Apple Pay Security Questioned: Can iPhones with Visa cards linked be skimmed via NFC while locked? Vulnerability analysis and prevention methods
In recent years, mobile payment has rapidly gained popularity, and Apple Pay's security has always been considered the industry standard. However, the latest research indicates that under specific conditions, a security vulnerability may exist when an iPhone is linked with a Visa card, allowing for contactless fraudulent transactions even when the phone is locked, raising concerns about NFC payment security. Given the potential vulnerability in Apple Pay and the high level of attention on credit card anti-theft mechanisms, the following will explain the principles behind these vulnerabilities and provide practical prevention and setup methods.
iPhone Visa Card Vulnerability Exposed
The critical vulnerability lies in the iPhone's "Express Transit Mode." This feature was originally designed for public transport payments, allowing users to complete transactions without unlocking their phone or verifying with Face ID / Touch ID.
Research shows that attackers can use specialized NFC tools (such as Proxmark) to simulate the identification signal of a legitimate transit terminal, causing the iPhone to mistakenly identify it as a transit payment environment, thereby bypassing security authentication mechanisms.
In test scenarios, even when an iPhone is locked, high-value transactions (approximately US$10,000, equivalent to HK$78,000) could be triggered, indicating a potential risk.
Vulnerability Discovered Long Ago: Only Affects "iPhone + Visa" Specific Combination
Fact-checking reveals that this vulnerability was publicly disclosed by a UK academic research team in 2021, with the following key points:
- Only affects Apple Pay with Visa cards
- Mastercard and American Express are not affected
- Samsung Pay does not have the same vulnerability
Research indicates that the problem primarily involves the design of Visa's contactless payment verification mechanism, and is not solely due to an iPhone hardware issue.
Visa Official Response
Regarding the vulnerability, Visa stated:
- Attacks require specialized equipment and close-range operation
- The probability of occurrence in daily life is extremely low
- Cardholders are protected by the "Zero Liability Policy"
- In case of unauthorized transactions, refunds and dispute resolution can be applied for
In other words, even if fraudulent transactions occur, user funds are still protected by security mechanisms.
How to Prevent Apple Pay Fraud
Until the vulnerability is fully patched, users can enhance security by taking the following measures:
Disable "Express Transit Card / Express Mode" for Visa Cards
The steps are as follows:
- Open the "Apple Wallet" App
- Select the linked Visa card
- Tap "More (...)"
- Go to "Card Details"
- Tap "Express Transit Settings"
- Turn off the feature or remove the card setting
Other articles: Lucky SIM number porting to keep your number
Many people keep their Hong Kong phone numbers. The top choice for number porting is the "$138 for 3 years" super value plan! In addition to free SMS reception in Hong Kong and overseas, Hong Kong data has been increased to 30GB, while prices for other 540-day/2-year/3-year plans remain unchanged, with data upgrades! It's incredibly cost-effective!
New 30GB roaming data for 42 countries/regions has been added, expanding global internet access! All porting plans can be topped up/renewed later, so whether you are in Hong Kong or overseas, you can add data as needed, ensuring you never run out.
Lucky SIM phone cards are compatible with various devices, including physical cards and eSIM-enabled phones. Whether you are in Hong Kong or overseas, you can apply for number porting using the official authorized form below, and a dedicated representative from the official authorized agent will contact you.
Google Form application form:https://forms.gle/tY7vCdDgRFTYZd616 (physical card or eSIM options available)
Article details:https://stepstepinfo.com/?p=2694
Official authorized agent StepStepInfo offers priority sales of various LuckySIM and Lucky2 eSIMs. For prices, please refer to the order form: https://forms.gle/mZej1dDA3MyugCkr8
Lucky2 50 Countries/Regions 365 Days 12GB Unlimited Data Card + Hong Kong 5GB (eSIM)
This annual card provides 365 days of roaming data service, with the first 12GB being high-speed data. After consumption, you can continue to use unlimited data at a reduced speed of 384kbps, plus an additional 5GB in Hong Kong!
This annual card supports 50 popular travel countries and regions worldwide, including China, Taiwan, Hong Kong, Macau, Japan, Korea, UK, France, Germany, Canada, USA, and major locations in Europe, Asia, Americas, Australia, and New Zealand.
Except for Hong Kong and Taiwan, real-name registration is not required in other regions. This is an eSIM version, so seize the limited-time offer!
Online store order: https://1worldsim.com/products/lucky2-esim-50region12gb-hk5gb
Lucky2 China, Japan, Korea, Taiwan, Macau 5 Regions 365 Days 40GB Unlimited Data Card + Hong Kong 5GB (eSIM)
Our best-selling annual card! Upgraded from 30GB to 40GB! High-speed 5G/4G, then throttled to 512K unlimited internet, plus an extra 5GB of Hong Kong data.
Real-name registration is required for Hong Kong or Taiwan; only one registration is needed to use it in both places. China/Macau/Japan/Korea do not require real-name registration.
Online store order: http://1worldsim.com/products/lucky2-esim-5region25gb
LuckySIM 3 Years 30GB + 2000 Minutes Recommend to Keep Hong Kong Phone Number (eSIM)
The popular number-keeping phone card! Offers a validity of up to 3 years, with an additional 30GB of Hong Kong data. Real-name registration is required. A super cheap way to keep your Hong Kong phone number.
Online store order: https://1worldsim.com/products/luckysim-esim-3years-30gb-keephknumber
Official authorized agent StepStepInfo offers priority sales of various LuckySIM and Lucky2 eSIMs. For prices, please refer to the order form: https://forms.gle/Z2ZcysWePMatZmcc8