Fraud Rampant In Apple Pay

PvtVoid writes with this report from the New York Times, excerpting: An industry consultant, Cherian Abraham, put the fraud rate [for Apple Pay] at 6 percent, compared with a traditional credit card fraud rate that is relatively minuscule, 10 cents for every $100 spent. [i.e. one tenth of one percent]. The vulnerability in Apple Pay is in the way that it — and card issuers — "onboard" new credit cards into the system. Because Apple wanted its system to have the simplicity for which it has become famous and wanted to make the sign-up process "frictionless," the company required little beyond basic credit card information about a user. Nor did it provide much information to the banks, like full phone numbers and addresses, that might help them detect fraud early. The banks, desperate to become their customers' default card on Apple Pay — most add only one to their iPhones — did little to build their own defenses or to push Apple to provide more detailed information about its customers. Some bank executives acknowledged that they were were so scared of Apple that they didn't speak up.

Comments

Aren't these already compromised cards?

[Galaga88]

The story doesn't really indicate how this could be much of Apple's problem - it sounds like the cards that are getting used are already stolen?

I guess what's happening is criminals are getting stolen CC info, and are then able to use it in a physical environment via Apple Pay where it previously would have required printing a forged card?

The article mentions that it's easier to get away with fraud in person because the lack of shipping delay leaves less time to catch it, which shows why they'd be so eager to jump to a method like this.

Re:Aren't these already compromised cards?

[rgbscan]

This is exactly what it is. Already compromised cards being added as payment token. Banks are supposed to follow a protocol called "Yellow path" to prevent this fraud, but since everyone wants their ApplePay to work right away without having to call a call center, a lot of banks are lenient on the security checks. This is not a problem with Apple's technology, or the secure element on the phone, or the fingerprint reader. This is a bank allowing a card to be added to an ewallet, presumably because the party adding the card has all the relevant info (stolen identity) to make it work.

Re:Aren't these already compromised cards?

[Anonymous Coward]

Apple and banks have little incentive to reduce fraud. Why would they care? No matter what happens, they're not on the hook.

Re:Aren't these already compromised cards?

[Anonymous Coward]

The story doesn't really indicate how this could be much of Apple's problem - it sounds like the cards that are getting used are already stolen?

I guess what's happening is criminals are getting stolen CC info, and are then able to use it in a physical environment via Apple Pay where it previously would have required printing a forged card?

The article mentions that it's easier to get away with fraud in person because the lack of shipping delay leaves less time to catch it, which shows why they'd be so eager to jump to a method like this.

It's Apple's problem because they're not providing enough information to the banks and credit card companies. For instance if it just shows up as "APPLE PAY" on my credit card statement, instead of "AP: WHOLE FOODS FL" it would be hard to catch the fraud that is revealed when you consider that I used my credit card last night in Oregon and hours later via some Apple Pay account at a Florida Whole Foods in person.

Paypal used to have the same exact problem but now provide lots of details on my statement instead of just "PAYPAL."

Re:Aren't these already compromised cards?

[Ronin Developer]

I read another article on this. As the article tries to expose, the fault lies not in Apple Pay, but rather in (as the article suggests), the process by which cards are authorized for use with Apple Pay during the onboarding process. There are two paths, the Green Path and the Yellow Path when authorizing a card. The difference is the types of information collected and passed. Most cards go down the Green path. But, when a card has incomplete information, it goes down the Yellow path and is subject to less stringent and, sometimes, manual intervention. It is down this pathway where the fraud occurs.

While a card is being approved during the Yellow pathway, the card can be used using the card number, expiration date and, not always, the security check value.

It is up to the banks and card issuers to secure their onboarding process. Apple (via Apple Pay) is not responsible for ensuring this takes place. Thankfully, the fraud is easy to detect and remedy. Next year, when our cards all have chips in them, the exposure via the Yellow Path will all be eliminated.

Apple supporters were right to call out Mr. Abraham - he is biased and attempting to create FUD against Apple and Apple Pay. The real fault and finger pointing needs to be directed to the banks and they need to get their houses in order.

Re:Aren't these already compromised cards?

[DogDude]

It's easier to punch stolen numbers into a phone than it is to print up an actual card. When chip + pin happens, all of the criminals will be using Apple Pay.

Re:Aren't these already compromised cards?

[Solandri]

When you use a credit card online or in the store, the merchant can use various information like your address, phone number, the security code printed on the card, your signature, to confirm the card is valid. (The U.S. is finally rolling out EMV smart card chips.) This is actually optional - the merchant doesn't have to do it. But if the cardholder issues a chargeback, the merchant's chances of successfully contesting the chargeback are much better if they've used these options. If you've ever wondered why the gas pump asks for your zip code when you use a credit card, this is why. It's not trying to collect marketing data, it's doing a rudimentary identity check to elevate the chances that you are the card's actual owner.

Anyhow, allowing transactions using only the card numbers themselves is horribly flawed because anyone can just take a photo of a card to get its numbers. So the credit card companies have come up with these other methods to "verify" the card's authenticity. (I put it in quotes because it doesn't actually verify the card's authenticity, just reduces the chances the card is not authentic.) Apparently Apple refused to forward much if any of this information to the banks when a fresh card is first being loaded into Apple Pay, making it easy to load a stolen credit card - easier than actually using the card for a purchase. And the banks were too cowed to make an issue of it, landing them in the mess they're in.

On the one hand it's the bank's fault for not speaking up and pressing a vital security issue. On the other hand it's Apple's fault for being an 800 pound gorilla which uses its market clout to force concessions from its partners. Stuff like this is why you always want at least two strong competitors in a given market - so if one makes unreasonable demands of a business partner, the partner is not afraid to tell them to go jump in a lake. It's the same reason we allow unions - because the hiring employer has a lot more clout than the individual employees.

Re:Aren't these already compromised cards?

[Galaga88]

On the one hand it's the bank's fault for not speaking up and pressing a vital security issue. On the other hand it's Apple's fault for being an 800 pound gorilla which uses its market clout to force concessions from its partners. Stuff like this is why you always want at least two strong competitors in a given market - so if one makes unreasonable demands of a business partner, the partner is not afraid to tell them to go jump in a lake.

I like the looks of Apple Pay, and think it's a great move forward but even as an Apple fan, it seems bizarre for Apple to move forward on their own payment standard rather than the industry creating one. I mean, I know they did it so that they could skim profits off the top, and that they got away with it because they're worth 700 gazillion dollars and could probably make demands of the ocean, but I really wish this had come about via an industry standard.

Of course then, it'd probably suck.

Re:Aren't these already compromised cards?

[jellomizer]

So if you use Apple Pay, you have less of a chance of getting YOUR credit card data stolen... However if your credit card had already been stolen, Apple Pay means there is a higher chance of it getting used. Because you won't need to face someone who may question your identity.

Re:Aren't these already compromised cards?

[znu]

Apple Pay is built on top of standardized front-end payment infrastructure, and competing systems can be (and are being) built on that infrastructure as well. It's analogous to being able to visit, say, either Google or Bing from the same computer; the world doesn't need to agree on a single standard search engine if multiple search engines can be accessed via the same front-end (in that case, the web browser and user's Internet connection), and in fact user choice is better enabled if it doesn't.

Re:Aren't these already compromised cards?

[myowntrueself]

Apple supporters were right to call out Mr. Abraham - he is biased and attempting to create FUD against Apple and Apple Pay. The real fault and finger pointing needs to be directed to the banks and they need to get their houses in order.

Indeed.

If the banks had the courage to confront Apple and demand that Apple Pay include more information then this wouldn't have happened. Its entirely the banks fault for being scared of Apple (which probably has a larger war chest than all those banks combined).

Re:Aren't these already compromised cards?

[GLMDesigns]

Do you really believe this? Nobody will use their service and makes their company look like mud. Small businesses (and big ones) are very concerned about CC theft. They will not touch this product now.

Re:Aren't these already compromised cards?

[Anonymous Coward]

The banks already get all the data that is necessary to do an onboard. They get the card number, and the expiry. That allows them to uniquely identify a customer, and to do one of phone that customer, email that customer and/or write a letter to that customer.

They are meant to confirm that they can contact the customer and that the customer really wanted to add the card to Apple Pay before on boarding.

If they don't, that's the bank's problem.

Re:Aren't these already compromised cards?

[Immerman]

In fairess, it doesn't sound like there's a problem with Apple's implementation - it may well be perfectly(hah!) secure. But security is only as good as the weakest link, and if the banks aren't doing their job of verifying that the CC account being bonded to the Apple-Pay account is actually legit - well then there's a giant F'ing hole in the security that theives will enter by the busload. Nothing Apple can do about that, technologically at least - though if they're pressuring banks to provide a "painless" bonding experience, well then they do bear some responsibility.

