The Secret Spy Tech Inside Every Credit Card

0:00 Watch what happens if you take a credit

0:02 card and stick it in a beaker of acetone.

0:04 Nail polish remover basically?

0:05 Nail polish remover.

0:06 Okay.

0:07 [Henry] It does start to work very quickly.

0:09 [Marques] That is crazy.

0:12 [Henry] This is one that we started about 30 minutes ago.

0:14 We'll do a little-- That's a credit card from 30 minutes ago?

0:18 [Henry] Yeah.

0:19 [Marques] Why does it look, okay, so I see this like,

0:21 this like frame on the inside now.

0:23 [Henry] Yes.

0:24 [Marques] Is that all antenna bands basically?

0:27 Exactly.

0:27 That's the antenna.

0:28 And the chip right there in the middle.

0:30 And what we're gonna do now is show it's still working.

0:37 [Marques] Ah.

0:37 Okay.

0:38 [Henry] Oh, that's the important part, all right.

0:40 [Marques] That's it.

0:40 [Henry] Yeah, that's your credit card.

0:42 Theoretically, if you just touch that here, I think it would work.

0:46 Come on, little card.

0:47 You can do it.

0:49 You still have $20.

0:50 You gotta believe.

0:51 I guess that's why the antennas are so important.

0:53 Yeah, right?

0:54 (phone beeps)- [Henry] Right, with the antenna, it works now.

0:58 That worked?

0:59 Wow!

1:00 How cool is that?

1:02 This is just one of the technologies hidden inside a credit card.

1:06 And you can trace its origins back

1:08 to a top secret CIA counter surveillance operation.

1:13 In this pair of videos,

1:14 we're going to uncover all of the credit card's hidden features

1:17 and put them to the test to see how secure they really are,

1:21 including attempting to steal $10,000 from MKBHD's locked iPhone.

1:26 That's a lot of zeros.

1:27 Careful with that.

1:28 Oh my God.

1:29 I don't like that at all.

1:32 (chuckles)- [Derek] In 1945, at the end of the Second World War,

1:35 a group of Soviet school children visited the US ambassador to the Soviet Union.

1:39 They presented him with a hand-carved plaque,

1:42 of the great seal of the United States,

1:44 a gift to acknowledge the country's recent alliance.

1:48 The ambassador proudly displayed the plaque in his office.

1:51 But what he didn't know was that hidden

1:53 inside was a secret listening device, a bug.

1:57 This bug was the first of its kind.

1:59 It had no battery, no plug point, no power source of any kind.

2:03 So when the US counter surveillance team swept the office,

2:06 they couldn't find it.

2:08 In fact, the bug remained undetected for years.

2:12 But then in 1951, something strange happened.

2:15 An operator at the nearby British embassy was

2:18 monitoring Soviet radio channels when he heard people speaking,

2:22 not Russian, but English.

2:24 English that was coming from inside the US ambassador's residence.

2:29 But despite multiple sweeps of the building,

2:31 the Americans couldn't find any hidden listening devices.

2:34 Then in 1952, they detected a radio signal coming from the ambassador's office.

2:40 They said, "It's coming from over there behind that plaque on the wall."

2:43 And they took the plaque down and put it down somewhere,

2:46 so they tore all the plaster out,

2:48 trying to find the microphones that were hidden in the wall.

2:50 Of course, there was nothing.

2:51 Absolutely nothing.

2:52 Joseph Bezjian, who was a total hero,

2:55 pointed at the plaque and said, "Don't say anything.

2:59 Just come outside and let's talk." And then they said, "Right,

3:03 let's take it to bits."- [Derek] They prized open the seal,

3:07 and to their horror, discovered the bug.

3:10 It looked simple, an antenna attached to a small copper cavity.

3:16 But what made this device so hard to detect was that it had no power source.

3:21 It laid totally dormant until it was activated remotely by the Soviets.

3:28 To see how it works, we're gonna simulate sending some radio waves

3:31 at the bug and monitor any signal we get back.

3:34 We'll start at 800 megahertz and then gradually ramp up the frequency.

3:38 At first, nothing much happens, but then around 900 megahertz,

3:44 we get a strong signal back.

3:46 That's because as the radio waves hit the antenna,

3:49 their electric field tugs on the electrons inside,

3:52 causing them to oscillate and create an alternating current inside the antenna,

3:56 which in turn re-radiates a signal out.

