Ok, this was weird. Wife got email about her Apple ID password being reset at 18:07 (when she was in a store, phoning me).At 21:29 she she got an email about a new subscription in an app she hadn’t heard of. We were watching TV at the time; she definitely didn't order the subscription since she hadn't even heard of the app.We checked, and was installed today on her phone (she didn’t do it).We immediately cancelled the subscription, reset her Apple ID password and installed the iOS 14.4 update (she was on 14.3).This shouldn’t be possible, so how did it happen? Some fraud scheme using iOS bugs to force-install apps and start subscriptions? Is that even something that happens? Has anyone else seen something like this?