point isn't the wallet; it's the enrolment step, which is exactly where the code rules above protect you.
If it's already happened
Go straight to our first-hour checklist.
Related guides
- Someone added your card to their phone wallet: what to do (how the scam works and your refund rights)
- Card in a scammer's wallet: your first hour
- Cyber and scam insurance in Australia compared
- Does cyber insurance cover scams?
Sources (checked 20 Oct 2026)
- Krebs on Security: Lighthouse phishing kit · UK Finance: Annual Fraud Report 2026 press release · National Anti-Scam Centre: 2025 scam losses
- Linkt: latest scams · Australia Post: scam alerts · ACMA: SMS impersonation scams · Scamwatch: bank impersonation alert
- ANZ: digital wallets · CommBank: digital wallet scams · CommBank newsroom Nov 2024 · CommBank newsroom Aug 2025 · NAB: SMS security
- ACMA: customer identity authentication rules · Visa: tokenization
Questions
Why does my bank text me a code when I add my card to a wallet?
Banks send a one-time code to check that the real cardholder is adding the card to a new device. Scammers try to get that code from you so the card is added to their phone instead.
Is it safe to type a code into a payment page?
Only if you started the payment yourself on a website you typed in or opened from the official app, and the message clearly describes that payment. If the message mentions adding a card to a wallet or device, stop.
Would my bank ever ask me to read out a code?
Scamwatch warns that scammers impersonate banks by phone and text and ask for codes. If someone asks, hang up and call your bank on the number on your card or in its app.
Are digital wallets unsafe?
No. Visa says tokenised credentials have a lower fraud rate than non-tokenised ones. The risk is the moment a card is added, when a scammer tricks you into handing over the code.