A deep dive into the exploit that could, in theory, drain funds from a locked iPhone, and why you probably shouldn’t panic.

What’s the story?

Hey there! You might have seen some buzz lately about an iPhone exploit that supposedly lets thieves drain money from your locked phone using a ‘transit trick.’ It sounds pretty scary, right? The core of the story is that researchers discovered a way to bypass security measures in certain mobile payment systems, specifically involving Visa cards used with Apple’s Express Transit feature.

Basically, if a thief had your locked iPhone and some specialized equipment, they could potentially trick your phone into making high-value transactions. The Express Transit mode is designed for quick, low-value payments like subway fares without needing to unlock your phone, but this exploit manipulates that system to allow for much larger sums to be taken. It’s a clever, albeit malicious, piece of technical wizardry that has been known for a few years but recently gained renewed attention.

Why does it matter?

So, why should you even care about this if it sounds so complicated? Well, on the surface, any vulnerability that could lead to your money being stolen is a big deal. It touches on our trust in the security of our everyday devices and the digital payment systems we rely on. We carry our lives in our phones, and the idea of someone accessing our finances without our knowledge is unsettling.

Beyond the immediate financial risk (which, as we’ll see, is pretty low for most people), this story highlights the ongoing cat-and-mouse game between cybersecurity researchers, tech companies, and potential bad actors. It reminds us that even the most secure systems can have theoretical weak points, and it pushes companies like Apple and Visa to continually improve their safeguards. For you, it’s a good prompt to understand how your digital wallet works and what protections are in place.

The deeper context

This isn’t a brand-new vulnerability that just popped up yesterday. Researchers from the University of Surrey and University of Birmingham, led by Ioana Boureanu and Tom Chothia, first identified this exploit almost five years ago. They demonstrated how data from transit terminals (like those on the London Tube) could be recorded, modified, and then used to initiate fraudulent transactions from a locked iPhone.

The key to the exploit lies in the ‘Express Transit’ feature. This mode allows users to tap their iPhone to pay for public transport without needing Face ID, Touch ID, or a passcode. It’s designed for speed and convenience, but this convenience creates a window where a specific type of attack can occur. The researchers found a way to essentially ‘upgrade’ a low-value transit transaction into a high-value one by relaying and modifying the payment data through a separate phone and laptop setup.

It’s crucial to understand that this isn’t an ‘iPhone issue’ in isolation. The researchers specifically pointed out that it primarily affects Visa cards. Mastercard and American Express systems, as well as Samsung Pay, are not susceptible to this particular trick. This indicates that the vulnerability isn’t in Apple’s hardware or core software, but rather in how certain payment networks interact with the Express Transit feature.

Both Apple and Visa have acknowledged the theoretical nature of this exploit. They’ve consistently stated that while it’s technically possible in a lab setting, the conditions required to pull it off in the real world are so complex and specific that it’s highly unlikely to occur at scale. Think about it: a thief would need your phone, specialized equipment to intercept and modify signals, and then another device to complete the transaction – all without you noticing. Plus, payment networks have sophisticated fraud detection systems that would likely flag such unusual activity.

However, the researchers, particularly Dr. Andreea Radu, have warned that even complex lab attacks can eventually be adopted by criminals if left unaddressed. While it hasn’t become a widespread issue in the past five years, the discussion resurfaces periodically, reminding us that vigilance is always necessary in the digital world.

What you should know

Alright, so after all that, what’s the practical takeaway for you? First and foremost, don’t panic. The consensus from Apple, Visa, and the researchers themselves is that this exploit is extremely difficult to execute in the real world. It requires a very specific setup and direct, in-person interaction with your phone, which isn’t something a casual pickpocket could pull off.

If you’re still concerned, there are simple steps you can take. The easiest is to simply turn off Express Transit mode for any Visa cards in your Apple Wallet. While it’s a convenient feature, disabling it completely eliminates this particular vulnerability. Alternatively, if you want to keep Express Transit active, you could choose a non-Visa card (like Mastercard or American Express) for that specific function, as those are not affected by this exploit.

Finally, remember that Visa has a ‘zero liability policy.’ This means that in the highly unlikely event that you *were* to be a victim of this type of fraud, you would be protected and not held responsible for the unauthorized charges. So, while it’s good to be aware and take precautions if you wish, this isn’t a reason to lose sleep over your iPhone’s security.

And there you have it – a deep dive into a fascinating, if a bit niche, cybersecurity topic. It’s a great example of how the world of tech security is constantly evolving, with researchers pushing boundaries to find vulnerabilities and companies working to patch them up. It reminds us that staying informed is always our best defense, even when the threats are more theoretical than immediate. So, keep those digital wallets secure, stay curious, and let’s keep exploring the hidden layers of our connected world!

Originally sourced from: https://www.forbes.com/sites/davidphelan/2026/04/19/thieves-can-drain-funds-from-a-locked-iphone-with-this-trick-how-to-protect-yourself/