Getting suspicious messages or spam

Yes, that's a Phishing Scam message, which you are wise to not open or interact with in any way. We ALL get such messages. Don't open it. Delete it and report it as Spam.

You are very lucky if this is the first such message you've ever received.

See this --> https://support.apple.com/en-us/102568

Delete it, and move on with the rest of your day.

Exactly nobody unknown to you is ever going to send an unannounced and context-free VCF vCard Contact card file; to send you what amounts to an electronic business card.

And if they actually do send an unannounced and unexpected VCF from an unknown account, oh well, it got deleted anyway oops sorry my bad.

I have a collection of “Oops, it got deleted.” considerations when reading texts from unknown senders too, as well as spam filtering rules for various spamming, polling, and political keywords using the Bouncer spam-filtering app.

Why might a spammer send a VCF file? Recipient unfamiliarity with the VCF file type, better chances of bypassing carrier spam filters, and bypassing unknown-caller filters if the VCF gets added to Contacts and the scammers then call the recipient, and quite possibly other reasons.

As for the ongoing Apple Pay scam, here’s where that scam diverges from reality, and lies about fraud detection:

• https://discussions.apple.com/docs/DOC-250009890

Haven’t seen or heard of that scam showing up as a VCF file, though. Yet.

This is the first time I've heard of one of these "Apple Pay" messages delivered as a contact card, but it is almost certainly a scam! You were wise not to open it or to add the contact to your Contacts list.

NebraskaLand Bank – That “Apple Pay” Text Warning You About Fraud? It’s the Real Scam

"Your phone buzzes. It’s a text from “Apple Pay” warning that a $159.99 purchase has been paused due to unusual activity. There’s a number to call if you didn’t make the purchase. Your stomach drops, and your thumb hovers over the call button.

Stop right there. That message is fraud, and if you follow its instructions, you could hand scammers direct access to your bank account."

Just because I kept wondering why or how a vCard can be malicious.

Malicious Hyperlinks: A vCard can contain a website field that points to a local or remote executable file rather than a normal web page. In some operating systems or email clients, clicking that link can trigger the download or execution of malicious code.

So, good thing you didn't double-click the file.

While it's possible to be something else, a .vcf file is normally a vCard. It's what you'd get if you highlighted one or more contacts in your list and exported them.

Why any scammer would want you to import a contact, or what good that could possibly do, I don't know. But as lobsterghost1 said, ignore and delete.

Yea this is the first one I’ve seen. Ans thanks for the info. I wouldn’t dare open or click it till I find out what it was. Will delete and report. Ty!