Researchers: a flaw in Apple Pay lets attackers make a Visa payment with a locked iPhone in Express Transit mode; Apple calls it “a concern with a Visa system”
here's what to do Will Feuer / New York Post : Researchers flag flaw that allows hackers to drain cash from iPhones Tweets: @serghei : 😬In combination with a Visa card, “this feature can be leveraged to bypass the Apple Pay lock screen, and illicitly pay from a locked iPhone, using a Visa card, to any EMV reader, for any amount, without user authorisation.” https://twitter.com/... CyberSec Chey / @chey_cobb : Convenience is the enemy of Security ~ When you upgrade an iPhone iOS, your phone badgers you to set up Apple Pay. When you agree, this type of convenience sidesteps security measures. In the UK, banks are not legally bound to return your money. https://www.bbc.com/... Linda Yueh / @lindayueh : The researchers have urged consumers who use a Visa card with Apple Pay to turn off the express travel setting in their iPhones until the issue is fixed. https://www.thetimes.co.uk/... Dan Bridgland / @danbridgland : @MacRumors @waxeditorial Unless I've missed a crucial point, There's a super simple solution to this, Apple should cap the spending limit for express transit purchases. @telegraph : ❌The researchers said the problem could be easily solved by either Apple or Visa but that both parties had declined to introduce fixes despite being warned about it
Context & Ripple Effects
Earlier Apple Pay fraud coverage traced losses to banks' verification procedures rather than Apple Pay encryption, while another report showed how mobile wallets could move stolen online card details into physical-store payments. The Express Transit finding shifts attention to the payment path available before an iPhone is unlocked.
Apple attributes the issue to Visa's system, but the affected setting sits in Apple Pay. That split matters because researchers say Apple and Visa were warned yet did not introduce fixes.
First-order effects
- Apple Pay users with a Visa card are urged to disable Express Transit, trading the feature's convenience for protection against unauthorized payments from a locked iPhone.
- Apple and Visa face an immediate responsibility dispute: Apple calls the weakness a Visa-system concern, while the vulnerable experience is delivered through Apple Pay.
Second-order effects
- Visa must address a payment-flow weakness that can affect Apple Pay's locked-device mode, while Apple must weigh whether to alter or restrict Express Transit absent a Visa-side change.
- The incident reinforces the verification and authorization gaps highlighted in earlier Apple Pay fraud reporting, rather than treating wallet encryption alone as the relevant security boundary.
Third-order effects
- If locked-device payment modes continue to expose exceptions in card-network controls, mobile-wallet security will be judged across the handset, wallet and payment rail rather than by any one party's safeguards.
- The pattern points toward tighter access-control design for convenience features, with platform and network partners sharing accountability for the transaction states they enable.
The trend: Contactless-payment security is moving from protecting stored credentials to governing the exceptional access paths that make fast, lock-screen transactions possible.