Can Someone Steal Money From Your Locked Phone? The Truth Every Nigerian Must Know
A scientist just drained $10,000 from a completely locked iPhone — no PIN, no Face ID, no warning. If you use Kuda, OPay, PalmPay, or any banking app in Nigeria, this story is your business.
Imagine your phone sitting in your pocket. Screen off. Locked. You haven't touched it in ten minutes. And yet, someone nearby — with a small device the size of a TV remote — is quietly processing a million-naira transaction from your account without triggering a single security alert.
That is not a scene from a thriller. In April 2026, it happened live on YouTube in front of millions of viewers.
A popular science channel called Veritasium approached YouTuber Marques Brownlee — also known as MKBHD — placed a custom device near his locked iPhone, and processed a $10,000 Apple Pay transaction. No fingerprint. No passcode. No confirmation prompt. MKBHD watched in stunned silence as the payment went through in seconds.
Apple Pay is not available in Nigeria. But the lesson buried in that shocking demonstration reaches directly into your Kuda wallet, your OPay account, your GTBank app, and your crypto wallet. Because the flaw that made this possible is not specific to Apple. It is baked into the way modern payment systems think about security — globally, and right here in Nigeria.
This post breaks down exactly what happened, why it matters for you, and the specific steps you can take today to protect your money.
What Actually Happened? The $10,000 iPhone Experiment Explained
To understand the hack, you first need to understand a feature called Express Transit Mode.
In cities like London or New York, commuters tap their iPhones on subway gates dozens of times a day. Unlocking your phone every single time would be slow and frustrating. So Apple introduced Express Transit Mode — a setting that allows the phone to process transit payments while completely locked. No Face ID required. No passcode. Just tap and go.
It sounds harmless. After all, it was designed for small, routine payments. The problem, as researchers from the University of Birmingham and University of Surrey discovered back in 2021, is that the system has no real limit on the payment amount — and can be tricked.
Here is how the attack works. Using a small, commercially available piece of NFC (Near Field Communication) radio equipment, an attacker places the device near the target iPhone. The equipment broadcasts a special signal — the same kind of signal a real subway gate sends. The iPhone, believing it is paying a transit gate, bypasses all its usual authentication. At the same time, a separate device relays that transaction to a regular payment terminal. The victim's phone thinks it is doing something routine. The money goes to the attacker's terminal instead.
Veritasium's video simply brought this five-year-old research to life in the most dramatic way possible — demonstrating it on one of the most famous phones in the world, in front of a global audience.
"It's Not a Bug, It's a Feature" — The Most Dangerous Idea in Finance
Here is the part that should concern every fintech user, not just iPhone owners.
This hack did not work because someone found a hidden crack in Apple's code. It worked because the system did exactly what it was designed to do — process payments quickly, without friction, without asking questions. The vulnerability was not created by a mistake. It was created by a deliberate design decision.
This is the core lesson: every time a payment system chooses convenience over security, it is making a trade-off on your behalf — often without your full understanding of what you have agreed to.
- Express Transit Mode: Pay without unlocking. Convenient — and exploitable.
- Quick Transfer on banking apps: Send money in two taps. What happens if your phone is in the wrong hands?
- "Remember this device" on fintech apps: Skip your PIN. Your PIN becomes useless the moment your phone is stolen.
- Biometric login without transaction limits: One fingerprint can move any amount, instantly.
The iPhone hack is simply the most dramatic public demonstration we have seen of what this trade-off can cost you. The same principle operates quietly inside every app on your phone right now.
Why This Matters Directly for Nigerian Fintech Users
Nigeria is one of the fastest-growing mobile money markets in Africa. The Central Bank of Nigeria's cashless policy has pushed tens of millions of Nigerians onto digital payment platforms. OPay, Kuda, PalmPay, Moniepoint, Carbon, and the major bank apps now handle hundreds of millions of transactions every month.
Every single one of these platforms faces the same fundamental tension: the easier they make it to send money, the easier they accidentally make it for the wrong person to send your money.
Consider these real Nigerian scenarios — no advanced hacking required:
- Your phone is unlocked and handed to someone to "make a call." They open your OPay app before returning it.
