> You expect me to believe MKBHD keeps a Visa card with $10,000 ready to go as his Express Transit card?
Why wouldn't he? $10k is not a particularly high credit limit in the US, all things considered, and roughly every other card is a Visa card.
Sure, commuter benefit cards probably have a much lower limit, but not everyone has these. Tourists use express transit too; Apple explicitly nudges you to set it up when you arrive in some cities/countries! So I'd bet you can find more than one person with a >$10k limit and express transit enabled per NY subway train on average.
And since the attack works for lower values too, actual attackers would probably just pick a lower value that will sail through the victim's bank's fraud prevention system, but can still cause a lot of headaches for everyone involved.
