# We Took $10,000 From @mkbhd's Locked iPhone

Source: https://www.youtube.com/watch?v=b3KpFdb1pW8
Recap page: https://rapidrecap.app/video/b3KpFdb1pW8
Generated: 2026-10-01T18:03:54.325+00:00

---
## The Gist

Veritasium successfully takes $10,000 from MKBHD's locked iPhone by exploiting a vulnerability in payment terminals that process unauthorized transactions.

## Quick Overview

Veritasium and Marques Brownlee demonstrate a critical security flaw in virtual wallets and payment terminals. By using a standard payment terminal rigged to manipulate transaction parameters, the team successfully authorizes a $10,000 transfer from Brownlee's locked iPhone without unlocking the device or requiring biometric confirmation. The exploit highlights a dangerous gap in how contactless payment systems handle background processing and card tokenization.

**Key Points:**
- Veritasium tests a security exploit on Marques Brownlee and his locked iPhone.
- The demonstration uses a standard payment terminal capable of processing contactless transactions.
- The experiment results in an unauthorized $10,000 transaction successfully processing on the locked phone.
- Apple Pay fails to prevent the large transfer from executing while the device remains completely locked.
- The flaw exposes vulnerabilities in how virtual wallets handle background authentication and terminal communication.

![Screenshot at 0:47: Marques Brownlee reacts in shock as the $10,000 transaction prompt appears on his locked iPhone.](https://ss.rapidrecap.app/screens/b3KpFdb1pW8/00-00-47.jpg)

**Context:** Virtual wallets and contactless payments rely on near field communication and tokenization to ensure security, but vulnerabilities in payment terminal scripting can sometimes bypass user authentication protocols on locked devices.

## Detailed Analysis

The video opens with Veritasium explaining the premise to Marques Brownlee, stating their goal to steal $10,000 from his locked iPhone using a payment terminal. Brownlee expresses skepticism, doubting that Apple Pay would ever permit such a large transaction without biometric verification. As Brownlee places his locked phone on the terminal, the device appears unchanged and remains locked. However, the background script running on the terminal executes the unauthorized charge. Moments later, Brownlee's phone lights up with a prompt to approve the $10,000 charge, proving the exploit successful.

### The Setup and Skepticism

- Veritasium approaches Marques Brownlee with a standard payment terminal and asks him to place his locked iPhone on it.
- Brownlee expresses disbelief that a $10,000 transaction could ever be processed through Apple Pay on a locked device.

![Screenshot at 0:09: The payment terminal is placed on the table next to Marques Brownlee's locked iPhone.](https://ss.rapidrecap.app/screens/b3KpFdb1pW8/00-00-09.jpg)

### Executing the Exploit

- The team runs a custom script on the payment terminal while the phone sits undisturbed on top of it.
- The phone initially shows no outward signs of change and remains completely locked during the initial processing phase.

![Screenshot at 0:31: The iPhone remains locked and unchanged immediately after the terminal interaction.](https://ss.rapidrecap.app/screens/b3KpFdb1pW8/00-00-31.jpg)

### The Reveal and Outcome

- A notification abruptly appears on Brownlee's screen asking him to approve the massive transfer.
- The successful prompt confirms that $10,000 was effectively pulled from the locked device.

![Screenshot at 0:44: The approval prompt appears on the phone screen after the script executes.](https://ss.rapidrecap.app/screens/b3KpFdb1pW8/00-00-44.jpg)