NFC-APPLE-PAY-RELAYLateral Movement

Apple Pay Express Transit Relay

Specific Visa + Express Transit config let attackers relay an active wallet from a victim's pocket to a payment terminal up to several thousand £ per tap.

§ Where this technique fits

NFC-APPLE-PAY-RELAY is catalogued under the Lateral Movement tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 4 on average.

§ Dossiers chaining this technique

Apple Pay Express Transit relay → high-value contactless fraud
Specific configuration (Express Transit + Visa) allowed contactless transactions over £1k without unlock or per-tx auth. Two devices relayed the wallet from victim's pocket to a real terminal.
step 4 / 6

§ What commonly comes next

01
Contactless Limit Bypass
NFC-LIMIT-BYPASS · Impact
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Apple Pay Express Transit relay → high-value contactless fraud

§ What commonly comes next