3:59 At most frequencies, that signal is very weak, but around 900 megahertz,

4:03 each push from the radio waves lines

4:05 up almost perfectly with how the electrons oscillate.

4:08 So each cycle reinforces the last and you get resonance.

4:12 As a result, you get a strongly reradiated signal.

4:17 This resonant frequency is unique to a given object or circuit,

4:21 and it changes based on its electrical properties like capacitance.

4:25 So the Soviets realized they could use this by adding a cavity.

4:29 What we need to do is have a resonant cavity that's very,

4:33 very highly tuned, like a tuning fork for radio.

4:37 (metal chimes) Now, obviously there's a capacitance

4:41 between this end and the sheet,

4:43 and as the diaphragm moves in and out, the capacitance changes,

4:48 so that changes the tuning of this electronic tuning fork.

4:53 [Derek] So as people in the room speak, the sound vibrates the diaphragm,

4:56 and that changes the capacitance between the two plates,

4:59 which in turn alters the resonant frequency.

5:02 So you get a 10-nanometer movement,

5:04 that's enough to move the resonant frequency.

5:06 That changes the amplitude of the radio waves that get reradiated.

5:10 So you end up with this, a return signal that contains the original radio wave,

5:15 but it's enveloped within the sound wave.

5:18 It's a technique called amplitude modulation,

5:20 and it's the same technique used to create AM radio.

5:23 So whenever the Soviets wanted to listen to a conversation,

5:26 they blasted radio waves from outside, likely from a van or a nearby building.

5:31 And then they received the radio wave they got back

5:34 from the bug and extracted the sound information modulating that radio signal.

5:40 The Americans nicknamed the bug "The Thing," since at first,

5:43 they didn't know how it worked.

5:45 It was created by Soviet inventor, Leon Theremin,

5:48 who'd been coerced into building the device

5:50 while imprisoned in a Gulag during the 1940s.

5:54 This is the same guy who invented

5:56 the contactless electrical instrument named after him.

5:59 So what did the president and the CIA do after discovering

6:03 the bug that had been spying on them for seven years?

6:06 They told no one.

6:09 They realized the thing was years ahead of their own spying technology.

6:13 This was new and nobody done this before.

6:16 There were no countermeasures.

6:18 [Derek] So they secretly began working

6:20 on their own enhanced version of the device.

6:26 (bright upbeat music)- [Henry] Meanwhile,

6:27 in the rest of the United States, the post-war economy was booming.

6:30 For the first time, ordinary families could

6:32 afford things that used to be luxuries, TVs, cars, even flights.

6:37 But paying for these expensive items was clunky.

6:40 You either had to carry a huge wad of cash,

6:42 or you wrote a check that might take days to clear.

6:44 So banks saw an opportunity.

6:46 If you could make buying things even easier, then spending could explode.

6:52 [Henry] The first bank to capitalize was Bank of America.

6:54 In 1958, they launched their-- [Announcer] BankAmericard.

6:57 It's money in a more versatile form.

7:00 Allowing customers to buy all kinds of expensive items on credit.

7:04 This was the first universal credit card.

7:06 By the end of the decade, two million cards were in circulation,

7:09 and over 20,000 merchants had agreed to accept it.

7:12 A few decades later,

7:14 this card was being used worldwide under a different name, Visa.

7:19 But these early cards had two main problems.

7:21 First, for each transaction,

7:23 the seller had to physically imprint the card details onto two slips.

7:27 One for the customer, and then one they'd later send to the bank.

7:30 That's why the numbers on older cards are slightly raised.

7:33 However, this whole process was inconvenient for the customer,

7:36 who was still used to just handing over cash,

7:38 but it was even more inconvenient for the seller.

7:40 They had to mail all these slips to the bank or take them over themselves.

7:43 The bank would then visually inspect them in order to authorize a payment.

7:46 This meant that it could take days before

7:48 the seller actually received the funds in their account.

7:51 So that first problem was speed.

7:53 And this actually led to the second problem, security.

7:57 A criminal could buy something with a stolen or counterfeit card,

7:59 and by the time the banks realized they'd been defrauded several days later,

8:03 well, the criminal was long gone.

8:05 And as criminals got smarter, fraud kept growing.

8:08 By the late '60s, credit card fraud was costing the banks $100 million a year,

8:13 around a billion in today's money.

8:15 So the banks needed to make a better system,

8:18 one that was faster, but also more secure.

