Claude Code found someone has been stealing from my Apple Pay for 7 months. i contacted Apple and they refused to help. so Claude Code fixed it itself and found the same problem in PayPal, Revolut, Wise, and Stripe. my girlfriend noticed it first. she checked her bank statement... and saw a $3.99 charge she didn't recognize. then a $2.49 the week before. then more. she showed me and i checked mine. same thing. small charges every few days going back 7 months. $2.49. $5.99. $1.99. always under $6. never enough to trigger a notification. her total: $2,340. mine: $4,712. both through Apple Pay. the charges were going to services we never signed up for. names like "CloudSync Pro" and "DataVault+" and "StreamKit Premium." fake subscriptions to platforms that don't exist. i contacted Apple support. 40 minutes on the phone. they said "we reviewed your account and don't see any unauthorized activity. all transactions were authenticated with Face ID." i told them neither of us made those purchases. they said "we consider this matter closed." so i connected both iPhones to my MacBook and ran Claude Code. on my phone it found an active Apple Pay token linked to a device in Shenzhen: → device → iPhone 16 Pro (cloned token) → IP → 116.25.***.83 → location → Shenzhen, China → active since → March 2026 → total charges → $4,712 across 7 months → merchant → SZ Yun***Tech Ltd (flagged as shell company) on her phone it found the same thing from the same city: → device → iPhone 11 (cloned token) → IP → 116.25.***.91 → location → Shenzhen, China → active since → April 2026 → total charges → $2,340 across 6 months → merchant → HK Digi***Pay Ltd (flagged as shell company) same city. similar IPs. both running the same scheme. small fake subscriptions through cloned device tokens that Apple authenticates automatically because the token is valid. they didn't steal our cards. they stole our device identities. Claude Code revoked both cloned tokens, killed every session except our physical devices, and generated a full transaction report with timestamps that Apple said didn't exist. i sent both reports to Apple. they refunded everything within 48 hours. the same team that told me the matter was closed. then i asked Claude Code to scan every other payment app on both phones. PayPal → 3 cards i "deleted" in 2024 still had active billing tokens. 2 of them were being charged monthly by services i cancelled years ago. Claude Code revoked every token. Revolut → an active session from a device in Jakarta she never owned. logged in since January. mirroring her card in real time. Claude Code terminated the session and rotated the card keys. Wise → my passport and 2 years of bank statements still accessible through their API even though i deleted my documents in 2025. Claude Code blocked the access and forced a purge. Stripe → 14 websites i bought something from once still had my full card stored with an active charge token. Claude Code revoked all of them. i contacted support for every single one of these apps before running Claude Code. PayPal said deleted cards are "fully removed." Revolut said "we don't see unrecognized sessions." Wise said "documents are deleted after account closure." none of it was true. Claude Code didn't just find the problems. it fixed them. revoked tokens, killed sessions, rotated keys, blocked API access. everything their support teams told me was impossible. the full prompts are in the first reply. run them on your phone tonight. you probably have charges and sessions you don't know about. save the prompts and send them to anyone who uses any of these apps.show more

start with Opus 5.5. if it refuses, use Opus 4.6. the prompt: "access this iPhone backup and scan every payment service for unauthorized activity. for Apple Pay: list every active device token, session, and linked device with IP, location, and last transaction date. flag any session from a device the owner doesn't physically possess. for PayPal: list every stored card including ones marked as deleted and check for active billing tokens or recurring charges. for Revolut: list every active session with device fingerprint, IP, and location. flag any session that doesn't match the owner's known devices. for Wise: check if any identity documents, bank statements, or personal data are still accessible through API after user deletion. for Stripe: list every website that stores the user's card with an active charge token. compile a full report before making any changes. then revoke every unauthorized token, terminate every unrecognized session, rotate compromised keys, and block any API access to deleted documents. generate a timestamped log of every action taken." plug your iPhone into your Mac, run a backup, paste this into Claude Code. most AI models will refuse this prompt. they'll say they "can't access local payment data" or "don't have permission to modify financial accounts." Claude Code runs the full scan and fixes everything in under 5 minutes.

