Viral video shows how your locked iPhone could still be used to drain your account with Apple Pay

A viral video shows exactly how a locked iPhone can still get drained through Apple Pay without the owner unlocking it or approving anything.

YouTuber MKBHD (Marques Brownlee) set his phone down on a regular payment terminal. It stayed completely locked the whole time. Seconds later, a $10,000 charge cleared anyway. He never entered a passcode or saw a single verification prompt.

The clip comes from Henry Reich at Veritasium. He brought in two cybersecurity professors from the University of Surrey, Ioana Boureanu and Tom Chothia, to walk through the attack step by step. They built the whole thing live on camera using off-the-shelf NFC gear and a simple man-in-the-middle setup. The full video is right here.

What’s more concerning is that this is not some brand-new discovery. The same researchers told Apple and Visa about the vulnerability back in 2021. Five years later, it still works on the right iPhone and card combo.

The trick leans on Apple’s Express Transit mode. That feature lets you tap and ride the subway without unlocking your phone. The professors figured out how to fake the signal a subway gate sends so the iPhone thinks it is paying for a cheap transit fare instead of a $10,000 retail purchase.

From there, they flip two tiny bits in the transaction data flying between the phone and the terminal. One bit tells the iPhone that the huge amount is actually low value. The other tells the terminal that the user has already verified everything. The phone and the reader never realize they are being fed lies.

So you have to keep in mind that it only works on iPhones with a Visa card set as the default transit option in Apple Wallet. Samsung phones check the actual dollar amount and block it. Mastercard runs an extra signature check that kills the attack. Visa does not always require that step when the terminal is online.

Apple sent Veritasium a statement saying the problem lies with Visa’s system. Visa replied that the attack is unlikely outside a lab and reminded everyone of its zero-liability policy that covers disputed charges. Neither company has rolled out a software fix.

If you want to be safe, you can open Apple Wallet, remove any Visa card from the Express Transit slot, or turn the whole mode off. The setting flips on automatically once you add a compatible card.

Most victims would probably get their money back after filing a dispute. That does not make the surprise hit any less annoying. Watching $10,000 vanish while your phone sits in your pocket is the kind of thing that sticks with you even after the refund lands.

Featured image credit: Veritasium / YouTube

We stand out from the tech-media crowd because we break news stories; we mainly bring you stuff that you won’t find anywhere in the mainstream tech media. Our stories have been picked up by some of the world’s most popular websites and media outlets—more info is available here.