My wife payed £1.99 for some daft personality test with Apple Pay on her phone. A week later another payment was taken for £20, luckily her bank sent a notification of it or she might not have noticed. I didn’t know it was possible to take out an additional payment without Touch ID or Face ID? Anyone else encountered this?