LONDON—Commuters who use Apple Pay to tap in and out of public transport could be at risk of having “unlimited” sums of money stolen from their Visa payment cards, a new study is cautioning.
Researchers from two British universities identified a vulnerability that occurs when an Apple Pay user sets a Visa credit or debit card as their “Express Transit” payment option in their iPhone’s wallet, Euro News reported.
In a video demonstrating the vulnerability, the researchers were able to take a £1,000 contactless payment from a locked iPhone.
The researchers said that the security flaw only occurred when using a combination of Apple Pay and Visa. Other combinations such as Apple Pay and Mastercard or Samsung Pay and Visa were not affected.