If You Lose Your iPhone, You Can’t Pay Your Apple Card Bill on the Web
buzzfeednews.com
buzzfeednews.com
And you can't at least call the general support number(s) Apple surely posts online?
https://dilbert.com/strip/1995-11-27
or not:
And it's entirely reasonable for Apple to request MFA when you're trying to authenticate using your iCloud credentials.
IMO you are less likely to loose your phone then credit card. We think of actual physical credit card only when we need to pay with it. 99% of the time it is just sitting in the wallet being all useless. Phone is something we are using every 5 min or more so chances are less that one would loose phone like that. Now if you do loose it, and hopefully it is locked then no one can use your card. However one can just cancel the card by calling it from borrowed phone or something like that.
As the article notes, they'll have the option to call in and pay over the phone like many other banks allow. It's not ideal, but it's not the end of the world.
We added an iPad and tried to purchase something, but the only card on file was long since expired and thrown away.
But in order to verify the account we had to enter the card's digits, which we did not have, and we couldn't add a new card because we hadn't verified the old one.
In other words we were stuck. Had to contact Apple support. Took several days to resolve.
What possible security or business justification could exist for that? What does it even mean to 'validate' a card you've been billing successfully for years?
(Spoiler: in case this happens to anyone else, the secret turns out to be disabling family sharing on the account. It will then let you remove the old card and add a new one, after which you can re-enable family sharing.)
I don't have a magic solution but all this using random factoids about us as identity verification seems to be a big hassle.