[mr_toad]

> Surely this researcher was quoted out of context in that it's the Android phone that can be on any continent?

That’s what the article says, as far as I can tell. They still need a radio receiver near the iPhone. The android phone can be anywhere.

I’m not sure how this threat differs from a payment card that doesn’t require a PIN for purchases under $x. Presumably you could use the same attack.

[rawling]

I assume it's just that the AP limit of £1000 is an order of magnitude higher than the limit for a physical card. (Maybe the Transit limit should be lower?)

I would also assume that this is why the article references Samsung Pay but not Google Wallet - the former seems to have a Transit-like option but not the latter?