For years, the people in Silicon Valley have been telling us that the future is “seamless.” They want a world where you don’t have to speak to anyone, look at anyone, or—God forbid—actually press a button. And that brings us to something Apple calls Express Transit Mode.
In the olden days, if you wanted to get onto a train, you’d stand in a queue behind a man who didn’t understand how coins worked, you’d contain a piece of orange plastic, and shove it into a slot. Now, Apple has decided that’s far too much effort. Express Transit Mode allows your iPhone to talk to a ticket barrier while it’s still in your pocket. You don’t have to wake the screen, you don’t have to show it your face, and you don’t even have to be conscious. You just tap the phone against the reader, and vwoop—you’re through.
It exists because Apple’s engineers believe that waiting three seconds for Face ID to recognise your tired, morning face is a human rights violation. It’s designed for speed. For efficiency. For the man who is so late for his commute that every millisecond spent not-authenticating is a millisecond closer to being fired.
THE FLAMING HOLE IN THE FENCE
However, there is a problem. And it’s a big one. It’s the sort of problem you’d get if you built a high-tech security gate but forgot to put a padlock on it because you thought padlocks were “too fiddly.”
If you use a Visa card with Express Transit Mode, you aren’t just opening a door for yourself; you’re leaving the vault wide open for any passing scoundrel with a bit of radio equipment.
Security researchers—the sort of people who wear hoodies in dark rooms and find things like this fun—discovered that they can trick your locked iPhone into thinking a handheld card reader is actually an Opal card turnstile. Because Visa’s “magic” doesn’t require a PIN or a face-scan for transit, the thief can simply “ask” your phone for money.And your phone, being a polite Californian, says “Yes, of course! Have ten thousand dollars!”
If you have a Mastercard or an Amex, you’re fine. They have systems in place that say, “Hang on, nobody spends five grand on a single bus fare.” But Visa? Visa just waves it through like a distracted security guard at a Bee Gees tribute concert.
WHO’S TO BLAME?
You’d think, having known about this since 2021, that someone would have fixed it. But no.
Apple says it’s Visa’s fault because they’re the ones approving the nonsensical transactions without the kind checks that Mastercard uses. Visa further mumbles that this kind of fraud is very rare and if your bank account is drained by a man sitting next to you on the bus with a rooted Android phone and a dream, they will refund you the money no questions asked…eventually. One assumes while you wait for your money so you can buy food you can eat your shoes for nourishment.
WHAT CAN YOU DO?
So, how do you protect yourself from this digital pickpocketing? Well, you could wrap your iPhone in tinfoil, but then you’d look like a conspiracy theorist who thinks the moon is made of cheese.
Instead, you have two real options:
The Sensible Move: Go into Settings on your iPhone and scroll to Wallet settings and change your Express Transit card to a Mastercard or an Amex. They actually bother to check if a transaction makes sense.
The Safe Move: Turn Express Transit OFF.
Yes, it means you’ll have to spend two seconds looking at your phone to let it see your face before the barrier opens. It’s a harrowing ordeal, I know. You might even miss your tram. But at least when you get to the other end, you’ll still have enough money to buy a sandwich.