8:22 Back at CIA headquarters, they were facing a similar problem.

8:26 To enter the building, staff presented an ID card to a guard who

8:30 would inspect it and decide whether to let them in.

8:33 This process was slow and all the information was clearly visible on the cards.

8:37 So if you think about it,

8:38 it wouldn't be that hard for a card to be cloned by, say, a Soviet spy.

8:43 Then in the early 1960s,

8:45 they wanted to create a more secure ID card for CIA officials,

8:49 and to do that, they brought in IBM engineer Forrest Parry.

8:53 Parry knew that audio cassettes stored their information on magnetic tape,

8:57 and he wondered if he could use the same tape to store data on the ID cards.

9:01 He managed that part easily enough, but no matter what he tried,

9:05 he couldn't get the tape to stick to the cards.

9:07 It would just keep falling off.

9:09 Frustrated, he shared the issue with his wife while

9:12 she was doing the ironing, and legend has it,

9:14 she suggested just ironing the tape onto the card,

9:17 and the idea quite literally stuck.

9:22 So what's very interesting about magnetic stripes,

9:24 and this is an old card from our fellow writer, Casper,

9:27 and what we're gonna do is we're gonna show that if you

9:29 get a little bit of iron filings on the back of this card,

9:31 we're just gonna run it through here.

9:33 So you kinda see it's like sticking to that magnetic stripe.

9:35 Yeah.

9:36 Right?

9:36 And if we knock off a bit of this, you see there's sort of ones and zeros.

9:41 [Marques] Just because it's magnetic.

9:42 [Henry] Yeah.

9:43 So you can read a magnetic stripe with only magnetic filings.

9:46 I don't know, I guess that makes perfect sense.

9:48 Right, okay.

9:49 But you can also see how simple it is, right?

9:51 At the end of the day, it's just ones and zeros, you know, in a code.

9:55 And that code can be read by this machine

10:00 So that is all the information there, Casper Mebius.

10:03 Oh, yeah.

10:04 Yep.

10:05 That's the name, the card number?

10:07 Yeah, right there.

10:08 The first magnetic stripe credit cards were rolled out in 1970.

10:12 These new cards slashed the time required to process transactions.

10:16 Not only did that make spending way easier, but it became easier for the bank

10:20 to quickly identify and block suspicious payments.

10:24 So these new cards seem to solve the problem,

10:26 speed and security, and that's what today's sponsor Saily is all about.

10:29 And right now I'm traveling to New York, and when I touch down,

10:32 I'm gonna use Saily to make sure that I'm seamlessly connected when I land.

10:35 All you have to do is first download the Saily app,

10:37 then you're gonna search for your destination,

10:38 I'm gonna select the United States,

10:39 and then you pick a data plan that fits your trip.

10:41 And then right here at checkout,

10:42 you can apply the code Veritasium to get 15% off on your order.

10:46 And the best part of this is the moment I touch down,

10:48 I can just use my mobile data as normal.

10:50 I can open Maps, call an Uber,

10:52 or call my mom to let her know that I got there safely.

10:54 All this without rushing to get on airport

10:56 Wi-Fi or any other unsecured public network, or waiting in line for a local SIM,

11:00 or relying on hefty fees that your carrier charges for roaming.

11:03 It's also so much better than swapping tiny physical SIM cards.

11:06 Once the Saily eSIM is installed,

11:08 you don't have to install a new one when you visit different countries.

11:10 You just go into the app and you can change it there.

11:12 And Saily offers plans across over 200 different destinations.

11:16 So if you're traveling across multiple countries,

11:18 get a regional plan or a global plan.

11:20 And the Saily Ultra Plan takes convenience even further.

11:23 It gives you unlimited data and special perks like access to airport lounges,

11:28 fast track services, and advanced online security tools.

11:31 So download the Saily app via the QR code that's on screen,

11:34 and when you're at checkout, use code Veritasium,

11:36 and then you can share your own referral code

11:37 with your friends to get even more off your next trip.

11:40 I wanna thank Saily for sponsoring this video, and now back to the show.

11:43 So, these new cards seem to solve the problems of speed and security,

11:48 but this magnetic stripe had a critical weakness.

11:51 This is how you read credit cards, but also you can write to them, right?

11:55 So this is just a blank card.

11:57 So if we get some, like, magnetic dust on there, it's not really doing anything,

12:03 but if we write to this one, let's try reading it and see if we got anything.