- You enable fingerprint login on your banking app. Someone places your finger on the sensor while you are asleep or distracted.
- You pay with a QR code at a market stall. Someone has replaced the merchant's legitimate QR code with one pointing to their own account.
- Your daily transfer limit is set to the maximum "for convenience." One security breach, and everything goes.
None of these scenarios require the equipment Veritasium used. They require only opportunity — created by the same convenient, frictionless design choices that made the iPhone hack possible.
The Nigerian Threat You Need to Worry About Even More: SIM Swap Fraud
While NFC attacks require specialized equipment and physical proximity, there is a threat far more common in Nigeria that runs on exactly the same principle — exploiting the convenience features we take for granted.
SIM swap fraud is when a criminal contacts your mobile network — MTN, Airtel, Glo, or 9mobile — impersonates you, and convinces them to transfer your phone number to a SIM card they control. Once they have your number, every OTP (one-time password) your bank sends goes directly to them. They reset your passwords, take over your accounts, and empty them — often in under thirty minutes.
SIM swap has cost Nigerians billions of naira and remains one of the most active financial crimes in the country. It works because our banking systems use phone numbers as the ultimate proof of identity. Your number is the master key. Whoever holds your number, holds your money.
How to Protect Your Money on Your Phone Right Now
Here is a practical checklist every Nigerian mobile money user should work through this week. None of these steps require technical knowledge. They take less than thirty minutes in total.
- Turn off NFC when you are not using it. On most Android phones: Settings → Connected Devices (or Connections) → NFC → toggle OFF. Only enable it when you specifically need to tap-to-pay. This closes the direct equivalent of the Apple Pay vulnerability on your device.
- Disable "Quick Pay" or "Express Payment" on all your apps. Open every financial app and look for settings that allow payments without a PIN or fingerprint. Turn them off. The extra two seconds of authentication is worth more than the convenience.
- Set a realistic daily transaction limit on every account. Every major Nigerian bank and fintech app allows you to cap your daily outgoing transfer amount. Set it to what you actually need for daily life — not the maximum. This limits the damage even if someone does get in.
- Enable instant SMS and push notifications for every transaction. This does not stop fraud, but it gives you the fastest possible chance to detect it and contact your bank before more money moves.
- Use a dedicated SIM card exclusively for banking. Never share this number publicly. Do not use it on social media, WhatsApp group chats, or online registrations. The less visible your banking number is, the harder it is to SIM swap.
- Never leave your phone unlocked with someone else. If you need to hand your phone to someone, lock it first. This simple habit costs you nothing and closes a surprising number of attack opportunities.
- For crypto: use a hardware wallet for significant amounts. Hot wallets like Trust Wallet and MetaMask are connected to the internet and therefore vulnerable. Any amount of crypto you do not need immediate access to should be moved offline.
The Bigger Lesson: Understanding Your Tools Is Your Best Defence
The $10,000 iPhone hack went viral because it was dramatic, public, and alarming. But the real insight it gives us is quieter: the financial systems we rely on are built to prioritize our convenience, sometimes at the expense of our safety. And that choice has real consequences for real people.
In Nigeria, where mobile money adoption is accelerating rapidly and digital financial literacy is still catching up, understanding what you enable on your apps is not a technical skill — it is basic financial self-defence. Read the settings on your banking apps. Know what each toggle actually does. Turn off what you do not need.
Fraudsters — whether they are using NFC hardware in London or conducting SIM swaps from a city near you — are looking for the same thing: the gap between what a system was designed to allow and what you actually intended to authorize. Your job is to make that gap as small as possible.
Take ten minutes tonight to go through the checklist above. Check your NFC settings. Review your transaction limits. Confirm your authentication requirements on your most-used apps. Then share this post with one person in your family or on your contact list who may not have thought about this yet.
Your money is only as safe as your weakest security setting. Make sure that setting is strong.
Found this useful? Help protect someone else.
Share this post with a friend or family member who uses OPay, Kuda, PalmPay, or any mobile banking app. One conversation could save them a very painful lesson. And follow The DeFi Counsel on all socials for more practical guides on keeping your money safe in the digital age.
Post a Comment
Drop your Thoughts Here