Re:Aren't these already compromised cards?

[Fnord666]

I like the looks of Apple Pay, and think it's a great move forward but even as an Apple fan, it seems bizarre for Apple to move forward on their own payment standard rather than the industry creating one. I mean, I know they did it so that they could skim profits off the top, and that they got away with it because they're worth 700 gazillion dollars and could probably make demands of the ocean, but I really wish this had come about via an industry standard.

You don't get to be first to market by waiting for an industry standard. In fact, if you wait for that to happen you probably won't even get into the market. You build it out as fast as you can using as much existing infrastructure as you can, then pivot if and when the industry gets around to creating a standard. In the meantime you build a leading market share and can even leverage that during the standards creation process.

Re:Aren't these already compromised cards?

[Anonymous Coward]

I doubt this - the serial number of the iOS device can be tied to the on boarding process....do this with a fraud card and they could, in theory, BRICK the device at best, or lead the cops to your doorstep at worst. That's a REALLY expensive and stupid exploitation vector...

Re: Aren't these already compromised cards?

[iluvcapra]

Geez, if Apple told you to jump off a cliff, you have to, right? I mean they have "such a large war chest."

At a certain point surely the responsibility of bankers to keep their customers' accounts secure entails-- it's the very basis of their profession.

and anyway, what exactly are they afraid of? Did they even ask to implement the necessary security features? Did they ask, and did Apple refuse? Has Apple threatened any sort of sanctions against banks that don't comply? It's all very amorphous, and again, seems to rely on the idea that bankers have minimal accountability or responsibility, and may respond to undefined, mysterious, and unsubstantiated "fears" without basis.

Re:Aren't these already compromised cards?

[Austerity Empowers]

...and stop calling me Shirley.

Re:Aren't these already compromised cards?

[macs4all]

I know they did it so that they could skim profits off the top...

You claim to be an "Apple fan"; yet you make a tell-tale comment like that?

Apple supposedly receives something like .00018% of aggregate transaction fees from each member bank (sorry, I can't find where I read that right now); but, according to what I read, has no way of checking nor enforcing such fees; so it doesn't look like they designed the system with that as an important monetization feature; but rather as a general-purpose fund to help offset the administration costs of the setup procedure, of which Apple is a participant.

What I am saying is that, if Apple was so interested in those "profits", they would have demanded that the banks report exactly what each "account" was "charging", rather than accepting what is essentially a voluntary, aggregated amount.

Re:Aren't these already compromised cards?

[Austerity Empowers]

This sounds like some companies are fighting with Apple over who has to pay for the security checks. Since Apple is posting record profits, they see Apple as the one who needs to do it, even though the problem is clearly with how insecure credit cards always have been .

Re:Aren't these already compromised cards?

[parkinglot777]

So everyone thought that apples system of implementation would be more secure? Cheap is as cheap does.

I don't think everyone thought the system is more secured. I think these people use Apple pay because it is convenient. They, however, may expect the security level to be up to par, which is not...

Re:Aren't these already compromised cards?

[Lumpy]

American banks have ALWAYS sucked at security in the world of the credit card. that CCV number on the back of the card is the dumbest thing ever and offers zero security.

Re:Aren't these already compromised cards?

[Eunuchswear]

If you've ever wondered why the gas pump asks for your zip code when you use a credit card, this is why.

I thought it was just trying to piss me off. (I don't have a zip code, you insensitive clod).

Re:Aren't these already compromised cards?

[Anonymous Coward]

All absolutely correct. However, from the bank point of view, before they understood that the fraud problem would be as bad as it is, they figured that each user has a handful of cards. They want the user to pick THEIR (the bank's) card over the others. So they all hope to be the one that is easiest to add to Apple Pay since most people only bother to add one. So the banks then err to "green path" which allows the card to be added the most easily. They get forced their by their own desire to be "the" card that gets used. This will correct itself as banks see the fraud levels and move to "yellow path".

Re:Aren't these already compromised cards?

[Anonymous Coward]

Got anything else you want to make up?

it does not show up that way, how about you actually use something before you make shit up about it.
I get the full details on my account.

Now Google Wallet, that works the way you are talking.

Re: Aren't these already compromised cards?

[Lumpy]

Actually an apple employee will show up and push you off the cliff if you dont jump. It's a part of the customer care program.

Re:Aren't these already compromised cards?

[AmiMoJo]

ApplePay is part of the problem. Because it tries so hard to keep information away from banks and retailers it makes it harder to detect fraud. If Apple were providing things like names and phone numbers to the banks they could very easily see that a particular CC was not being used by the authorized owner or on a phone they had never used it with before.

To be fair, banks could have demanded that information during sign up, but didn't. There is plenty of blame to go around. What I'd like to know is who pays for it. Usually it is the merchant, in which case I'd expect to see some of them refusing Apple Pay.

Re:Aren't these already compromised cards?

[Applehu Akbar]

Apple is just one of the many vendors supporting the global NFC standard. Cognizant of all those stories coming out of Europe about wallet-brushing skimming devices, Apple Pay is just a more secure implementation of the standard.

Re:Aren't these already compromised cards?

[_xeno_]

It may not be Apple's fault (exactly), but it sure as hell is their problem. If more than 1 in 20 ApplePay transactions are fraudulent, what merchant in their right mind is going to accept it as a payment method? (Remember that fraud is paid by the merchants, not the banks.)

Even if it isn't Apple's fault, it sure is their problem to solve.

Re:Aren't these already compromised cards?

[Registered Coward v2]

This is exactly what it is. Already compromised cards being added as payment token. Banks are supposed to follow a protocol called "Yellow path" to prevent this fraud, but since everyone wants their ApplePay to work right away without having to call a call center, a lot of banks are lenient on the security checks. This is not a problem with Apple's technology, or the secure element on the phone, or the fingerprint reader. This is a bank allowing a card to be added to an ewallet, presumably because the party adding the card has all the relevant info (stolen identity) to make it work.

Here's what I don't understand. ApplePay is tied to a specific phone and has, or should have, access to user specific identification that it can share with the bank. If that doesn't match with the banks info, such as phone number on the account, then they could refuse ApplePay. They could send an email to the card holder or call an alternate phone number to verify the card is not compromised, or refuse to activate the card if a second phone with a spoofed phone number attempts to activate. They also have access to location data and use that to refuse ApplePay; in fact with the iPhone they can get data real time on card use and location

It seems they have more, not less, information available to validate a card is in fact being used by the cardholder. If ease of use is so important than they'll have to live with a higher fraud rate.

Re:Aren't these already compromised cards?

[doug141]

I've seen a 4-figure mail-order fraud fail to work because the crook couldn't give the CCV numbers over the phone.

Re:Aren't these already compromised cards?

[Anonymous Coward]

The problem is with Apple Pay.

It's not with Apple Pay the technology, though, it's with Apple Pay the arrangement between banks, consumers and Apple. And it's clear that Apple shares blame for how it's turning out.

Re:Aren't these already compromised cards?

[Bacon Bits]

I always assumed CCV was designed to offer basic protection against incidental photographs of the card being taken, and other situations where only one side of the card has been compromised.

Re:Aren't these already compromised cards?

[tlhIngan]

ApplePay is part of the problem. Because it tries so hard to keep information away from banks and retailers it makes it harder to detect fraud. If Apple were providing things like names and phone numbers to the banks they could very easily see that a particular CC was not being used by the authorized owner or on a phone they had never used it with before.

To be fair, banks could have demanded that information during sign up, but didn't. There is plenty of blame to go around. What I'd like to know is who pays for it. Usually it is the merchant, in which case I'd expect to see some of them refusing Apple Pay.

Actually Apple DOES provide some information to the banks. They provide information they know about the user - limited iTunes account information and how long that account has existed IS passed to the bank. (Presumably, if the card is being associated with a new iTunes account, the bank should be more careful). Stuff like names aren't important (because when you buy a credit card number you get a name, so it's trivial to make a new iTunes account with that name). Presumably, the method the number was entered is also passed on (you can take a photo of your credit card to add it - assuming that's probably a bit more secure than if you merely typed it in... don't know if the photo itself is sent to the bank).

And yes, banks respond back to Apple with whether it's completely accepted (green path), rejected, or further verification required.

As for who is liable, that's an interesting question because in the end, the merchant doesn't really know how the transaction was done - it appears to them as a regular credit card transaction. Only the bank knows when they look up the token that the transaction was actually done by Apple Pay.