12:08 Oh, it's reading as if it's the same Casper's

12:11 card with the 0009 and the super long stripe number.

12:14 Exactly.

12:14 So does that mean if you put magnetic filings on it now it

12:17 will show that it's written-- [Henry] So now you see we're getting something.

12:22 [Marques] Yeah, yep.

12:24 But you can, like, line them up and you can see that they're the same code.

12:27 Maybe it's a little hard to see in the light.

12:31 Cloning cards in this way and then using that to steal money was

12:33 so easy and so effective that some people made entire businesses out of it.

12:37 Back then, right, we would have what we call a grabber, which is a card reader.

12:42 I ended up having, like, 300 people working for me in restaurants, bars.

12:47 [Henry] This is Tony Sales, co-founder of We Fight Fincrime,

12:51 but around 20 years ago, he had a different title, Britain's greatest fraudster.

12:56 I'd give them a grabber, yeah,

12:58 and I'd just say to them, "Just swipe the numbers.

13:00 Just when someone comes to pay, swipe their card,

13:03 then swipe that one on there." You know,

13:05 I'm gathering thousands and thousands of numbers weekly.

13:09 But I'm also becoming a wholesaler of the numbers.

13:12 You know, at 16, I was paying, like, loads of people, 300 quid a week wages.

13:17 The problem is that the data on that magnetic stripe is static.

13:21 So if you have a skimmer,

13:22 you can clone the card in seconds and then reuse it again and again,

13:26 draining the funds before the card owners realized.

13:29 Yeah, well, I had half a million quid under my bed, didn't I, at 16?

13:32 It's crazy how easy it was.

13:35 [Henry] By the early 2000s,

13:36 card fraud was costing the UK over 400 million pounds a year,

13:40 and the single biggest culprit was magnetic stripe skimming.

13:44 The UK was just getting hit massively with credit card fraud.

13:50 So the biggest card networks got together to solve the problem.

13:53 They created the EMV standard,

13:56 a 700-page document that defined how to make secure card payments.

14:01 The result was this, the chip.

14:05 (lively music) It's what you use every time

14:06 you enter your card to a payment terminal, and then you enter the pin.

14:10 In other words, chip and pin.

14:12 Now, the way the chip works is fundamentally different from the magnetic stripe.

14:16 That's because the magnetic stripe encodes information statically,

14:18 so every time you use it,

14:20 it sends the same information first onto the card reader,

14:23 then onto the issuing bank.

14:25 But the chip is different.

14:26 That's because it's basically a mini computer.

14:29 So it can encrypt its information using a secret

14:31 key known only by itself and the issuing bank.

14:34 When you insert the chip,

14:35 the reader sends it a long message containing all the transaction

14:38 details as well as a long random number generated by the reader.

14:42 The chip then uses its secret key to garble the message into a unique code,

14:46 which it sends back to the reader.

14:48 The reader then forwards this onto the bank,

14:50 along with the raw transaction details and the random number.

14:54 The bank then applies its own key to the raw data as well,

14:57 and if the output matches the code from the card,

14:59 well, the bank knows the transaction's valid.

15:02 Then, and only then does the bank authorize the transaction.

15:06 This process makes the chip more secure for two reasons.

15:10 First, each transaction creates a new, unique code,

15:12 so you can't steal a code and reuse it.

15:15 Second, a chip is incredibly difficult to clone.

15:18 That's because its secret key is never revealed in a transaction,

15:21 and it's stored in memory cells buried deep within the chip silicon.

15:26 Now, to extract the secret key,

15:27 you'd have to pry open the card, strip away layers of silicon,

15:31 and then overcome multiple countermeasures designed

15:33 to destroy the data if tampering is detected.

15:36 It is theoretically possible, but it would take days of work,

15:39 hundreds of thousands of dollars of specialist equipment,

15:42 so it's not really practical, unless, of course,

15:44 you get your hands on a billionaire's credit card.

15:46 With the move from the mag stripe to the chip,

15:48 the easiest way to commit fraud was just to steal a card.

15:52 That's why banks paired each chip with a four-digit pin,

15:55 known only to the card holder.

15:57 But stealing PIN numbers is not very difficult,

16:00 and there are multiple ways in which a PIN number

16:03 could be stolen from you before your card was then compromised.

16:06 Over the shoulder at the ATM,

16:08 with a hidden camera at the ATM, all these types of different things.

