Bank of China Mastercard users reported unauthorized overseas transactions starting September 25, 2025. The incidents primarily affected Great Wall Global Mastercard cards, with transactions appearing in Brazil and Uruguay via Apple Pay. One user reported a fraudulent charge of BRL 11,404.68, which was refunded on September 28.
Mastercard confirmed on September 29 that the issue is resolved and cardholder funds are secure. Bank of China representatives stated that the bank is canceling the fraudulent transactions, meaning affected users will not be required to pay these amounts. The bank is currently coordinating card replacements with the impacted customers.
Industry analysts suggest the incident may involve a card-cracking attack where perpetrators generated card numbers based on known patterns and tested them at merchants with low security. A similar wave of unauthorized overseas transactions occurred in September 2025 involving Pudong Development Bank Mastercard cards in Brazil.
In April 2026, Mastercard and NetsUnion Clearing Corporation enabled Apple Pay for cross-border payments on Mastercard-branded cards issued in China. Following the recent events, banks are advising customers to use mobile banking apps to lock cards or disable overseas card-not-present transactions to prevent further unauthorized activity.