Re:Aren't these already compromised cards?

[Immerman]

Oh, absolutely - greed beats security or institutional responsibility every time - anything else would be un American (tm)(c)(etc). I'm simply saying that the responsibility for this lies squarely on the banks - trying to blame Apple, who couldn't realistically have done anything to mitigate it (well, beyond maybe *requiring* the more-secure process be used by all participating banks), is disingenuous.

Re:Aren't these already compromised cards?

[Anonymous Coward]

Look, it is one of those apple fans who talk about apple's "war chest" like it is a badge of honour to overpay for a device to fund said war chest (which by the way is overseas to avoid taxes).

Re: Aren't these already compromised cards?

[myowntrueself]

Geez, if Apple told you to jump off a cliff, you have to, right? I mean they have "such a large war chest."

At a certain point surely the responsibility of bankers to keep their customers' accounts secure entails-- it's the very basis of their profession.

and anyway, what exactly are they afraid of? Did they even ask to implement the necessary security features? Did they ask, and did Apple refuse? Has Apple threatened any sort of sanctions against banks that don't comply? It's all very amorphous, and again, seems to rely on the idea that bankers have minimal accountability or responsibility, and may respond to undefined, mysterious, and unsubstantiated "fears" without basis.

I would have hoped that a company as prestigious as Apple would have demanded a higher standard of security from the credit card companies and banks and forced them to be more scrupulous. After all Apple customers have so much more to lose from fraud, being so much more wealthy than the rest of us unwashed masses who must make do with PCs and Android phones.

Re:Aren't these already compromised cards?

[Anonymous Coward]

It is a problem with APL's policies though.

Their policies are such that they want it to be "frictionless" as per the article. The banks cannot ask for this information because they're not permitted to.

You don't see existing technologies like Tap-To-Pay Credit cards and Google Wallet with insanely high fraud rates...

Re: Aren't these already compromised cards?

[iluvcapra]

I see, so it IS okay for Apple to strong arm banks into doing things Apple's way, provided Apple's way meets your standard. Funny that.

I mean obviously this is a foul up and both the banks and Apple should work to fix it, they're BOTH responsible. The idea that banks are just helpless ninnies at the mercy of Apple, forced to conduct their business exactly as Apple demands, is dumbass.

Re:Aren't these already compromised cards?

[dave420]

You should probably read what the CCV is for before telling everyone you can't be bothered to and just making up your own explanation.

Re:Aren't these already compromised cards?

[Ronin Developer]

I disagree. The banks and card issuers should have performed a risk analysis and identified the yellow path authorization as a problem. It has become Apple's problem because of bad press caused by the institutions not doing their job adequately. Thankfully, in most cases, the card holder is not responsible for unauthorized CC use without a valid signature or PIN involved with the purchase.

What I am unclear is what happens to the original card after it is imported into Apple Pay. Perhaps, when a card is imported into Apple Pay, use of that card outside Apple Pay should not be possible until unlinked by an action taken by the Apple Pay user (or, issuer if phone was lost). This could be a temporary measure for one-off uses with automatic or manual Apple Pay reactivation if a separate card (and number) is not issued by the institution.

Something a simple as having an SMS sent to the card-holder's phone alerting them to use of their card outside of Apple Pay could be the solution.

While some of these issues could be resolved by Apple, it is the banking and card issuing institutions that need to step up and improve their process. What happened here is their desire to get in on the deal and not be left behind as an excuse for inadequate processes.

Re: Aren't these already compromised cards?

[Anonymous Coward]

Apples implementation IS more secure for the end user. You clearly don't understand the issue at hand. The fraud that is happening is a result of people who have already had their information stolen and then approved by the bank to be used on the thief's device. You can do no mobile payments at all and have this happen to you.

Re:Aren't these already compromised cards?

[quantaman]

It may not be Apple's fault (exactly), but it sure as hell is their problem. If more than 1 in 20 ApplePay transactions are fraudulent, what merchant in their right mind is going to accept it as a payment method? (Remember that fraud is paid by the merchants, not the banks.)

Even if it isn't Apple's fault, it sure is their problem to solve.

This seems a little crazy, assuming thieves make the same average purchase as non-thieves it suggests that about 1/20 people who walk into a store and use ApplePay are thieves.

How many people are using ApplyPay? I wonder if this isn't essentially a statistical blip of some gang hitting up a high end electronics store.

Re:Aren't these already compromised cards?

[Theaetetus]

I always assumed CCV was designed to offer basic protection against incidental photographs of the card being taken, and other situations where only one side of the card has been compromised.

Not really - Amex puts its CCV on the front of the card. The real purpose is that the CCV isn't encoded in the magnetic strip, and isn't embossed, so theoretically, someone using a magnetic swiper to steal data or someone dumpster diving for those old carbon paper-imprint style records would get the numbers but not the CVV.

But of course, the person who is stealing your credit card info is most likely your waiter, and they have a minute or two with your card over at the POS to copy down the CVV manually.

Re:Aren't these already compromised cards?

[danlip]

I think the most likely way to get your card data stolen these days is online ... where you also have to enter the CVV for everything. It does seem to be a rather pointless security measure.

Re: Aren't these already compromised cards?

[myowntrueself]

I see, so it IS okay for Apple to strong arm banks into doing things Apple's way, provided Apple's way meets your standard. Funny that.

I mean obviously this is a foul up and both the banks and Apple should work to fix it, they're BOTH responsible. The idea that banks are just helpless ninnies at the mercy of Apple, forced to conduct their business exactly as Apple demands, is dumbass.

Wait... Apple is responsible?!?!?

Re:Aren't these already compromised cards?

[myowntrueself]

Look, it is one of those apple fans who talk about apple's "war chest" like it is a badge of honour to overpay for a device to fund said war chest (which by the way is overseas to avoid taxes).

I'm such an Apple fanboi that I can't wait for the Apple game console whose controller will have one button.

Re: Aren't these already compromised cards?

[danlip]

It's not Apple's customers that are being defrauded - in fact it is Apple's customers that are doing the fraud. Apple is making it as convenient as possible for their customers to do so.

Re:Aren't these already compromised cards?

[icknay]

You are half right and half wrong.

1. For the "card present" case, like swiping or using your Google Wallet or Apple Pay in person, the BANK pays for the fraud (so long as the merchant has the right equipment, saves the signatures etc. etc. .. not hard).

2. For the "card not present" case, like I go to the merchant web site, type in my number etc. etc.. If there's fraud in that case, the MERCHANT eats the cost.

What this tells you is that for card-present case, the banks have a pretty good tech stack, so they are not super worried, and they lose very little money (i.e. they are able to decline the bad purchases before they go through). The card not present, case is much more iffy, and the banks shift the costs onto the merchant, and the merchant can make up their own policies about which transactions are worth the risk.

Re: Aren't these already compromised cards?

[slew]

Apples' implementation IS more *convenient* for the *fraudulent* user.

FTFY. By hiding some of the transaction information from the banks that clear the transactions, the fraud detection heuristics used by banks are less effective. By requiring no physical trace of the transaction, the merchants don't have any incentive to intervene to avoid chargebacks thus making it easier those in possession of stolen card numbers to rack up charges.

Actually this was quite predictable (and predicted by several industry folks), but fear of being left off the ship that was going to sail basically led the banks to just hope for the best as a cost of doing business.

Reminds me of a story a co-worker told me. Back many moons ago (~20years ago), he was a field engineer for mainframes. One day he got an emergency call from a customer that needed a mainframe fixed as some ridiculous hour of the morning. When he got there, his boss was there along with a half-a-dozen Bank presidents in suits in the computer room hovering and watching him work.

Later he found out from his boss that it was a mainframe that did real-time credit card approvals and the bank was basically approving nearly all transactions blind whilst they waited for the computer to be fixed. The theory was that if they didn't do this, people would just take out another card and they would lose all the business for potentially several days (the once bitten twice shy on c-c declines). Apparently all the Bank presidents were there as part of an agreement to verify if he wasn't able to fix the computer within that hour, they would start denying large transactions and they expected to lose tens of millions dollars in lost merchant fees if they did that (and something like that needed their immediate approval). That's why his boss didn't tell him that before he started working on the machine. No pressure...

Re:Aren't these already compromised cards?

[xevioso]

Surely you jest.

Re:Aren't these already compromised cards?

[Strider-]

But of course, the person who is stealing your credit card info is most likely your waiter, and they have a minute or two with your card over at the POS to copy down the CVV manually.

And this is why the United States needs to move to EMV (Chip & Pin) like the rest of the world. Rather than the waiter taking your card away, they bring you a hand-held terminal, which you then take and perform the last portion of the contract yourself, with the card never leaving your hands.