16:12 [Henry] It's not that hard, but it's much harder than just forging a signature.

16:16 When chip and pin comes in, our business is dead in the water.

16:20 But then it weren't because America didn't adopt it till much later,

16:25 so now we can sell them in the States.

16:27 Chip and pin was introduced in the UK in 2003, and over the next seven years,

16:32 counterfeit fraud in the UK fell by 63%,

16:35 leading to a 27% decline in fraud overall.

16:38 But over the same period, US card fraud increased by 70%.

16:44 It took until 2013 for a huge wake-up call.

16:47 Criminals stole 40 million card numbers from the superstore chain Target.

16:52 They used the details to create cloned cards,

16:54 which they then swiped around the country.

16:57 Finally, the US began to recognize the need to shift to chip and pin.

17:01 And as EMV chip cards were rolled out more widely over the next few years,

17:05 counterfeit fraud dropped by 76%.

17:09 But the improved security came at a price.

17:11 The time it took to do a transaction more than doubled,

17:14 adding on average around 10 seconds onto each transaction.

17:18 That may not sound like much, but if you consider all the transactions taking

17:21 place across the country, it soon adds up.

17:24 In the US, it's been estimated that chip and pin

17:26 added about 116 million hours every year waiting at cash registers.

17:31 That's why businesses care so much about

17:33 the tiniest bit of friction to spending.

17:36 For example, it's been found that one-click

17:38 checkouts online can increase spending by almost 30%.

17:42 So now the banks switched their attention from security back to speed.

17:46 And they began to wonder.

17:48 What if you could take a second off of every transaction?

17:50 What about two?

17:52 What if you could make each transaction basically

17:54 instant without having to make contact at all?

17:57 Well, that would require sending a signal across a distance

17:59 and then getting back a reply at the speed of light.

18:02 Kind of like the Soviets did with 'The Thing',

18:05 which brings us back to the CIA in the 1950s.

18:08 While reverse engineering the Soviet device,

18:11 the Americans realized its design had one major flaw.

18:14 The main issue with it is that it is so hypersensitive to disturbance,

18:20 they would have to retune and recalibrate every time

18:23 the room temperature changed drastically or somebody slammed a door.

18:27 The device is tuned to work over a small range of frequencies.

18:30 If the transmission signal is too close to the resonant frequency,

18:33 the change in amplitude due to the movement

18:36 of the diaphragm is too small to detect.

18:38 The same is true if it's too far away from the resonant frequency.

18:42 Therefore, you only get enough sensitivity in this tiny region,

18:45 either side of the resonant frequency.

18:48 So the Americans set about creating something more robust,

18:51 something that wasn't so reliant on this ultra-precise frequency.

18:55 And to do that, they stopped thinking about

18:57 radio waves as something they could modify with sound,

19:00 and instead, they started thinking of radio waves as a source of power.

19:05 So inside the device, they added a rectifier,

19:08 which converted the alternating current from the antenna into a direct current.

19:12 And they used that to power a hearing

19:16 aid amplifier with a tiny little microphone.

19:18 [Derek] This amplified microphone output was sent back to the antenna,

19:22 which created a modulated return signal that was

19:25 sent out and could be picked up.

19:27 That microphone and the antenna and everything

19:30 else was hidden inside pieces of furniture.

19:33 They tried it inside the hollow legs,

19:36 they actually drilled holes lengthwise through the legs of the furniture.

19:39 They compromised a furniture factory to be able to do

19:43 this, a stunning piece of work that one was.

19:45 [Derek] This became known as Project Easy Chair,

19:48 and the CIA used it to get back at the Soviets

19:51 by planting their own listening device in the Soviet embassy in the Hague.

19:57 (horn honking) It wasn't until the 1970s

19:59 when a former rocket engineer, Mario Cardullo,

20:01 gave this technology a modern twist to solve a problem involving toll booths.

20:06 Throughout the States, cars had been queuing to pay for years.

20:10 To speed up the process and reduce queue times,

20:12 Cardullo invented a small tag that could be used to identify a vehicle remotely.

20:18 The tag had two key components,

20:20 a coil of wire to act as the antenna, and a chip.

20:23 Like the bugs, the antenna receives a radio

20:26 wave as it passes through the toll booth.

20:28 That creates alternating current,

20:30 which passes through a diode to power the chip.

