A flaw in Apple Pay with Visa’s design means that large, unauthorised payments can be made even if the iPhone is locked.

Researchers at the Universities of Surrey and Birmingham demonstrated the exploit in a video in which they used a simple wireless device to receive a £1,000 payment using the Express Travel feature.

The researchers explained that the exploit could easily be fixed on either Apple or Visa’s end but both parties had failed to take action despite warnings about a potential vulnerability.

Contactless payments generally require a form of authentication – either through facial recognition, thumb print or password – but Express Travel bypasses the need for this, leaving it open to exploitation.

Express Travel is currently used in the UK on Transport for London’s Oyster network and on the First Bus system, which operates in dozens of towns and cities.

The vulnerability applies specifically to Visa, as Mastercard  and American Express cards prevent such payments by using an extra authentication process.

“Apple Pay users should not have to trade-off security for usability, but at the moment some of them do,” said Ioana Boureanu from the University of Surrey’s Centre for Cyber Security

Recommended

• Meet the firms chosen for Scotland’s first Smart Things Accelerator
• YouTube announces complete ban on anti-vaccine misinformation
• Edinburgh revealed as top city for startups outside London

Talking about the exploit, a Visa spokesperson said: “Visa cards connected to Apple Pay Express Transit are secure and cardholders should continue to use them with confidence.

“Variations of contactless fraud schemes have been studied in laboratory settings for more than a decade and have proven to be impractical to execute at scale in the real world.

“Visa takes all security threats very seriously, and we work tirelessly to strengthen payment security across the ecosystem.”

Worryingly, there is no limit on Apple Pay transactions, meaning hackers could in theory drain a person’s bank account or their credit card limit.

In a statement, Apple said: “We take any threat to users’ security very seriously. This is a concern with a Visa system but Visa does not believe this kind of fraud is likely to take place in the real world given the multiple layers of security in place.

“In the unlikely event that an unauthorised payment does occur, Visa has made it clear that their cardholders are protected by Visa’s zero liability policy.”