Re:Aren't these already compromised cards?

[Rich0]

I like the looks of Apple Pay, and think it's a great move forward but even as an Apple fan, it seems bizarre for Apple to move forward on their own payment standard rather than the industry creating one.

Scenario 1 - Apple creates new system. If it takes off, Apple makes more money.

Scenario 2 - industry creates a new system. If it takes off, industry makes the same money they have always made. Industry is mostly run by MBAs who don't realize that if somebody else does scenario 1 they might become obsolete.

Can you see why scenario 2 not happening isn't as bizarre as you might think it should be? We're also talking about banking - hardly the most progressive industry on the planet. We still use paper checks in the US and think that taking a few days to do an electronic funds transfer is normal.

Re:Aren't these already compromised cards?

[Anonymous Coward]

Actually, in this instance, Apple *DID* wait for an industry standard. Specifically, they waited for the updated standard for NFC payment (EMV-plus-Tokenization) to be finalized, and were the first to implement and roll out *that*. [http://pomcor.com/2014/09/14/apple-pay-emv-and-tokenization/]

'ApplePay' is just the brand name for their implementation of the standard, and accompanying software front end, just as 'Google Wallet' is Google's brand name for their implementation of the *older* NFC payment standard.

Re:Aren't these already compromised cards?

[Theaetetus]

But of course, the person who is stealing your credit card info is most likely your waiter, and they have a minute or two with your card over at the POS to copy down the CVV manually.

And this is why the United States needs to move to EMV (Chip & Pin) like the rest of the world. Rather than the waiter taking your card away, they bring you a hand-held terminal, which you then take and perform the last portion of the contract yourself, with the card never leaving your hands.

Yep. Great system, though a little awkward when tipping and they're standing over you staring as you go to push the 10- no, 15- no, [gulp] 20% button. Maybe that's why they don't tip much in Europe.

That said, there's a reason why the US is moving to Chip & Signature cards, but not Chip & PIN. The banks will tell you it's because they don't want to confuse or scare their customers who can't learn new systems, but the real answer is that legally, if there's fraud on regular credit cards or chip & signature, the banks can charge it back to the merchant, who must have failed to verify the signature or ID of the purchaser. If there's fraud on chip & PIN cards, legally, the banks have to eat it. So they're not moving to that until they have to.

Re:Aren't these already compromised cards?

[Anonymous Coward]

The reason why in Europe tipping is less "rampant" is that the tip is a tip and not a the service charge. In most European countries, the service is calculated into the price of the meal, so you are paying the tip to encourage above average service and not to make sure the waiter gets paid at all.

Re:Aren't these already compromised cards?

[PRMan]

They'll just use a stolen iDevice as well.

Re:Aren't these already compromised cards?

[Anonymous Coward]

You are wrong about merchant liability and signatures The merchant is under no obligation to check the signature, not now and not in the future with a chipped card. The signature is simply used as an acknowledgment. In fact, as a merchant I am not allowed to check the signature or ask for identification, even if the back of the card has wording in the signature area asking to check the identification. Doing so is a violation of the merchant agreement with Visa, Mastercard, Discover, and Amex. As long as the transaction is approved and the customer acknowledges it, the transaction is considered valid. If the merchant follows their merchant agreement and there is no fraud on their part, they have zero liability.

Merchant charge backs are no as common as people believe. If fraud is committed by the person using the card, there is no charge back to the merchant. What happens is the financial institution holding the account will refund the fraudulent purchase to authorized user and assume the loss.

When liability shift happens this year, the merchant liability is as follows.

Customer magnetic & Merchant magnetic POS: liability - 0%
Customer magnetic & Merchant chip POS: liability - 0%
Customer chip & Merchant magnetic POS: liability - 100%
Customer chip & Merchant chip POS: liability - 0%

Re:Aren't these already compromised cards?

[Anonymous Coward]

Maybe that's why they don't tip much in Europe.

No, in Europe, we didn't tip much at all, even before non-cash payment became widely accepted (much less practiced). It's we're decent human beeings and not assholes who think they can get away with paying people less than a living wage.

Re:Aren't these already compromised cards?

[Dixie_Flatline]

I thought the deal was that the fraud was paid for by the least secure element in the chain. That is, if you're a merchant and you're still using the old swipe system after a certain date, you'll be on the hook for any fraud. However, if you've switched to the new systems that are theoretically more secure (and they are, provided that the data isn't pre-stolen) the bank is once again taking on the responsibility for the fraud. (Of course, merchant prices go up to cover the bank's costs when the bank screws up too, so...)

Re:Aren't these already compromised cards?

[Anonymous Coward]

Yep. Great system, though a little awkward when tipping and they're standing over you staring as you go to push the 10- no, 15- no, [gulp] 20% button. Maybe that's why they don't tip much in Europe.

No, that's not why.

Re:Aren't these already compromised cards?

[Miguelito]

My latest replacement Capital One card (2nd in a year due to hacks) has a chip.. and no numbers on the front. Now the numbers are just printed on the back, with the cvv right below. So one pic and the info is all there.

No PIN to go with chip.

Re:Aren't these already compromised cards?

[cmdrxizor]

You are wrong about merchant liability and signatures The merchant is under no obligation to check the signature, not now and not in the future with a chipped card. The signature is simply used as an acknowledgment. In fact, as a merchant I am not allowed to check the signature or ask for identification, even if the back of the card has wording in the signature area asking to check the identification. Doing so is a violation of the merchant agreement with Visa, Mastercard, Discover, and Amex. As long as the transaction is approved and the customer acknowledges it, the transaction is considered valid.

This is not true. Since it has been a while since I've looked up these rules, I double checked my memory againstthe MasterCard Transaction Processing Rules (I did not check the other three major issuers). There is a procedure to follow if the credit card is not signed -- see page 66. In short, the merchant is required to get authorization from the bank that issued the card, AND require the customer to sign the credit card. "The Merchant must not complete the Transaction if the Cardholder refuses to sign the Card." Of course, I have rarely seen this rule enforced to the letter...

Re:Aren't these already compromised cards?

[david_thornley]

I have several things coming out of my credit card each month, including MMORG fees and donations to charities. It would be inconvenient to need a separate card for these because the one used in Apple Pay was automatically tied up.

Re:Aren't these already compromised cards?

[david_thornley]

Apple wants to sell you stuff, like iPhones and iPads and iMacs. That's where they get most of their income from. They're primarily interested in making it more tempting to buy stuff from them. Eventually, Apple might wind up with a good revenue stream from this (it happened with the iTunes store), but right now they want to give people a reason to buy the latest iPhone.

Re:Aren't these already compromised cards?

[Just Some Guy]

Is there any reason at all why American merchants couldn't start swiping US-style signature only cards at the table today?

Re:Aren't these already compromised cards?

[pasamio]

Isn't that the XBox + Kinect? An on button and then you can use the Kinect to control it?

Re: Aren't these already compromised cards?

[Anonymous Coward]

It's also a hallmark of Apple's arrogance towards established industries.

The exact same thing happened with phone carriers when the iPhone was introduced.

Apple steamrolled over existing processes and demanded the carrier do thing Apple's way or they can sod off. Most carriers were either so afraid of Apple or afraid of not being on the Apple bandwagon they did.

The carrier I used to work for told them to fuck off, and refused to sell the iPhone. Sure, we didn't get zillions of sales, but we also didn't get all the costs and reduced margins other carriers got slugged with.

Re:Aren't these already compromised cards?

[Anonymous Coward]

In my 20+ years of using credit cards, I've never once signed a card. I can count on one hand the number of times a merchant tried to refuse my card because it wasn't signed, and this simple explanation always got me passed that: "I will never sign a credit card, ever. What good is putting the signature on the card when the person who steals it can just copy it? If you're going to refuse my card, that's fine, I'll just shop elsewhere."

Re:Aren't these already compromised cards?

[mjwx]

Yep. Great system, though a little awkward when tipping and they're standing over you staring as you go to push the 10- no, 15- no, [gulp] 20% button. Maybe that's why they don't tip much in Europe.

They dont tip much in Europe because everyone is paid a wage they can live off. I know, what a novel idea.

However with tipping a fix to that is easy. Just add the tip to the end of the bill before putting it into the machine. If you go the same route as the rest of the world this is what you'll have to do as the EFTPOS (Electronic Funds Transfer, Point Of Sale) device will not be able to change the value of the transaction once it has been entered or passed through to the device.