20:32 The chip then flips a series of transistors on and off,

20:35 which subtly alters the current in the antenna.

20:38 This modulates the radio wave, encoding the ID number of the card,

20:42 which the antenna sends back to a reader in the toll booth.

20:45 So the process is almost identical to the Cold War spying devices,

20:49 but whereas they relied on sound to modulate the wave,

20:52 here it's a tiny circuit inside the chip.

20:56 This technology is called radio frequency identification, or RFID for short.

21:00 And today, it's used in toll booths,

21:03 clothing stores, and warehouses all over the world.

21:06 (device beeps)- And also, your credit card.

21:09 This is a credit card that we're gonna go try to buy lunch with.

21:11 You guys take tap?

21:14 Yeah.

21:15 This is a credit card.

21:16 Yeah, yeah.

21:17 And we're gonna see if it works.

21:19 Okay, yeah.

21:19 Where do I put it?

21:21 Don't lose it.

21:22 That's pretty cool, eh?

21:24 I ran it through the wash.

21:26 But there is one more important difference in the way credit cards work.

21:29 See, some of these other RFID devices function over ranges of 10 meters or more.

21:34 But for a credit card, that's just not how you want it to work.

21:37 You don't wanna accidentally trigger a transaction from meters away.

21:41 (device beeps) So the card providers had to find a way to shorten the range.

21:44 The solution was to stop relying on radio waves,

21:47 and instead to rely on magnetic fields.

21:50 Inside a card reader is a small coil.

21:53 When you pass an alternating current through this coil,

21:55 it creates a changing magnetic field.

21:57 Then if you move your credit card close enough so

21:59 that the changing magnetic field cuts through the card's antenna,

22:03 well, it induces an alternating current in the antenna.

22:06 And you can see this in action using a special chip with an LED.

22:09 This is one of those chips.

22:11 What's very interesting is, like, that these chips don't have batteries in them.

22:15 If I come in with the reader,

22:16 if you watch really closely, you'll see it'll start to light up.

22:20 Yeah, there you go.

22:22 See?

22:23 Yeah, so that's showing that all the power is coming from the reader.

22:27 That current passes through a diode to power the card's chip.

22:31 The chip then alters the current in its antenna.

22:33 This modulates the magnetic field around the antenna,

22:35 which the coil in the reader detects.

22:37 That modulated signal carries the unique code for that transaction,

22:41 which the reader then sends onto the bank.

22:43 Cryptographically, this works just like chip and pin.

22:46 Except now, instead of using metal contacts,

22:48 the chip and reader communicate through a shared magnetic field.

22:52 This technology is called near-field communication, or NFC,

22:56 and it's what powers all contactless credit cards today.

22:59 The first contactless payment cards were launched in the mid-2000s,

23:02 around the same time as chip and pin,

23:04 but contactless took much longer to catch on, particularly in the United States.

23:09 Customers were cautious,

23:10 and banks were waiting for enough retailers to get the right card readers,

23:13 while retailers were waiting for enough customers

23:15 to get the contactless cards from the banks.

23:18 That all changed in 2020.

23:20 Suddenly, touching keypads and handing over cards felt risky.

23:23 And tap to pay meant you could avoid physical contact altogether.

23:27 So in the first three months of 2020,

23:29 global contactless transactions grew by over 40%.

23:33 And over that same year, contactless payments in the US grew by 150%.

23:38 And so, along comes contactless.

23:41 And the first thing that struck me was,

23:44 what if you could read a contactless card through somebody's pocket?

23:49 This is a Flipper Zero.

23:50 One thing it does is has an NFC reader in there.

23:53 Okay.

23:53 So we're just gonna put a little read,

23:55 do a little tap, and then you get the credit card information.

23:59 [Marques] It pulled the card number, the expiration.

24:02 [Henry] So this seems kinda crazy, right?

24:03 That you can just go up and tap

24:04 and get any information about any card that simply.

24:06 [Marques] That was pretty quick, yeah.

24:07 But the same thing can be done with any old land NFC cable device.

24:12 Like, I have a credit card reader app right here.

24:16 And so there you go.

24:20 [Marques] It's the same card number right there.

24:22 But in terms of credit card fraud,

24:24 that's actually a lot less useful than you might think.

24:26 The chip secret key is never revealed in any sort of communication,

24:29 and without that, you can't clone the card.

