How a Locked iPhone Gave Up Ten Thousand Dollars in Seconds

Derek Muller from Veritasium collaborated with Marques Brownlee on a wild experiment. They wanted to try draining money from a fully locked iPhone with nothing but a tap and some flashy, yet relatively clever, equipment. Marques plugged his phone into a little reader that was connected to a laptop. The screen stayed dark and locked the entire time, showing no signs of life. Then, a few seconds later, the first charge arrived for $5. They kept going, increasing the amount until they had siphoned off a total of $10,000.

Marques left his phone on and it remained connected to Apple Pay. His Visa card was set to express transit mode, which allows users to just tap and go on buses or trains without having to authenticate each time they travel. It’s designed this way so you can pay quickly without fiddling with your phone. The setup went like this: one piece of equipment read the signals sent from the iPhone. A laptop then gathered all of the information and transferred it to another device. That device then pretended to be a legitimate payment terminal, good for a rapid transit fare, and voila, the actual terminal got the message. This succeeded because Visa processes transit payments with less checks on the total amount. Apple Pay transactions are generally limited to low values unless you confirm the charge, but transit taps are an exception, as they forgo that extra step in favor of speed.

They performed a dry run to ensure that everything was working properly, sending in a little charge to see if it would pass through. Sure enough, $5 appeared on Marques’ phone, indicating that he had received the message, but he never touched the screen. Then they increased the quantity. Each one followed the same path, but with increasing sums. The phone replied automatically due to express transit mode, which kept the near-field communication channel open. The Visa system recognized this as a legal transit activity, and the cash cleared without hesitation. After a few more runs, $10,000 disappeared.

It’s worth mentioning that only Visa cards are now susceptible to this technique. Mastercard and American Express are not fooled, as their regulations prohibit this specific sequence. To add to the difficulty, Apple Pay requires the phone to be in Express Transit mode for it to work. If you turn it off, the trick will stop working immediately. Physical touch is important here because the reader must be quite close to the phone for several seconds. Nothing travels over the internet or through the air from a distance.

Apple claims the issue is with how Visa handles transit transactions. Visa maintains that this staged scenario is not something that the average person will ever encounter, and don’t forget that Visa has a zero liability policy, so if you do receive an unauthorized charge, you can dispute it immediately. Both companies also stress that the demo required some rather specialized hardware and knowledge.