Also the waiter doesn't stand over you. They give you the device then walk away like they currently do with bills, at a good restaurant wait staff will only step in like a well trained butler if you need assistance.

Re:Aren't these already compromised cards?

[Anonymous Coward]

The latest Capital One Quicksilver cards have no chip, but also have no raised numbering (just got my new one last week). The number, expiration, and cardholder name are all printed on the face of the card toward the bottom-left corner. Capital One seems to be completely phasing out raised numbering to stop imprint machine fraud (the card is placed in a mechanical imprint device along with a carbon-copy receipt, and the merchant then slides a roller across it to imprint the face of the card directly on the receipt - this is a great way to steal cards because the carbon-copy receipt has a copy of all of the info on the face of the card including card number, expiration, and cardholder name, and since there is no electronic record of the card being swiped, the source of compromise is nearly impossible to identify).

Re:Aren't these already compromised cards?

[Anonymous Coward]

Whether you believe it or not, it's true. When fraud is discovered, the banks simply chargeback the transactions and take the money back from the merchant.

In the end, the merchant is the one that gets screwed. Not the idiot cardholder that gave his card information to some scammer in India that called to sell him a Windows license. Not the bank that doesn't provide a secure payment method. The merchant. Until the banks are responsible, nothing will change.

Re:Aren't these already compromised cards?

[Miguelito]

the card is placed in a mechanical imprint device along with a carbon-copy receipt, and the merchant then slides a roller across it to imprint the face of the card directly on the receipt

hah.. yes, I am actualy old enough to have paid that way a few times myself when I was younger. I was always taught to ask for the carbons and rip them up in such cases too.

Also had them whip it out at Fry's once when the computers crashed (and the cashier was a complete idiot that had no idea how to fill out the form, add numbers together and compute tax) but thankfully the computers came back just before I simply walked away due to annoyance.

Re:Aren't these already compromised cards?

[macs4all]

Apple wants to sell you stuff, like iPhones and iPads and iMacs. That's where they get most of their income from. They're primarily interested in making it more tempting to buy stuff from them. Eventually, Apple might wind up with a good revenue stream from this (it happened with the iTunes store), but right now they want to give people a reason to buy the latest iPhone.

Apple wants to sell you stuff, like iPhones and iPads and iMacs. That's where they get most of their income from. They're primarily interested in making it more tempting to buy stuff from them. Eventually, Apple might wind up with a good revenue stream from this (it happened with the iTunes store), but right now they want to give people a reason to buy the latest iPhone.

I agree that Apple is primarily a Hardware company (which, as an aside, is always amazing that they generally do a bangup job on their software, too!) ; but doesn't that fly in the face of the premise of this sub-thread, as expressed by Galaga88, above, that "it seems bizarre for Apple to move forward on their own payment standard rather than the industry creating one. I mean, I know they did it so that they could skim profits off the top..." (which implies a monetizataion other than something focused on driving Hardware Sales).

Re:Aren't these already compromised cards?

[Anonymous Coward]

In fairess, it doesn't sound like there's a problem with Apple's implementation - it may well be perfectly(hah!) secure. But security is only as good as the weakest link, and if the banks aren't doing their job of verifying that the CC account being bonded to the Apple-Pay account is actually legit - well then there's a giant F'ing hole in the security that theives will enter by the busload.

Apple doesn't validate the credit card with the bank against the user even though it has the user's details. So anybody can add anybody elses card to their account and use it. It's like if you were to steal somebody's tap-and-pay card except thanks to Apple's technology all you need is the card number and not the physical card. So to make it work more seamlessly and be relatively "frictionless" Apple is exploiting a hole in the bank's security mechanisms.

The banks need to stop the ease at which this process can be accomplished but it takes a pretty desperate apologist to say "oh Apple didn't know this could happen" and place the blame solely on the banks.

Re:Aren't these already compromised cards?

[Anonymous Coward]

Trying to absolve Apple of all blame is disingenuous. You actually believe Apple were completely unaware this might happen? Yes this is a flaw with the security of some of the banks but Apple's technology is what allows exploitation of that flaw.

Apple has all the information to validate the card and should work with banks to make sure this happens.

Re:Aren't these already compromised cards?

[Fjandr]

The same reason why chip & pin cards that do exist are only "suggestions:" It requires merchants to buy new transaction equipment. Since not all banks have moved to chip & pin (Chase is just now getting around to it), requiring new hardware just means someone will use another card when a retailer hasn't upgraded. Banks won't start requiring the new chips be utilized at the point of sale until enough retailers have upgraded. Until the threat of your merchant gateway provider cutting your ability to process credit card sales has some teeth, nobody is going to be the first to make the equipment upgrade mandatory.

Re:Aren't these already compromised cards?

[Immerman]

Ah, I didn't realize that - from the summary it sounded like Apple sent the info they had and the banks just said "sure, whatever". On the other hand, at the end of the day I'm paying my bank to protect my account, not Apple. If they can't be bothered to do that job when it might marginally interfere with profits, I'm going to seriously consider taking my business elsewhere.

I'm sure the *other* banks take their responsibility seriously, I mean they've had genuine two-factor authentication since..., umm... hmm... Do I detect a failure of the free market?

Re:Aren't these already compromised cards?

[paultscott]

You are wrong there. The bank does know who you are when issuing the transaction. ApplePay utilizes the same chip and pin system of using a one time use code that your phone knows and the bank is aware of. If the bank didn't have your information they wouldn't be able to charge you. The fraud that is happening is people using stolen cards and creating a fake account on iTunes and attaching an iPhone. It is no different than someone presenting a stolen credit card. Apple is taking steps to avoid that by validating who people are when setting up a new iTunes account before letting them use Apple Pay. They are taking a stance against it. The banking industry never did anything about the rampant fraud which costs about $190 billion a year in lost revenue for retailers and cost us higher interest rates because if you think the credit card companies are eating the fraud your nuts. The data isn't being shared with the retailers who have quiet publicly lost large chunks of peoples private data. Apple not sharing data is a good thing because we get to control what we want to share with the merchant.

Re:Aren't these already compromised cards?

[Anonymous Coward]

Considering that one the most popular places to commit fraud this way has been at Apple stores buying big ticket, easily marketable items, I would think Apple does have a problem to solve.

Re:Aren't these already compromised cards?

[johncandale]

haha, I love sending assholes like you away. The card says "not vaild unless signed" for a reason. And we compare the sig to the one on the ID not the one on the paper to verify. Entitled middle class+ jerks that were born into silk sheets that never really had to work thinking you are above the rules and can expose me to liability then stand around and insult my employees.

Re:Aren't these already compromised cards?

[weweedmaniii]

But of course, the person who is stealing your credit card info is most likely your waiter, and they have a minute or two with your card over at the POS to copy down the CVV manually.

And this is why the United States needs to move to EMV (Chip & Pin) like the rest of the world. Rather than the waiter taking your card away, they bring you a hand-held terminal, which you then take and perform the last portion of the contract yourself, with the card never leaving your hands.

Funny, my new Chip & PIN card came in the mail from one of my CC last week...still no word on the PIN yet, perhaps I need to contact them directly & no it is not my current bank...

Re:Aren't these already compromised cards?

[david_thornley]

However, Apple's not using their own payment standard, so the OP is wrong there. Moreover, it seems odd that they'd be doing this to skim profits, at least at first.

Re: Aren't these already compromised cards?

[darkarena9789]

That's not entirely true though. There is no "yellow path" for other electronic mediums like Amazon or Pay Pal or Pay at the Pump you find in most gas stations. I think, though, that simply requiring you to provide a zip code or other information would cut down on the fraud significantly. One thing I do agree on is that calling the bank and having them authorize a device would be the most secure, but it would significantly hinder adoption.

Re:Aren't these already compromised cards?

[Anonymous Coward]

Or have a terminal at the table. Outback does this.

Duh!

[DogDude]

Apple Pay is simply going to get too expensive for all but the most clueless merchants to use, both from the fraud and from Apple's eventual fees. It was a bad idea to begin with, and it's a bad idea now.

Re:Duh!

[Anonymous Coward]

that's where I see thing going for electronic payment systems: lots and lots of hefty fees for middle men who do not do very much - it's going to make American Express' fees look like chump change (next time you're in a store that has a sign that they don't take Amex, ask them why.)

Re:Duh!

[Anonymous Coward]

Huh?

Re:Duh!

[MachineShedFred]

Except that you could switch out "Apple Pay" for the upcoming "Samsung Pay" or "Google Wallet" or "Contactless Payments" and still have the same problem.

This is not fraud happening because someone has cracked Apple Pay - this is bad people doing what they would have done before, only using stolen credentials and information on an iPhone.

