iOS Express Transit (quick transit-payment function) plus VISA's lack of requirement for asymmetric (public/private key) in certain situations is a big security hole known since 2021 that is vulnerable to MitM attacks. https://www.youtube.com/watch?v=PPJ6NJkmDAo