Apple Pay Express Transit Mode Hack: $10K NFC Exploit
During a podcast recording, host Henry watches Marques Brownlee trigger a $10,000 unauthorized purchase with a locked iPhone. The phone sits on a Proxmark NFC device that mimics a payment terminal, allowing the transaction to complete without any password, PIN, or biometric verification. The same exploit was first disclosed in 2021, yet Apple has not issued a patch.
How the Attack Works
The attacker creates a man‑in‑the‑middle chain: a Proxmark intercepts the iPhone’s NFC signal, a laptop rewrites the data, and a burner phone forwards the altered request to a retail reader. The phone believes it is communicating with a legitimate transit terminal, while the reader thinks it is talking to the phone.
The Three Lies
- Express Transit Mode Trigger – The Proxmark broadcasts a specific transit terminal identifier, forcing the iPhone into Express Transit Mode and bypassing the unlock requirement.
- High‑Value Bit Flip – The laptop changes a single data bit that labels the transaction as “low value,” preventing the phone from demanding a PIN or biometric check even for large amounts.
- False Verification Claim – The system modifies the reader’s response to claim that customer verification was performed on the device, satisfying the terminal’s security checks.
Cryptographic Differences Between Networks
MasterCard employs asymmetric RSA signatures for each transaction, which would detect the data tampering introduced by the laptop. Visa, however, does not consistently require such signatures for online transactions, allowing the altered data to pass unchecked. The attack therefore succeeds only with Visa‑issued cards.
Industry Reaction
Apple attributes the vulnerability to Visa’s payment infrastructure, while Visa maintains that the attack is unlikely to occur in everyday use and points to zero‑liability policies that refund affected customers. Experts from the University of Surrey, including Ioana Boureanu and Tom Chothia, argue that relying on statistical fraud mitigation is insufficient; the system should be technically hardened regardless of how rare the exploit appears.
Implications for Mobile Security
The demonstration shows that a locked iPhone can be charged via a payment terminal without any user interaction, exposing a fundamental weakness in Apple Pay’s Express Transit Mode. Although fraud losses average only a few cents per $100 of transaction volume, the ability to siphon thousands of dollars in a single swipe highlights the tension between statistical risk models and the demand for absolute technical security.
Takeaways
- A locked iPhone can be charged via a payment terminal without any user authentication, enabling a $10,000 unauthorized transaction.
- The attack relies on a Proxmark device that tricks the phone into Express Transit Mode and flips a high‑value flag to appear as a low‑value purchase, bypassing PIN or biometric checks.
- Visa’s lack of mandatory asymmetric cryptographic signatures for online transactions allows the data tampering that powers the exploit, unlike MasterCard’s RSA‑based verification.
- Apple blames the vulnerability on Visa’s system, while Visa argues the scenario is unlikely and relies on zero‑liability refunds to protect customers.
- Experts argue that statistical rarity does not excuse the need for technical hardening, because fraud cannot be fully eradicated.
Frequently Asked Questions
How does the Proxmark device enable the Express Transit Mode bypass?
The Proxmark broadcasts a transit terminal identifier that forces the iPhone into Express Transit Mode, which authorizes payments without requiring a PIN or biometric check. By appearing as a legitimate transit reader, it convinces the phone to complete the transaction automatically.
Why does Visa consider the attack unlikely in real‑world settings?
Visa argues that the specific combination of hardware and protocol manipulation required for the exploit is rare and that customers are protected by zero‑liability policies. It maintains that most users will not encounter the precise NFC setup needed to perform the man‑in‑the‑middle attack.
Who is Veritasium on YouTube?
Veritasium is a YouTube channel that publishes videos on a range of topics. Browse more summaries from this channel below.
Does this page include the full transcript of the video?
Yes, the full transcript for this video is available on this page. Click 'Show transcript' in the sidebar to read it.
How the Attack Works
The attacker creates a man‑in‑the‑middle chain: a Proxmark intercepts the iPhone’s NFC signal, a laptop rewrites the data, and a burner phone forwards the altered request to a retail reader. The phone believes it is communicating with a legitimate transit terminal, while the reader thinks it is talking to the phone.
Helpful resources related to this video
If you want to practice or explore the concepts discussed in the video, these commonly used tools may help.
Links may be affiliate links. We only include resources that are genuinely relevant to the topic.