24:31 Now, you might think to use the card details in an online transaction,

24:34 but for that, you need the CVV,

24:36 three-digit code that's not stored on the chip itself.

24:39 It's actually only written on the back of the card physically.

24:42 So if you wanna read that number,

24:43 you're gonna have to find a way to socially engineer that number out of someone.

24:47 But the truth is that if I can clone a card by getting close to it,

24:52 then I can almost certainly video that card as well.

24:55 I take a photograph of that card.

24:57 That three-digit number on the back is on the back.

24:59 So if I can get access to the card to clone it,

25:02 all I gotta do is add the extra step to get access to the card to see it.

25:06 But there's an even easier way to commit contactless fraud.

25:16 This is called digital pickpocketing or ghost tapping, and when I tried it,

25:20 I found you had to be within about two centimeters of the victim's pocket.

25:23 But in most countries, contactless transactions have an upper limit,

25:27 so you can only lose so much in a single transaction.

25:31 In the UK, that's grown over time to 100 pounds.

25:34 But what if you could do it thousands of times?

25:38 [Henry] That's exactly what a 36-year-old woman thought in Italy in 2025.

25:42 She was arrested after tapping money from unknowing

25:44 tourists in the busy streets of Rome.

25:47 And crowded places like this could

25:48 be vulnerable to even more sophisticated scams.

25:51 So what if you were to put a contactless reader into a public space, like,

25:56 for example, between the walkway where you go

25:58 through into the subway or the underground, right?

26:00 You have to go through a narrow space.

26:02 What if I could hide a reader in there?

26:03 Or if enough people have cards in a pocket at the right position,

26:07 I could maybe read hundreds or thousands of cards a day.

26:10 [Henry] And while most countries do limit the amount

26:12 you can pay in a single tap, the US doesn't.

26:15 So in a single tap, you could lose thousands of dollars.

26:20 One way to protect against digital pick pockets

26:22 is keeping your cards in a Faraday cage wallet,

26:25 or having multiple cards next to each other also

26:27 makes each individual card a lot harder to read.

26:30 But of course, that's not much use if you lose your card or it gets stolen.

26:33 What happens when you make a payment?

26:36 Do you get a notification on your phone?

26:38 Does the bank tell you?

26:39 'Cause the banks will offer that service, and you should do it.

26:43 And I think if everybody watching this, I watch, you know,

26:45 I watch Veritasium, by the way, I'm a fan, I like them a lot.

26:49 With the millions of people you have watching it,

26:50 if you can get half of those people just

26:52 to go onto their phone app and put notifications on.

26:55 If you do that, you will have the biggest impact

27:00 on vulnerability when it comes to contactless payment than anybody.

27:05 With notifications on, you can contact your bank

27:07 as soon as you spot a suspicious payment.

27:10 But why not go one step further and transfer

27:12 all your cards to the mobile wallet on your phone?

27:15 There, your real card numbers aren't stored, so they can't be stolen.

27:19 And even if you lose your phone,

27:20 your card is safe, protected by fingerprint or facial recognition.

27:23 It seems like the mobile phone is the perfect blend of speed and security.

27:28 But the thing is, tap to pay has evolved far beyond its original design.

27:33 Over the last 20 years, new features have been added,

27:36 some for security, others for convenience, and that convenience comes at a cost.

27:42 Coming soon to Veritasium.

27:44 I'm here with MKBHD,

27:45 and we're gonna try to steal $10,000 from his locked iPhone.

27:49 Really hope it doesn't work.

27:50 I really hope it doesn't work.

27:51 I'm gonna get you to put that phone down on top of this device.

27:54 This is just a regular payment terminal.

27:55 Nothing weird about that.

27:57 Careful.

27:58 Careful with that, careful, careful.

28:00 That's a lot of zeros.

28:02 Careful with that.

28:03 Oh my God, okay.

28:04 Do you even think it's possible, firstly, $10,000?

28:07 I don't know if Apple Pay will let you do that.

28:11 Let's see, let's see if it works, I feel like I'm a bit of a magician,

28:13 but I'm like, I haven't changed anything, right?

28:15 [Marques] Okay, yeah.

28:16 It's still locked.

28:17 It's locked.

28:18 [Henry] Nothing else.

28:18 Yeah.

28:19 Okay.

28:19 We're gonna start the script again.

28:27 (dramatic music) (phone beeps)- [Marques] What just happened on my phone?

28:31 (Henry laughs)