Source: Veritasium
Thank you for reading this post, don't forget to subscribe!Veritasium steals $10,000: What You Need to Know
THE TL;DW
- Derek Muller and university researchers exploit a flaw in Apple Pay’s “Express Transit” mode paired with a Visa card, letting a nearby NFC reader trick a locked iPhone into approving a payment with no passcode or Face ID.
- In the demo, Veritasium steals $10,000 from MKBHD’s fully locked, dark-screened iPhone after first confirming the relay attack with a small $5 test charge.
- The bug only affects Visa (not Mastercard or Amex) and has reportedly been known to Apple and Visa since 2021; the fix is simply turning off Express Transit or swapping the transit card.
The Jupiter Take
This isn’t a new zero-day — it’s Veritasium turning a five-year-old, already-disclosed Visa/Apple Pay loophole into a viral, high-stakes demo using one of tech’s biggest names. The video is scary in presentation but low in real-world risk, since it requires close-range hardware and physical proximity to the victim’s phone.
Context
Cybersecurity researchers from the University of Surrey and University of Birmingham first flagged this Apple Pay/Visa transit-mode weakness in 2021, and both companies have known about it since then without shipping a full fix. Coverage of the video notes the exploit only works with Visa cards in Express Transit mode and requires specialized NFC hardware plus physical proximity, and there are no confirmed real-world cases of it being used to steal money.
