Digital wallets can allow purchases with stolen credit cards

Researchers presented at USENIX Security 2024 show that attackers can add stolen payment card numbers to Apple Pay, Google Pay, and PayPal by forcing banks to fall back to knowledge-based authentication (via call-based flows) and using easily obtainable PII (ZIP, DOB, last 4 of SSN), then exploit banks' token management and recurring-payment handling so the wallet token remains usable after card cancellation; the paper includes tested purchases, disclosure to vendors, and recommended mitigations such as push notifications, stronger authenticators, and improved token/recurring-payment checks.