This $10,000 payment went through on a locked iPhone. No Face ID. No passcode. Marques Brownlee(MKBHD) still looked doubtful after seeing his locked phone get charged $5 through Apple Pay. So the team at Veritasium asked a wild question: “Can we try $10,000?” They placed his iPhone on a... device while it was still locked. Then, using a separate device, they tapped a payment terminal. Instantly, $10,000 was charged. No unlock. No Face ID. No passcode. Just tap, and the money was gone.show more

FYI to prevent this turn off Express Travel Card in Wallet settings.

I think it can bypass it This video is 2 weeks so I think they would have patched it

@King_Freddy_II no, it can’t bypass it. The only reason the hack works is because Express Transit Mode allows you to pay without unlocking your phone :) sadly that’s the only solution until Visa fixes this and stop allowing $10k “subways fares” 😂

@King_Freddy_II 😂😂😂 Makes sense

Scammers rubbing their hands like Birdman after watching this.

Me being concerned about my financial security after seeing this video with $2 in my account...

ft @veritasium

Nothing is secured or encrypted all that end to end encryption bullshit they talk about is just to lure you in all those your information is safe cause we use a 5D secure system protect your date huge lie. As long as there’s a front door there’s always a back door.

Ok, but my iPhone is connected to my credit card. I can dispute and reverse any charge made on my iPhone through my credit card company. Nice try!

Thats why I would never link a payment system to an account with significant funds in it.

And I am required to enter passcode 10 times a day 🙄

AI-Fact-Check 1.0 — 2026-05-02 21:45 UTC Headline Overall verdict: Mixed Claim-by-claim verdicts 1.“A $10,000 payment went through on a locked iPhone without Face ID or passcode.” — True for the demonstrated setup, not as a general iPhone condition. @veritasium published a video titled “I hacked MKBHD’s locked phone” about two weeks ago; independent tech reporting says the demo charged $10,000 from @MKBHD’s locked iPhone. The underlying 2021/2022 academic work says Apple Pay + Visa Express Transit can bypass the lock screen and allow transactions “for any amount” under the tested attack model. (Veritasium/YouTube; MacRumors; University of Surrey; University of Birmingham; IEEE paper)  2.“No Face ID. No passcode.” — True only for Apple Wallet Express Mode / Express Transit conditions. @Apple’s own support page says Express Mode can use some Wallet cards without waking/unlocking the device or authenticating with Face ID, Touch ID, or passcode. This does not mean ordinary Apple Pay retail payments normally work that way. @Apple’s UK Apple Pay transit page says Express Mode is for public transport and Face ID/Touch ID/passcode is still required elsewhere. (Apple Support; Apple Apple Pay UK)  3.“They placed his iPhone on a device, then used a separate device to tap a payment terminal.” — Substantially true. Reporting and transcript snippets describe an NFC relay/man-in-the-middle setup using a reader/device near the iPhone and another device/terminal side. The 2021 research describes bypassing the lock screen through Apple Pay + Visa Express Transit relay mechanics. (MacRumors; University of Surrey; Practical EMV Relay Protection)  4.Implied general warning that any locked iPhone can be charged $10,000 — Misleading if read broadly. The verified vulnerability concerns a specific combination: iPhone + Apple Pay + Visa card configured for Express Transit/Express Travel. University of Surrey says it does not affect combinations such as Mastercard in iPhones or Visa on Samsung Pay. MacRumors likewise reports it needs Express Transit Mode and a Visa card. (University of Surrey; MacRumors; TechTarget/Dark Reading)  Evidence / explanation X post retrieval and screenshot match: I found the X URL for @0xRuzy’s post through current web search. The indexed X text matches the screenshot’s visible wording at the start: “This $10,000 payment went through on a locked iPhone. No Face ID. No passcode…” and continues with @veritasium / @MKBHD wording. However, X’s opened page returned no readable full body lines, so I cannot verify the hidden remainder or certify a 100% full-post match. (X indexed result)  Temporal frame: The underlying vulnerability was publicly reported on 30 September 2021 and published at IEEE S&P 2022. The @veritasium demonstration is current relative to the post: YouTube search lists it as published about two weeks ago. The post does not use “breaking” or “today,” so it does not clearly misdate the older vulnerability, but it omits that the flaw was known since 2021. (University of Birmingham; University of Surrey; YouTube)  Sources @Apple Support; @veritasium YouTube; @MKBHD X profile; University of Surrey; University of Birmingham; IEEE Practical EMV Relay Protection; MacRumors; TechTarget/Dark Reading; Visa Zero Liability Policy.  Bottom line: The demo is real, but the post is incomplete because the attack requires the specific Apple Pay + Visa Express Transit setup, not just any locked iPhone. 

Only works if VISA is added to Express Transport feature and it is not instant, it takes several seconds. So rare that VISA said it’s not even worth it spending engineering resources to enhance the security. This “hack” was discovered in 2020 I think but it’s just not worth for any thief even looking into it. Also, many countries do not even have the Express Transport feature 😂 What a clickbait.

Proves nothing you need a laptop and a device and the phone needs to be on it based on the video.

lesson; turn off nfc use apple pay only on demand by toggling nfc?

The 5$ charge was the Trojan horse.

The guy was shocked 😂

so basically if someone steals your phone they can just tap it at any terminal?

We’re fucked @Apple . Get into a wrong hand then we’re finished.

Gone to which destination

To the payment terminal

Yes its true. Holy shit Veritasium (in collaboration with MKBHD/Marques Brownlee) demonstrated this in an April 2026 video. They successfully processed a $10,000 payment (and a smaller $5 one) from MKBHD's locked iPhone using Apple Pay, without Face ID, passcode, or any unlock.

Once the AC takes over everyone will have to get the mark which will also allow them to buy or sell and it's unhackable. Don't do it tho. Once one takes the mark there is no turning back, no chance to say you were wrong or change your mind. Your eternity is decided.

turn off Express transit Card in Wallet settings. @Apple can you put a limit on Express transit Card please.

I can unlock my dads phone with my face, It didn’t work the first few days but eventually it let me unlock it without entering the password , I thought that was strange

Ironically, SG govt highlighted this issue based on their security audit and flagged it like few years back. Both V & MC didn’t wanna fix it. So, SG govt never allowed express option at all.

Holy Apple Pay just let a $10k charge slip through a locked iPhone. Does anyone know how long the payment token stays valid?

Sucks for the scammers, bcz I typically only have $7 in my account or zero. 🤓

How does this exploit work @grok‽ Is there a way to thwart this‽

He could've said 100 instead of specifically 10 grand🤣

No it didn’t lol

People think ‘locked phone’ = safe. Turns out ‘convenient mode’ can mean spend mode. This is why I don’t outsource security. Self-custody mindset: assume theft is possible → design your setup around it. Do you prioritise convenience or security on your phone payments?

apple has to step up and do something about this

@erikdesmedt Doh you need the stupid transport card setup. Never do that. Always payments with some sort of check either passcode or faceid

It will do this but then in your own house it is hyper-vigilant to lock up when you want to see your spotify playlist.

The space bar on that macbook is way worn.

now you know why Speed wants his Huawei back.

I need to learn this method