Even if refunds are possible, the real cost is time, stress, and exposure.
Security isn’t just about what can happen — it’s about what should never happen.
Key takeaway:
Your phone doesn’t always verify what you think it does — sometimes it trusts what it’s told.
Mitigation:
• Disable Express Transit if unused
• Be cautious with wallet/card configurations
• Monitor transactions actively
By exploiting a known NFC relay (man-in-the-middle) attack, researchers showed how Express Transit mode + specific card setups can be abused to bypass authentication and approve high-value payments.
This vulnerability has been public since 2021.
