There is a lot of bad press going around because of fraud related to Apple Pay. The problem is that the bad guys have your credit card info, your address, SSN, date of birth and perhaps even your mother's maiden name. With all that info, the bad guy could also fraudulently purchase online, but Apple is getting heat because they are labeling this "Apple Pay Fraud". This really has nothing to do with Apple. The problem is with the credit card companies and there is a real easy fix for the problem.
When you setup a new credit card on your iPhone, this is the information that has to be entered:
If the bad guy has your name, card number, expiration date and security code - they will be able to start using your credit card from their iPhone (just like they would be able to online as well).
The solution, is to have Apple send the GPS location of where your iPhone is located when you are activating the card. The credit card companies can determine if that address is your billing address and if it is, allow the card to be added to the iPhone. Unless the bad guy is in your house, this solves the fraud problem completely!
This does bring up some inconveniences, like trying to setup a credit card for the first time when you are traveling OR if your billing address is a PO Box, BUT it will eliminate the Apple Pay Fraud issue - which really is more of a credit card fraud issue.