# Can you steal $10,000 from a locked iPhone?

Source: https://www.youtube.com/watch?v=PPJ6NJkmDAo
Recap page: https://rapidrecap.app/video/PPJ6NJkmDAo
Generated: 2026-04-15T17:33:03.362+00:00

---
## Quick Overview

A locked iPhone can be used to steal $10,000 by exploiting a vulnerability in Apple Pay's 'Express Transit' mode, which allows transactions to proceed without unlocking the device or requiring biometric authentication. By using a Proxmark device to simulate a transit terminal and a laptop to modify the transaction's data fields, hackers can trick the iPhone into authorizing a high-value purchase as a low-value transit fare, bypassing security protocols.

**Key Points:**
- A locked iPhone authorizes a $10,000 transaction by misidentifying a retail payment terminal as a transit reader.
- Apple Pay's 'Express Transit' mode intentionally bypasses Face ID and passcode requirements to facilitate quick transit fare payments.
- Attackers use a Proxmark device to broadcast a transit terminal signal, causing the iPhone to enter an insecure transaction state.
- A custom Python script running on a laptop modifies the transaction data, flipping bits that tell the iPhone the transaction is low-value and transit-related.
- The attack succeeds because the iPhone does not verify the actual dollar amount of the transaction, only its classification as low or high value.
- Visa's payment system is susceptible to this exploit because it does not always require the same level of asymmetric cryptographic verification for transit transactions as it does for retail purchases.

![Screenshot at 11:42: The point of failure where the iPhone authorizes a $10,000 transaction without requiring any user input or biometric authentication.](https://ss.rapidrecap.app/screens/PPJ6NJkmDAo/00-11-42.jpg)

**Context:** The video demonstrates a sophisticated man-in-the-middle attack developed by cybersecurity researchers Ioana Boureanu and Tom Chothia from the University of Surrey and the University of Birmingham. The researchers highlight a flaw in the implementation of contactless payments on iPhones, specifically when using Visa cards, which allows for unauthorized transactions even when the device is locked.

## Detailed Analysis

The video details a successful $10,000 theft from a locked iPhone, made possible by a design flaw in Apple Pay's 'Express Transit' feature. By tricking the phone into believing a retail payment terminal is a transit reader, the attack bypasses the need for Face ID or a passcode. The process involves three distinct 'lies' or manipulations: first, the iPhone is convinced it is interacting with a transit terminal; second, the transaction is falsely labeled as a low-value fare; and third, the reader is tricked into believing the customer has already verified the transaction on their device. Because the iPhone does not verify the actual monetary amount of the transaction, it authorizes the payment. This vulnerability is specific to Visa cards, as Mastercard requires more stringent asymmetric cryptographic checks that would detect the data tampering. Visa has stated that such fraud is unlikely in real-world settings and that cardholders are protected by zero-liability policies, yet the researchers emphasize that the underlying technical vulnerability remains unpatched.

### The Anatomy of the Attack

- Proxmark device simulates a transit terminal
- Laptop runs Python script to modify transaction data
- Phone is tricked into authorizing high-value payment as low-value transit fare

### Security Layers Bypassed

- Apple Pay Express Transit mode skips biometric authentication
- Device is tricked into accepting transaction without user intervention
- iPhone fails to verify actual monetary value of the request

### Why Visa is Vulnerable

- Visa's verification process relies on symmetric cryptography in transit settings
- Mastercard uses asymmetric cryptography that detects data tampering
- Vulnerability exists due to lack of end-to-end verification of transaction details

![Screenshot at 05:07: The Proxmark device used to broadcast the false transit terminal signal to the iPhone.](https://ss.rapidrecap.app/screens/PPJ6NJkmDAo/00-05-07.jpg)
![Screenshot at 07:33: The critical binary code modification that changes the transaction from high-value to low-value.](https://ss.rapidrecap.app/screens/PPJ6NJkmDAo/00-07-33.jpg)
![Screenshot at 11:24: The final step where the laptop flips the authentication bit from 0 to 1, tricking the phone into approving the transaction.](https://ss.rapidrecap.app/screens/PPJ6NJkmDAo/00-11-24.jpg)
![Screenshot at 20:33: The final receipt confirming a successful unauthorized transaction of £180.00.](https://ss.rapidrecap.app/screens/PPJ6NJkmDAo/00-20-33.jpg)