Apple’s iOS includes a highly convenient feature within Apple Wallet known as “Express Travel Card” (or Express Transit). This capability allows users to tap their iPhone on supported transit terminals (such as the London Underground or NYC Subway) to pay for a fare without needing to wake the device, unlock it with Face ID/Touch ID, or even double-click the side button. It utilizes near-field communication (NFC) in a persistent, pre-authorized state. While excellent for frictionless commuting, it poses a severe security risk in high-threat environments. If a user’s phone is stolen while active, or if they are subjected to a sophisticated NFC relay attack in a crowded area, the Express Travel configuration can be exploited to authorize unauthorized transactions without any biometric verification.
This guide explains how to completely disable the ‘Express Travel Card’ feature system-wide on an iPhone, ensuring that all NFC payment transactions strictly require explicit biometric authentication.
Disable Express Travel Card via Wallet Settings
To neutralize the pre-authorized NFC state, we must remove all payment methods from the Express Transit configuration within the Wallet settings.
- Unlock the iPhone and open the main Settings app.
- Scroll down and tap on Wallet & Apple Pay.
- Locate the “Transit Cards” section and tap on Express Travel Card (or Express Transit Card, depending on your region).
- You will see a list of your added payment cards. If a card is currently active for this feature, it will have a checkmark next to it.
- Tap on None at the top of the list, or toggle off the specific card that is currently enabled.
- Authenticate with Face ID, Touch ID, or your passcode to confirm the removal of the Express privileges.
Verify the Configuration Lockdown
By selecting “None,” you instruct the iOS Secure Enclave to revoke the persistent NFC authorization state for your payment cards.
To verify the lockdown is active, return to the Wallet & Apple Pay menu and ensure that the “Express Travel Card” status reads as “None.” The iPhone is now cryptographically bound to require explicit biometric authentication (Face ID or Touch ID) or a passcode for every single Apple Pay transaction, completely neutralizing the risk of unauthorized NFC transit charges or relay attacks.