Android Not Affected by iPhone Tap-to-Pay Vulnerability

For several years a tap-to-pay weakness affecting iPhones has been known, and a recent in-depth video has brought it back into focus. Importantly, Android phones are not affected by this particular issue.

Contactless payment via tap-to-pay is now widespread and for the most part is secure. A detailed examination in a recent Veritasium video explains a long-standing vulnerability that can allow very large transactions to be completed without unlocking an iPhone.

The technique exploits the way some phones handle transit payments. Both Android and iPhone platforms support special transit or “express” modes that let the device complete fares without the usual unlock step so passengers can move through gates quickly, even when the device is offline in areas with poor network coverage. On iPhone, however, a combination of the express transit setting and a flaw in how Visa processes high-value transactions in transit contexts creates an opening for larger payments to go through unchallenged.

This attack requires additional hardware to emulate a terminal and, in demonstrations, a rooted Android device has been used as a card emulator. The researchers behind the demonstration point to Visa’s processing rules as the enabling factor for high-value transactions in transit mode, and Apple has indicated the underlying issue relates to how Visa classifies and handles those payments. Both Apple and Visa have been aware of the issue since 2021.

Despite how this exploit was demonstrated in a lab environment, it’s important to note that it specifically targets iPhones running express transit functionality combined with the way certain transactions are treated by a particular payment network. Other payment processors and devices are not affected in the same way.

At present, Android devices are not vulnerable to this exact attack. Several Android vendors and Google have implemented additional checks for transit-mode payments. For example, some manufacturers flag unusually large contactless transactions made in transit mode so they can be reviewed, and Google Wallet requires the phone’s screen to be on before an unattended payment can proceed when the device is locked. Google has also added biometric protections and other hardening measures around the Wallet app to reduce the risk of unauthorized use.

The public demonstration highlights important distinctions in how different ecosystems treat device lock state, transit convenience, and payment processing rules. Transit modes are a trade-off between speed and security: allowing unlocked transactions speeds boarding and reduces friction, but that convenience can introduce edge cases where transaction handling behaves differently than in standard retail environments.

Device makers and payment networks have been working on mitigations for several years. In practice, the likelihood of this kind of exploit occurring in the wild is limited by several factors: the need for specialized hardware to emulate terminals, the specific transaction-handling behavior of a particular payment network, and the technical steps demonstrated in research that are nontrivial to reproduce at scale. That said, the demonstration serves as a reminder that payment systems and device settings should be reviewed and updated regularly, and that users should keep their devices and payment apps current.

For iPhone users who rely on express transit settings, staying informed about security advisories from both device manufacturers and payment networks is wise. For Android users, the additional protections applied by vendors and by Google Wallet offer an extra layer of security against this class of attack. Overall, contactless payments remain broadly secure, but this case underscores the importance of continuous scrutiny and collaboration between platform vendors and payment processors to close any gaps that might enable misuse.

More on Google Wallet: