We Took $10,000 From @mkbhd's Locked iPhone | Veritasium

The Gist

Veritasium successfully takes $10,000 from MKBHD's locked iPhone by exploiting a vulnerability in payment terminals that process unauthorized transactions.

Quick Overview

Veritasium and Marques Brownlee demonstrate a critical security flaw in virtual wallets and payment terminals. By using a standard payment terminal rigged to manipulate transaction parameters, the team successfully authorizes a $10,000 transfer from Brownlee's locked iPhone without unlocking the device or requiring biometric confirmation. The exploit highlights a dangerous gap in how contactless payment systems handle background processing and card tokenization.

Key Points: Veritasium tests a security exploit on Marques Brownlee and his locked iPhone. The demonstration uses a standard payment terminal capable of processing contactless transactions. The experiment results in an unauthorized $10,000 transaction successfully processing on the locked phone. Apple Pay fails to prevent the large transfer from executing while the device remains completely locked. The flaw exposes vulnerabilities in how virtual wallets handle background authentication and terminal communication.

Context: Virtual wallets and contactless payments rely on near field communication and tokenization to ensure security, but vulnerabilities in payment terminal scripting can sometimes bypass user authentication protocols on locked devices.

Detailed Analysis

The video opens with Veritasium explaining the premise to Marques Brownlee, stating their goal to steal $10,000 from his locked iPhone using a payment terminal. Brownlee expresses skepticism, doubting that Apple Pay would ever permit such a large transaction without biometric verification. As Brownlee places his locked phone on the terminal, the device appears unchanged and remains locked. However, the background script running on the terminal executes the unauthorized charge. Moments later, Brownlee's phone lights up with a prompt to approve the $10,000 charge, proving the exploit successful.