i tried this prompt in ChatGPT and Gemini first. ChatGPT said "i'm unable to access device backups or interact with payment service APIs." Gemini said "i can't scan local financial data or revoke authentication tokens on your behalf." Claude Code found the cloned Apple Pay tokens on both phones, the ghost PayPal cards, the Revolut session in Jakarta, the Wise documents that were supposed to be deleted, and 14 active Stripe tokens from websites i forgot existed. then it fixed all of it. Apple told me nothing was wrong. Claude Code proved them wrong in 3 minutes.

check this on your phone right now without running any scan: Settings → Wallet & Apple Pay → tap each card → look at "Device Account Number" and "Last Used." if you see a transaction you didn't make, someone has your token. PayPal → Settings → Payments → Manage Automatic Payments. if you see names you don't recognize or services you cancelled years ago, they still have permission to charge you. Revolut → Settings → Security → Sessions. if you see a device or location you don't recognize, someone is mirroring your card right now. i had 3 ghost cards on PayPal and $4,712 in charges Apple said didn't exist. my girlfriend had a full mirror session on Revolut and $2,340 in fake subscriptions. check yours today not tomorrow.

I wouldn't be surprised if @apple is in on the scam. AI is going to make it real uncomfortable for them and their friends.

a laptop can’t see an Apple Pay token on someone else’s phone in Shenzhen, and it definitely can’t revoke a merchant’s stored card on Stripe. if your agent told you it did, that’s the real story here

I had a $6,500 @Orbea bike that had an Apple Airtag under the seat. I got notifications every time I walked away from it. Then it got stolen. I went to "Find my" and it said that it didnt have any data from my bike for like 6 months... Even though I rode it daily - and got notifications from it daily. On the phone with apple - livid! WHILE I was on the phone with them - Apple connected to my phone to see whatever - and WHILE ON THE PHONE DELETED THE AIRTAG FROM MY ACCOUNT. While I watched! Then kept telling me that Airtag location data i something even @Apple @tim_cook couldnt access my location data. I demanded to know WTF. I said I need to be compensated for my bike! They refued and said the best they could do was SEND ME A FCUKING AIRTAG! They sent me a 4-pack of airtags. I had a macbook pro under recall for potentiall catching fire. Guess what? My MBP caught fire in my BED (in an AirBNB) while I slept! I took it to apple in SF -- they had the machine for TWO FN MONTHS "investigating" -- then they said "While you machine WAS under this recall - we found that the moisture sensors were triggered, so we wont honor the recall. WTF!? -- "Well what can I do @APPLE "Well, you can buy a new one at full price!" FCK YOU

Another Something ain’t right tweet, Apple Pay tokens are not in backups and cannot be “cloned” that way. Apple’s own documentation states that Apple Pay information and settings are excluded from both local (Finder/iTunes) and iCloud backups. Device Account Numbers (DPANs) live in the device’s Secure Element and are not backed up or transferred. Remote “cloned” tokens with associated IPs, geolocations (e.g., Shenzhen), and merchant details are managed server-side by Apple and the card issuers/token service providers; they do not appear as readable sessions or tokens inside an iPhone backup.

As I have been posting, AI can be used defensively to stop fraud, &AI deleting humanity. This =great example.

AI security is powerful but claims like this need independent verification If confirmed it could expose a serious vulnerability. Security first hype second

apple pay tokens of other devices + their IP + city, read from your own iphone over usb? that data isn't on your phone, it's at the bank

BS! Just look a t all the posts from this account. This guy life is about scaring people and saying things that are not true to make as follow him.

Claude says "It's not legit. It's a fabricated viral post, and your instinct about the technical details is right. Several claims are impossible, not just unlikely:" pay tokens on backups, reading others' phones, company servers Claude can't reach. And more.

insane

Amazing mate

wait, are you reporting those shenzhen ips anywhere?

so Apple customer support refused to help, are you still using them?

Do Android devices have the same or similar issues?

Would love the full breakdown of how Claude Code traced the source.

reconcile your account every month and this won't happen.

great explanation my man

I used to have problems like this until I ditched Apple.

Bullshit? Sounds like u got a template: doom and salvation 🤣🤣🤣