A group of researchers at the Birmingham and Surrey Universities in the UK have revealed a new iPhone flaw that allows attackers to perform unauthorized contactless payments by exploiting a weakness in Apple Pay’s Express Transit feature while using a Visa card.
Express Transit (Express Travel in the UK) allows an iPhone user to tap-and-go at ticket barriers for much quicker payments. In other words, it eliminates the need to authenticate using either a passcode, Touch ID, or Face ID when making payments, but this also introduces a weakness that can easily be exploited with a relatively inexpensive piece of commercially available radio equipment.
