Can Someone Steal Money From Your Phone With Apple Pay? Banks Say Every Payment Needs Your Face or Passcode

Someone who steals an iPhone cannot simply tap it on a card reader and spend the owner's money, banks say. NatWest says every standard in-store Apple Pay payment on an iPhone or iPad needs Face ID, Touch ID or the device passcode before it goes through at the till.

That protection has limits. Apple's own guidance lists an exception for compatible payment or travel cards set to Express Mode, which can be used for public-transport journeys without authentication. It also confirms a thief who knows the passcode can still pay. In one UK case, more than £11,000 ($14,730.50) went through Apple Pay on a stolen phone within hours.

What the Banks Say

NatWest says an Apple Watch asks for its passcode whenever the owner puts it on. Shops never see the customer's card number or identity, the bank adds. Neither the phone nor Apple's servers store the real card number. Santander Bank in the US says the checks also cover a Mac or iPad. Because of Face ID and Touch ID, it says, 'only you or registered users can approve a purchase.'

Apple says the phone holds a stand-in card number in a sealed chip. Each payment gets a one-time security code. If fraud happens, NatWest promises Apple Pay users the same protection as card holders, 'provided you take appropriate care.' Such conditions get tested. In the £11,000 case, the Financial Ombudsman Service made business banking provider Tide refund every disputed payment, accepting a thief could have accessed the phone.

Where the Gaps Are

The first gap is Express Mode, which lets a chosen travel or payment card work at ticket gates without Face ID or a passcode. Apple lists it as the only exception to those checks. The second gap is the passcode that unlocks the phone. Apple's Stolen Device Protection, introduced with iOS 17.3, adds biometric checks for some actions and a one-hour delay before certain security changes when the iPhone is away from familiar locations. The company's support page is plain about payments, as the graphic below shows.

'You can still use your iPhone passcode for purchases with Apple Pay,' Apple says. Away from familiar locations, it requires Face ID or Touch ID, with no passcode fallback, to access saved passwords or payment methods in Safari's AutoFill. Changing the Apple Account password away from familiar places also triggers a one-hour wait. That delay gives owners time to mark the phone as lost and secure their account.

What to Do If a Phone Is Stolen

If Find My was on, Apple says using Lost Mode suspends Apple Pay without cancelling the cards. They work again if the phone turns up. Owners can also remove them from their Apple Account page. Wiping the phone remotely through Find My removes them too.

Stolen Device Protection may already be on, Apple says, and owners can check under Face ID and Passcode in Settings. NatWest's wallet team answers around the clock. The Metropolitan Police recorded 81,439 phone thefts and robberies in London in 2024 and 71,867 in 2025, down 11.8 per cent.