Veritasium Reveals $10,000 iPhone Security Flaw

The assumption that a locked screen constitutes a secure perimeter is a dangerous fallacy. When a locked iPhone can be leveraged to siphon $10,000 via a niche NFC exploit, we aren’t looking at a failure of Apple’s Secure Enclave, but rather a catastrophic logic gap in the payment orchestration layer. This isn’t a script-kiddie exploit; it’s a sophisticated architectural bypass.

The Tech TL;DR:

• The Vector: A Visa-specific loophole in Apple’s “Express Transit Mode” allowing unauthorized high-value transactions from locked devices.
• The Requirement: Physical proximity, specialized NFC interception hardware, and a linked Visa card.
• The Mitigation: Disabling Express Transit Mode or utilizing non-Visa payment methods (Mastercard/Amex), as the flaw resides in the Visa system’s security protocols.

The recent demonstration by the YouTube channel Veritasium, featuring a target device owned by Marques Brownlee, exposes a vulnerability that has been lingering in the wild since 2021. The exploit, developed by cybersecurity researchers from the University of Surrey and the University of Birmingham, doesn’t attack the iOS kernel or bypass FaceID through brute force. Instead, it tricks the device into believing it is interacting with a legitimate mass transit terminal. By exploiting the “Express Transit” feature—designed for frictionless commutes—attackers can bypass the traditional requirement for user authentication on the lock screen.

The Anatomy of the NFC Interception Chain

From a systems architecture perspective, the attack is a man-in-the-middle (MITM) operation executed at the physical layer. The process requires a specialized NFC card reader tuned to the specific transit terminal identifier. This reader intercepts the communication between the locked iPhone and the spoofed terminal. The captured payment data is then routed to a laptop and relayed to a burner phone, which finally interacts with a legitimate card reader to finalize the transaction.

This bypass is particularly egregious due to the fact that it circumvents traditional transaction size limits. In the demonstrated case, the researchers successfully extracted $10,000. The vulnerability is not universal; it is strictly bound to the combination of an iPhone and a Visa card. Mastercard and American Express utilize different security methods that preclude this specific exploit, and the vulnerability does not extend to Samsung Pay on Samsung hardware. This confirms that the failure point is not the NFC hardware or the mobile OS, but the specific implementation of the Visa payment protocol within the Express Transit framework.

“Apple told Veritasium that it’s an issue with the Visa system, but something unlikely to occur in the real world.”

For enterprise environments managing a fleet of corporate iPhones, this represents a significant endpoint risk. Although the attack requires physical access, the potential for high-value theft from executive devices is non-trivial. Organizations are now auditing their mobile device management (MDM) policies to restrict high-risk features. To secure these endpoints, firms are increasingly relying on cybersecurity auditors and penetration testers to identify similar logic flaws in their mobile payment workflows.

The Implementation Gap: Logic Over Encryption

The technical failure here is a classic trade-off between user experience (UX) and security. Express Transit Mode is designed to eliminate latency at subway turnstiles, meaning the device must authorize a payment without waking the screen or requiring a biometric handshake. By spoofing the terminal ID, the attacker leverages this “trusted” state to initiate a transaction that should normally trigger a security prompt.

While there is no public CVE patch for a “Visa loophole,” developers and security researchers can analyze NFC traffic to identify anomalous request patterns. Below is a conceptual representation of how a security auditor might monitor for unauthorized NFC polling events using a CLI-based tool on a rooted test environment to detect spoofed terminal IDs:

# Conceptual check for unauthorized NFC terminal polling # Monitoring for non-standard Transit Terminal IDs (TID) sudo nfc-poll -p | grep -E "TID: [0-9a-fA-F]{16}" | while read -r line; do if [[ ! "$line" =~ ^(KNOWN_TRANSIT_ID_1|KNOWN_TRANSIT_ID_2) ]]; then echo "[ALERT] Unrecognized Transit Terminal detected: $line" logger -p user.warn "Unauthorized NFC Terminal interaction attempt detected." fi done

This type of monitoring is critical for high-security environments. Companies managing sensitive financial data are deploying managed security service providers to implement real-time endpoint detection and response (EDR) that can flag unusual hardware interactions.

Risk Assessment and Mitigation Matrix

The blast radius of this vulnerability is limited to a specific subset of users, but the financial impact per incident is high. Visa has countered the findings by pointing to its “zero liability promise,” suggesting that financial reimbursement is the primary safeguard. However, from a technical standpoint, relying on insurance rather than prevention is a failure of secure-by-design principles.

To further understand the underlying security architecture of these devices, developers should reference the Apple Platform Security guide and review the Visa official security terms regarding liability. For those implementing their own payment gateways, consulting Stack Overflow’s NFC implementation threads can provide insight into common pitfalls in terminal identification and handshake validation.

The fact that this vulnerability was first publicized in 2021 and remains an active risk in 2026 highlights a systemic inertia in the payment industry. When the “fix” is simply a promise of reimbursement rather than a protocol update, the industry is admitting that convenience outweighs the integrity of the encrypted tunnel. As we move toward an increasingly cashless society, the reliance on “zero liability” policies instead of robust technical controls is a gamble that CTOs cannot afford to take with their corporate assets.

Moving forward, the industry must shift toward dynamic authentication for all high-value transactions, regardless of the “Express” status of the terminal. Until then, the most effective defense remains a manual one: auditing your wallet settings and ensuring that only the most secure card providers are linked to your hardware. For enterprises looking to harden their mobile infrastructure, partnering with professional IT consultants is the only way to move beyond the “hope-based” security model provided by payment processors.