Could a contactless card reader steal money from my locked iPhone?

(Image credit: Getty)

published 1 October 2021

Researchers in the UK have demonstrated how hackers could steal money from your Visa card using Apple Pay Express Transit mode. This mode allows your card to be accessed without having to use Face ID or your passcode and is designed to allow users to effortlessly pass through transit gates, such as those on the London Underground and the New York City subway, which allow contactless pay via a credit card.

Apple Pay has been considered to be resilient to hackers, as it uses a token account number for purchases rather than your actual credit card number and requires your Face ID on an iPhone to pay, or a double tap on an Apple Watch. The Express Transit mode allows the iPhone to bypass this second phase of security by broadcasting a signal to the iPhone.

By replicating that signal, the researchers were able to obtain the card data to make payments on regular contactless card machines. They were also able to bypass the low payment limit set for contactless payment. However, this was only possible when a Visa card was tied to the Express Transit account – when a Mastercard was used, it didn’t work. It also didn't work when using a Visa card on a Samsung phone.

The research is summarized on a new website, which explains the findings of the test. It advises iPhone users to 'not use Visa as a transport card in Apple Pay.' It also states that 'if your iPhone is lost or stolen, activate the Lost Mode on your iPhone, and call your bank to block your card.'

There is good news though. Firstly, even if you have a Visa card on your Apple Pay, you need to manually activate the Express Transit mode for this to be possible – it’s turned off by default. The second is that this danger is theoretical and hasn’t been happening in the real world (as far as we know).

Also, now that this information is widely known, we can expect a solution to stop this happening – either from Visa or from Apple. And in the meantime, Visa offers zero-liability protection for any unauthorized payments.

How to turn off Express Transit mode

If you want to make sure your card can’t be accessed, on your iPhone, go to Settings>Wallet & Apple Pay and click on your Visa card. In the card information you will see an option for Express Transit. Click this and select None.

TOPICS

As T3's Editor-in-Chief, Mat Gallagher has his finger on the pulse for the latest advances in technology. He has written about technology since 2003 and after stints in Beijing, Hong Kong and Chicago is now based in the UK. He’s a true lover of gadgets, but especially anything that involves cameras, Apple, electric cars, musical instruments or travel.