Jin Daily Tech Trivia : Don’t set Credit Card as Express Transit Card in ApplePay

Jin Daily Tech Trivia : Don’t set Credit Card as Express Transit Card in ApplePay

Recently MKBHD just show case how to steal 10,000 USD NFC card swipe with Proxmark as the man in the middle attack.

The idea is simple:

• fake NFC terminal that broadcast Express Transit information and trigger Apple to auto allow NFC card swipe
• a bit flip in the visa transaction log claim this is a small amount transaction (even for 10k USD)
• another fake NFC device to talk to a real NFC terminal that user have passed the PIN/biometric check and go ahead and complete the transaction.

Is actually very hard to pull this off.

Check out the comment on how to turn off your express transit setting, or don’t use a credit card for that purposes. You can use a virtual card with max spending limit instead.