Security News > 2021 > September > Apple Pay with Visa Hacked to Make Payments via Unlocked iPhones

An attacker who steals a locked iPhone can use a stored Visa card to make contactless payments worth up to thousands of dollars without unlocking the phone, researchers are warning.

The problem is due to unpatched vulnerabilities in both the Apple Pay and Visa systems, according to an academic team from the Universities of Birmingham and Surrey, backed by the U.K.'s National Cyber Security Centre.

It requires an iPhone to have a Visa card set up as a transit card in Apple Pay.

Apple meanwhile shifted the responsibility to Visa and told the outlet, "We take any threat to users' security very seriously. This is a concern with a Visa system, but Visa does not believe this kind of fraud is likely to take place in the real world given the multiple layers of security in place. In the unlikely event that an unauthorized payment does occur, Visa has made it clear that their cardholders are protected by Visa's zero-liability policy."

For now, users can protect themselves by not using Visa as a transport card in Apple Pay, and if they do, by remotely wiping the device if lost or stolen.

The bug does not affect other types of payment cards or payment systems - Mastercard on Apple Pay or Visa on Samsung Pay are safe from such attacks, the researchers noted.

News URL

https://threatpost.com/apple-pay-visa-hacked-unlocked-iphones/175229/