Also, I love the meaningless statistic at the top of the summary - a 6% fraud rate, out of how many transactions? And that 0.1% fraud rate on traditional magswipe transactions is out of how many orders of magnitude more?

Re:Duh!

[DogDude]

Except that you could switch out "Apple Pay" for the upcoming "Samsung Pay" or "Google Wallet" or "Contactless Payments" and still have the same problem.

Absolutely. Contactless is pointless and expensive as fuck for merchants. I can't imagine many businesses where the "neat-o" factor from a few phone enthusiasts to be able to pay with their phones is going to outweigh the costs.

Re:Duh!

[MatthewCCNA]

Absolutely. Contactless is pointless and expensive as fuck for merchants. I can't imagine many businesses where the "neat-o" factor from a few phone enthusiasts to be able to pay with their phones is going to outweigh the costs.

Sometimes it comes down to offering convenience to your customers, there are 2 'corner' stores near my place, store a is a five minute walk, store b is a seven minute walk. I walk and drive to store b more often because I can use tap on my credit card to pay, store a requires chip and pin.

Re:Duh!

[DogDude]

That's not a sane decision. You're wasting four minutes in order to save a (perceived?) few seconds at the store at the point of payment. Most people are not going to make such decisions.

Re:Duh!

[Fnord666]

Absolutely. Contactless is pointless and expensive as fuck for merchants. I can't imagine many businesses where the "neat-o" factor from a few phone enthusiasts to be able to pay with their phones is going to outweigh the costs.

You do realize that newer EMV cards support contactless payments as well, right? No phone needed. You get the convenience of "tap and go" with the added security that EMV provides.

Re:Duh!

[green1]

So you value convenience over security.

I specifically avoid tap and pay and insisted the issuers give me cards without it to avoid the massive security hole it provides.

Chip and PIN takes approximately 10 seconds longer, and is infinitely more secure.

Re:Duh!

[Anonymous Coward]

I am utterly amazed at how stupid you are, and yet you still are allowed on the internet.

Allowed? Sheeet, we get the preferred line there, Chief. Good luck back there with the eggheads.

Re: Duh!

[Anonymous Coward]

So you will walk 4 minutes more in total to save 3 seconds and not have to pull a card out of your pocket instead of your phone and that is convienace to you?

Did you think about what you typed before you submitted it?

Re: Duh!

[Anonymous Coward]

And yiu need to remember a pin! This is the problem... I have 5 chip & pin cards and I live in the pin hell!

Re: Duh!

[Anonymous Coward]

the big difference is that that soon or later he should type the pin of the card if using an EMV card. And you need to remember it. This makes the difference with ApplePay

Come on...

[frank_adrian314159]

I could see the big bad CEOs being scared when Jobs was in charge, but Cook?

God, bankers are even bigger pussies than I thought.

Re: Come on...

[Anonymous Coward]

If they were pussies then Tim Cook would be more afraid of them!

Re:Come on...

[Princeofcups]

I could see the big bad CEOs being scared when Jobs was in charge, but Cook?

God, bankers are even bigger pussies than I thought.

Are you saying that gay guys can't be scheming sociopaths? Remember, Jobs chose him as his replacement.

Re:Come on...

[monkeyxpress]

No, but normally the sociopath does not surround himself with other sociopaths - compliant co-dependents work best because you can scream at them and they will do whatever you want. After a bit of screaming they are so eager to please you that they will spend their lives pre-emptively trying to keep you happy. It's pretty much how the corporate world works.

Re:Come on...

[Anonymous Coward]

Pussies when they want to absolve themselves of responsibility. The banking industry could have offered better security on debit and credit cards years ago.

They don't give a fuck.

Re:Come on...

[Anonymous Coward]

Why would they? Fraud doesn't cost the banks shit. They just take the money back from the merchant via chargebacks. Then when a merchant has too many chargebacks against them, their card processor increases their transaction fees. Guess who shares in those transaction fees. That's right, the banks. Fraud fucks the merchant, nobody else.

The banks don't give a fuck about it's own account holders, you think they'd give a fuck about merchants? Hell no, especially when not giving a fuck makes them more money. Meanwhile merchants are forced to accept a hopelessly insecure method of payment because, let's be honest, if they don't accept credit cards, they're going to lose sales, lots of sales.

They're not pussies, they're government-endorsed, John Q. Public-supported criminals. Want to help fix the problem? Stop using credit cards.

Calculated risk

[buchner.johannes]

For credit cards, frauds are nothing to banks. They just pay it from their profits, and the customer doesn't have to worry. Maybe it is the same here? Perhaps it still pays off for the banks and Apple to do that extra business, and it works out in their calculation.

Re:Calculated risk

[DogDude]

. They just pay it from their profits, and the customer doesn't have to worry.

No, they charge the merchant all different rates based on the risk of that particular transaction. There are hundreds of categories of cards, swiped vs non-swiped, address info vs no address info, etc. Apple Pay is going to be absurdly expensive for the merchants dumb enough to take it.

Re:Calculated risk

[Anonymous Coward]

they charge the merchant all different rates based on the risk

And then on top of that, when fraud is caught they just take the money back out of the merchant's account.

In no way do they ever "pay it from their profits".

Re:Calculated risk

[DogDude]

Actually, some laws were recently passed that puts even more liability on the merchant and less on the processors. Any smart merchant is going to run from Apple Pay and everything else that isn't chip + pin (come this October).

Re:Calculated risk

[MachineShedFred]

Except that Apple Pay is at contractually negotiated rates, below the "card not present" rates that online retailers already happily pay.

Re:Calculated risk

[ShanghaiBill]

For credit cards, frauds are nothing to banks. They just pay it from their profits

No. Nearly all the cost of fraud is pushed onto the merchants, who pass it on to consumers in the form of higher prices. So you are paying for credit card fraud even if you pay cash.

This is the problem with credit card fraud. The banks are in the best position to fix the problem, but have little incentive to do so, since they don't bear the cost.

Re:Calculated risk

[Anonymous Coward]

Only while Apple gain tracking in the financial facilitator market. Once they're a real player, they'll fuck merchants over with as many fees and rate hikes as possible; which will be passed on to the consumer.

Re:Calculated risk

[drunk_punk]

This is it exactly. It's the MERCHANT that pays charge backs, no one else. Which, to be clear, is certainly NOT Apple.

Re:Calculated risk

[Dogtanian]

And then on top of that, when fraud is caught [the banks] just take the money back out of the merchant's account. In no way do they ever "pay it from their profits".

This. A hundred times this.

I don't know if it's changed recently, but from reading Internet discussions on credit card fraud etc., it was always clear that people thought that- despite a notoriously sloppy and too-lazy-to-fix-the-obvious-flaws attitude towards security, the party paying for the banks' apparent fecklessness was the banks themselves.

Except, it isn't- it's the merchants. If there's a fraud, the money gets yanked back from the merchant, and that's the last he'll see of it. (No, you *won't* get the money back- even if they catch the people involved, proving and prosecuting fraud is more hassle than it's worth for the police. And most of the time the police won't do anything even if they're presented with evidence of a blatant fraud setup presented to them on a plate (e.g. full address of a rented flat in London being used as the delivery address for goods bought (or attempted to be bought) with a known-stolen credit card).

So now you know why it's "too much work" for the banks to do something about your stolen and misused credit card in advance, until you've reported and cancelled it yourself. It's because there's nothing in it for them. I can guarantee that if *they* were paying, it would very quickly become doable.

This is why the banks don't give a t***; they don't have to, they're not the ones paying.

(Note; this describes the situation in the UK- we've had chip and pin for years, but it still doesn't stamp out misuse of credit cards, especially over the Internet).

Re:Calculated risk

[macs4all]

. They just pay it from their profits, and the customer doesn't have to worry. No, they charge the merchant all different rates based on the risk of that particular transaction. There are hundreds of categories of cards, swiped vs non-swiped, address info vs no address info, etc. Apple Pay is going to be absurdly expensive for the merchants dumb enough to take it.

Hey fucktard! APPLE DOESN'T CHARGE MERCHANTS

Learn to READ.

Re:Calculated risk

[DogDude]

Hey fucktard! Apple isn't doing this for free. Use your brain!

Re:Calculated risk

[macs4all]

Hey fucktard! Apple isn't doing this for free. Use your brain!

Apple is in NO WAY involved on a per-transaction-basis; so, other than a (really small) setup fee charged to the bank, and a (thousandths-of-a-percent) AGGREGATED transaction fee charged to the bank (the reporting and paying of which is essentially voluntary; since Apple has NO WAY of verifying nor reinforcing what the bank reports/pays to Apple), yes, Apple is essentially doing this "for free".

