PanicStation.org
UK USA
us Money & financial emergencies

What to do if…
you get a notification that your card was added to a digital wallet you do not use

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy USA guide

Short answer

Do not approve anything or share any code. Lock the card if you can, then contact your card issuer using the number on the back of the card, the issuer’s official app, or the issuer’s official website.

Do not do these things

  • Do not tap links in the notification, email, or text.
  • Do not call a phone number provided by the text, email, notification, or caller.
  • Do not share verification codes, one-time passcodes, password reset links, or “approve” prompts with anyone who contacted you.
  • Do not keep using the card normally until the issuer confirms what happened.
  • Do not assume it is harmless because the message only shows the last four digits of the card.
  • Do not delete the alert before you have saved the basic details.

What to do now

  1. Check through a route you trust.
    Open your card issuer’s official app or type the issuer’s website address yourself. Look for security alerts, pending wallet approvals, connected wallets, device entries, token entries, or virtual card entries if your issuer shows them. If there is an approval request and it was not you, decline it.

  2. Lock or freeze the card immediately.
    Use the issuer app if that option is available. If not, call the number on the back of the card and ask for the fraud department.

  3. Tell the issuer exactly what happened.
    Say: “I received a notification that my card was added to a digital wallet I do not use.” Ask the issuer to:

    • block or lock the card while they investigate
    • remove or disable any wallet token, device-specific card number, or virtual card number for that card
    • confirm whether a wallet verification happened and how
    • reissue the card with a new card number if the card details may be compromised

  4. Review recent and pending transactions.
    In the issuer app or website, check recent charges, pending charges, small test charges, and card-not-present purchases. Report anything unfamiliar through the issuer’s fraud or dispute process.

  5. Secure the account named in the alert.
    If the alert mentions Apple Pay or Apple Wallet, go through official Apple Account settings, change your Apple Account password, review trusted devices, and remove anything you do not recognize.
    If the alert mentions Google Wallet or Google Pay, go through official Google Account settings, change your Google Account password, review signed-in devices, and sign out of anything you do not recognize.

  6. If you shared a code or approved a prompt, say so clearly.
    Tell the issuer: “I shared a verification code” or “I approved an add-to-wallet request,” if that happened. Ask them to cancel wallet access for the card and issue a new card number.

  7. If this may be broader identity theft, take one official step.
    Use IdentityTheft.gov to start an identity theft report and recovery plan. If you think someone may try to open new credit in your name, consider a credit freeze with Equifax, Experian, and TransUnion, or place a fraud alert; an initial fraud alert can usually be started by contacting one of the three credit bureaus.

  8. Make a short record.
    Write down the date and time of the notification, the wallet named in it, the last four digits shown, whether you shared any code, and what the issuer said they did.

What can wait

  • You do not need to decide right now whether to close your bank account.
  • You do not need to replace your phone unless there are signs your phone or account was compromised.
  • You do not need to contact every agency at once; locking the card and speaking to the issuer comes first.
  • A police report usually does not need to be your first step unless your issuer, IdentityTheft.gov, or the facts of your situation point you there.

Important reassurance

This alert does not automatically mean all your accounts are compromised. Acting quickly through the issuer can usually reduce the chance of more card activity while the issuer investigates.

Scope note

These are first steps only: stop immediate card use, remove possible wallet access, secure the relevant account, and start an official identity-theft path only if the signs go beyond this card.

Important note

This guide is general information, not legal, financial, cybersecurity, or professional advice. If you are unsure what is real, use the safest route: contact your card issuer through its official app, official website, or the number on the back of your card.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us