How easy is it to steal $10,000 from a locked phone?

How easy is it to steal $10,000 from a locked phone?

🎙 Veritasium 👥 21.1M 📅 April 15, 2026 ⏱ 25 min 👁 7.7M 📄 original study 🧭 2026-08-03
Available in: English (current) Français

Keywords

NFCcontactless paymentman-in-the-middleApple PayVisa

Summary

The video demonstrates a real security vulnerability in contactless payment systems, specifically Apple Pay with Visa cards. The host, along with cybersecurity experts, successfully steals $10,000 from a locked iPhone using a man-in-the-middle attack. The attack exploits three weaknesses: the Express Transit Mode, which allows payments without unlocking the phone; the lack of encryption in transaction data, allowing modification of the high-value bit; and the reader’s acceptance of a false verification flag. The video explains the technical details, including the binary bits involved, and discusses the implications for security. It also highlights that the vulnerability has been known since 2021 but remains unfixed. The video includes a sponsored segment for Incogni, a data privacy service, and concludes with an interview with a Visa representative who acknowledges the issue but indicates no immediate fix.

133 words

Critical Evaluation

The video is a well-produced and engaging demonstration of a serious security flaw in contactless payment systems. The collaboration with cybersecurity experts adds credibility, and the step-by-step explanation of the attack is clear and accessible. The use of a real-world demonstration with MKBHD makes the threat tangible. However, the video has some limitations. The attack requires specific conditions: a Visa card, an iPhone, and the attacker must be in close proximity to the victim’s phone. The demonstration is staged, and the victim is a willing participant, which may not fully represent a real-world attack scenario. The video also includes a sponsored segment for Incogni, which, while relevant to the theme of data security, may introduce a commercial bias. The explanation of the technical details is accurate but simplified, and the video does not delve into the broader implications of the vulnerability, such as the potential for widespread fraud. The response from Visa is presented without critical analysis, and the video does not explore alternative solutions or the role of other payment networks. Overall, the video is informative and raises awareness about a significant security issue, but it could benefit from a more balanced and critical perspective.

196 words

Title / Content Match

The title accurately reflects the content, which demonstrates a specific attack on locked phones.

Quality & Reliability

8/10

The video demonstrates a real security vulnerability with expert collaboration and references, but the demonstration is staged and the sponsor segment may introduce bias.

Chapters

Cited Sources

Concurring Sources

  • References for the hack — The video's references likely include academic papers and reports on the vulnerability.

Dissenting Sources

  • Visa's official response — Visa's response in the video downplays the severity of the issue, suggesting it is not a priority, which contrasts with the video's emphasis on the seriousness of the vulnerability.

Contribution & Novelties

The video provides a practical demonstration of a known but underappreciated vulnerability in contactless payment systems, highlighting the ease with which a man-in-the-middle attack can be executed. It explains the technical details in an accessible manner, making the information valuable for both security professionals and the general public. The video also raises important questions about the responsibility of payment networks like Visa to address such vulnerabilities.

Pour aller plus loin :

116 words

Radar Profile

The radar profile shows high scores in information quantity, quality, and reliability, with a slightly lower score in technical depth, indicating a well-balanced and credible presentation.

Reliability 8/10

💬 The comments are predominantly negative towards Visa, with many viewers expressing frustration at the company's lack of action. There is also a mix of humor and criticism regarding the sponsor and the video's format.