Re:Calculated risk

[DogDude]

Apple is in NO WAY involved on a per-transaction-basis

Yet.

Apple has NO WAY of verifying nor reinforcing what the bank reports/pays to Apple

Apple has access to every piece of data that passes through their phones. They know exactly how many transactions they do and for how much.

Apple is essentially doing this "for free"

Right. It ain't gonna last.

Re:Calculated risk

[Anonymous Coward]

That's part of why I loooove cash discounts, like at gas stations.

Re:Calculated risk

[macs4all]

Apple has access to every piece of data that passes through their phones. They know exactly how many transactions they do and for how much.

Citation, please, or STFU.

Re:Calculated risk

[Anonymous Coward]

My credit card gives me 5% cashback at gas station.
I rarely see cash discount that high. You are still getting screwed.

Re:Calculated risk

[Anonymous Coward]

Incorrect.

Fraud is assumed by the financial institutions. It is the reason why processing fees are high and indirectly may lead to higher prices at retailers. Merchant charge backs are no as common as people think. As a merchant that takes Visa, Mastercard, Amex, and Discover, as long as I follow the merchant agreement and don't commit fraud, I am not liable for fraudulent purchases. It is zero liability. If it didn't work this way, there would be no reason for a merchant to participate in the system. What ends up happening when you find unauthorized purchases on your card is your issuer does an investigation, and unless they find a violation of my duties as a merchant, they eat the loss and refund the purchase.

Finally, on the topic of signatures. I am under no obligation to check the signature even if you put wording to this effect in the signature area. Doing so is a violation of my agreement. A signature is an acknowledgement of the transaction, it does not convey authorization. As long as the transaction is approved, it is considered valid.

Re:Calculated risk

[DogDude]

Citation, please, or STFU.

Are you serious?

Re:Calculated risk

[Raistlin77]

It's exactly the same here in the US. Until the banks are responsible for their shitty credit card security and the fraud it perpetuates, nothing will change. Ultimately it's the merchant that gets screwed, and the end result is higher prices for consumers.

Re:Calculated risk

[Anonymous Coward]

Amazing that some fucktard moderated this as flamebait. Visa/MC/Apple employee?

Re:Calculated risk

[adolf]

This is why I find myself more-frequently finding $5.00 minimums at local merchants, sometimes with a $0.50 or $1.00 surcharge for purchases under $5.00: It, on average, covers their ass.

A local restaurant gives a (I forget) 5 or 10-percent discount for cash (vs credit), not even four blocks from my house.

Of course, these small merchants (coffee shops, carryouts, hardware stores, the one locally-owned liquor store) aren't in the business of selling big-ticket items: In my town, that's the realm of the singular audio salon, service companies (think HVAC, though HVAC folks like to establish their own credit lines for their customers -- which is fine with me) and big-box stores (Wal-Mart, Lowes, Best Buy, etc).

And I can only speak for the audio salon, because I do casual contract (1099) work with them on a a fairly regular basis and have been good friends with the owner for decades, but: He doesn't care. If there were a horror story involving credit card fraud, he'd tell me all about it in a late-night telephone rant, but that hasn't happened. What I do know is that he gets sadfaced when someone wants to pay with a credit card, and then tries to give them a better deal if they'll pay cash -- right now (or tomorrow or next week, even, depending on the sale).

He prefers cash because he has his money right now, instead of at the first of the month or whatever, and doesn't have to pay a percentage of the bill to $banking-system. Perhaps he is lucky that he has no grandiose fraud stories to report, though there isn't much that he sells that might be easily- and untraceably-fenced and criminals aren't necessarily stupid.

That said, for the ridiculous percentages that Visa and Mastercard charge merchants for their services, they should have plenty of cash to cover the fraud that is enabled through their own insecure processes instead of the merchant. That doesn't mean that they should cover it.

In the grand scheme of things, perhaps it doesn't matter: Someone must pay for fraud, and that someone must, ultimately, be the consumer. If better practices are put in-place, it is ultimately be the consumer who pays for the development and deployment of them (even if Visa writes the check). If fraud is instead rampant, then it is ultimately the consumer who pays for that too (which, under current rules, means that the merchant might adjust their sticker prices to adjust for fraud).

Because at the end of the day, it is me, the consumer (or the fraudulent consumer) who is (alleged to be) providing funds.

Currently, the impetus is on the merchant to verify that the transaction is valid, and the merchant (and ultimately the consumer) pays. If it shifted to Visa/MC, the consumer would also pay. If it shifted to the requisite banks who actually hold the money, the consumer would pay as well.

Arguing about whether the merchant or the bank or the processor covers the loss is an exercise in semantics: In all cases, money does not appear from thin air (unless you are the Federal Reserve Bank, which is a different discussion), and someone has to pay for fraud, and that someone must always ultimately be the consumer.

(Where the blame lays beyond that? As a consumer, I don't think it makes any difference. I'll be paying for it no matter what.)

Re:Calculated risk

[Anonymous Coward]

Good thing you're paying off your credit cards immediately; you're getting a free lunch!

Re:Calculated risk

[Anonymous Coward]

He should be asking you if you're serious - you've littered this thread with apoplectic claims that run contrary to everything Apple and the banks partnering with them have said. Time to put your cards on the table and cite sources, or admit that you think the sky is falling.

Bank problem

[BitZtream]

Both of the banks and the on CC card I have on ApplePay required I read an email, click a link and login to my account and explicitly authorize the use of the card before it was usable.

You mean there are companies NOT doing this?!

Re:Bank problem

[Galaga88]

Both of the banks and the on CC card I have on ApplePay required I read an email, click a link and login to my account and explicitly authorize the use of the card before it was usable.

You mean there are companies NOT doing this?

I could swear I read this exact article some time ago, before the NYT published it so maybe the "toughened standards" banks talk about were already enacted quite a while back and we're just now hearing about the problem?

Re:Bank problem

[Anonymous Coward]

My bank did the same and also called me to confirm.

Are they still on the job?

[bogaboga]

Some bank executives acknowledged that they were were so scared of Apple that they didn't speak up.

And such officials are still employed? In my opinion, such employees are good candidates for immediate termination.

But wait! We're gonna hear about the usual vitriol from these banks. I will go something like this:

"We take [the] security of our operations and clients' accounts with us very seriously."

"We process in excess of several billion transactions daily and although fraud is part of our industry, it constitutes less than 0.1% of our business." "Our bank is committed to providing the best security there is in this business..."

Re:Are they still on the job?

[smooth wombat]

No, that 's not it. You see, these people get paid the big bucks to make the tough decisions. They are our best and brightest, just like the folks on Wall Street, so whatever they do, you cannot question them. After all, they know what they're doing.

Afraid

[Anonymous Coward]

Some bank executives acknowledged that they were were so scared of Apple that they didn't speak up.

Its a sign of the politically correct times, they were so afraid of being accused of homophobia that they allowed an insecure system.

News for Nerds Who Can't Math

[Anonymous Coward]

10 cents for every $100 spent. [i.e. one tenth of one percent]

Thanks for doing the hard work for us. No way I could have done that calculation myself.

Meanwhile on Google Wallet..

[DigitAl56K]

.. I had to electronically send in a picture of a government-issued photo ID and a recent utility bill showing my home address.

Short story: Retailers should probably trust Google's platform more when it comes to fraud.

Re:Meanwhile on Google Wallet..

[DogDude]

Why would a merchant trust a computer manufacturer or a search engine company with payment processing in the first place...?

Re:Meanwhile on Google Wallet..

[MachineShedFred]

Right until Google drops the axe on it. They're already well into phase one: ignoring it's existence.

Re:Meanwhile on Google Wallet..

[Anonymous Coward]

I know right, payment done by software... by companies who employ teams of software engineers. Bizarre. As we have observed, banks have so been on top of the software security game haven't they?

Re:Meanwhile on Google Wallet..

[Anonymous Coward]

i end up having to do that once or twice a year for paypal.. so by that reasoning.. paypal should be the ultimate in trustworthy payment processors.

captcha: scrutiny

Re:Meanwhile on Google Wallet..

[swillden]

Why would a merchant trust a computer manufacturer or a search engine company with payment processing in the first place...?

How about because the "search engine company" processes tens of billions of dollars worth of payments annually, and achieves very low fraud with its internal risk engine -- mainly because it has a bunch of people who are really good at extracting important signals from large amounts of data (which is what both search and fraud risk analysis are about).

Re:Meanwhile on Google Wallet..

[Anonymous Coward]

I've never had to do any of that to open an account in Canada. Not even for a bank account, and especially not for a credit card. That sounds entirely excessive.

This is all you need in Canada, and I will never use Google Wallet with such horrid requirements surrounding it:

http://www.cba.ca/en/research-and-advocacy/50-backgrounders-on-banking-issues/83-opening-a-bank-account

You can open an account with a Social Insurance Number (those cards have no address on them, just the name and ID number) and a Credit Card. That's all I provided for my last account. The Credit Card isn't required if someone vouches for you. You could use a driver's license if you really wanted to. I did that once as well. Never would a bank ask for utility statements--we would think they're trying to scam us with a utility slam.

Why is Google so draconian? Why do people trust them so highly with so much information? Not for me, no thanks!

Hmmmm.....

[Anonymous Coward]

The fraud would have to be much higher before the banks bail on Apple Pay. At this level they will do what any business does: absorb the loss up front with the affected customers but pass the loss on as fees to the merchants. Remains to be seen if merchants will charge a premium for Apple Pay use. Customer will pay eventually, I think.

So.... are the criminals just getting warmed up? If the system is so easy to game that it has this sort of loss with just basic passing of bad cards, will there be a fraud assault by organized crime that will increase the fraud to an unsustainable point? Or will the banks and Apple get their poop together and plug the holes in the money boat?

Re:Hmmmm.....

[znu]

To be clear, the fraud here isn't in the technical implementation in Apple Pay, it's in the card verification procedures, which Apple deliberately leaves entirely up to banks. Each bank can do as much or as little verification as it wants, or even do different amounts of verification on a card-by-card basis if they like (based on a risk profile of a particular customer or whatever). So, bailing on Apple Pay isn't really in the cards here. Some banks clearly misjudged what the rate of fraud would be if they only did minimal card verification, but they can change that whenever they want to.

I trust ApplePay without reservation

[Anonymous Coward]

How do I know it's safe? Siri told me so.

Re: accounts

[Anonymous Coward]

Yes, but it is ridiculously easy to create a phoney name account on itunes. None of my accounts are tied to my actual self. Originally I created multiple accounts to access music titles in different iTunes stores and I don't see that Apple has instituted any significant changes to prevent this.

What good is authenticating against an account that is going to be bogus?

Towers of gold; feet of clay.

Simplicity?

[serviscope_minor]

How on earth does Apple Pay have more simplicity than a credit card? Here's how it works with a credit card:

1. Touch card or even whole wallet on reader.
2. Done!

And for more expensive transactions (over 20GBP, soon to be 30):

1. Insert card.
2. Enter PIN.
3. Done.

It doesn't get much simpler than the first one, really. I don't even have to extract my card.

Re:Simplicity?

[bondsbw]

In the states, we current use magnetic stripe for physical transactions. The "security" offered is in signature. I hate it, it's dumb, it's getting fixed supposedly, but it is what it is for now.

For us, Apple Pay means not having to extract a card, and with Touch ID it offers a somewhat real level of physical security as well.

Re:Simplicity?

[hcs_$reboot]

20GBP

20 what? Come on, do at least a bit of a forex conversion to give a rough indication of what that makes in a decent currency, like USD or EUR.

Re:Simplicity?

[bondsbw]

Another thing, Apple Pay provides a different card number to merchants than your regular card. That way if something looks fishy, you can disable that card number on Apple Pay and re-enroll with a new number, rather than having to deal with canceling your main card.

That said, I wish they took it one step further and provided a one-time-use CC number for every transaction. This way anyone who manages to steal that information would not be able to use it again.

Re: Simplicity?

[drummerboybac]

I believe a lot less contactless credit cards in the US currently, nor are the cards I use offered as a contactless option. As such, the convenience is really twofold for me 1. Backup payment method. If I don't have my wallet, I can still pay for things. Handy for the once in a while I forget it, but more handy if I'm out for a run and want to buy a drink or something. 2. One handed operation. Since all I need to do is put my thumb on the fingerprint reader and hold my phone by the contactless reader instead of needing to open my wallet to swipe a card, it's far easier to do while trying to keep my 4yo out of the candy in the checkout line with my other hand. Mind you these may both apply to Google Wallet as well, but I haven't used it so I can't say. Honestly, if Apple pay does nothing more than encourage the proliferation of contactless readers, I think both Apple and Android fans win.

Re:Simplicity?

[Anonymous Coward]

do at least a bit of a forex conversion to give a rough indication of what that makes in a decent currency

0.1020 BTC

Re:Simplicity?

[Anonymous Coward]

That'll be 20 GBP, then. Somewhere around 30-odd in monopoly money.

Re:Simplicity?

[Anonymous Coward]

How on earth does Apple Pay have more simplicity than a credit card?

APPLE!

FTFY

Re:Simplicity?

[Anonymous Coward]

GBP is in the top four most-traded currencies. If you know the term "forex" you know what a GBP is worth in dollars.

Re:Simplicity?

[Anonymous Coward]

Is it somehow easier for you to take out your phone than your card? Or do you walk around with your phone in your hand?

Re:Simplicity?

[rkww]

Simply type 20gbp into Google; the very first result is its value in USD, together with a handy graph of its value over the last five years.

20 British Pound Sterling equals 29.46 US Dollar

Re:Simplicity?

[wbo]

That said, I wish they took it one step further and provided a one-time-use CC number for every transaction. This way anyone who manages to steal that information would not be able to use it again.

Actually that is exactly what Apple Pay does. and is precisely why I have begun using Apple Pay as much as possible The phone generates a new one-time use credit card number for each transaction. So even if the number given to the merchant is compromised somehow, it will be rejected if someone tries to make a second charge using that number.

Re: Simplicity?

[rkww]

I wish I could attach a video of how it's done in Europe-land. I can buy a beer in a pub with a contactless card: I simply touch it on the card reader; it never leaves my hand. And I don't need to provide a fingerprint or carry a many-hundred-dollar identity widget.

The bar likes it because they don't have to handle the cash. And if I lose my card I can have it disabled remotely with a single phone call.

Oh, and one more thing, if I lose my card and I need cash, I can phone the bank and get a six-digit code for an emergency cardless withdrawal from a cash machine.

It's all much easier when you don't assume everybody's a criminal.

Re:Simplicity?

[Anonymous Coward]

I don't think it generates a new number for each transaction, only a number that differs from your physical CC. Every paper receipt I've gotten when using Apple Pay shows the same last 4 digits of the virtual credit card number - but it's not the same as my physical CC.

If they generated a new CC number for each transaction, they would rapidly exhaust the possibly supply of numbers.

Re:Simplicity?

[myowntrueself]

In the states, we current use magnetic stripe for physical transactions. The "security" offered is in signature. I hate it, it's dumb, it's getting fixed supposedly, but it is what it is for now.

For us, Apple Pay means not having to extract a card, and with Touch ID it offers a somewhat real level of physical security as well.

There was a guy documenting how he was signing with things like "transaction invalid" and "no not honor" and the shops weren't even checking.

Re:Simplicity?

[Paradise Pete]

I wish they took it one step further and provided a one-time-use CC number for every transaction.

I see your philosophy is "It's much easier to have my dreams come true when I wish for things to be as they already are." Good thinking!

Re:Simplicity?

[Anubis IV]

How on earth does Apple Pay have more simplicity than a credit card?

Even for a Brit, it's more convenient, but let's go down the list, that way we can include the Americans too, since they're getting more benefit from it:
1) It eliminates the need to carry additional, otherwise-useless pieces of plastic.
2) It mitigates the need to make use of anti-skimming technology.
3) It eliminates entering PINs.
4) It eliminates magnetic swiping.
5) It eliminates signing.
6) It eliminates showing driver's licenses.
7) It eliminates entering zip codes.
8) It eliminates providing CCV/security codes.

The entire process is:
1) Unlock phone next to reader
2) Done

And in addition to the extra convenience, you also gain better security and privacy:
1) It provides a randomized, single-use token that can't be reused by hackers who capture it.
2) Merchants can't track you across purchases because of the randomization.
3) It doesn't provide any extra information to the merchants.
4) You can deactivate it remotely if the device is stolen.
5) Stealing the device itself won't give a thief access without considerable effort.

All of which is to say, yes, it's simpler, and it's also more secure. Had we been using systems like this already, the sorts of hacks that happened last year in America would've been absolutely worthless to the thieves, since all they'd have gotten would have been used single-use data.

Re:Simplicity?

[puto]

I did it with my android phone at work before apple pay came into existence. I could buy chips or soda...

Re:Simplicity?

[serviscope_minor]

Even for a Brit, it's more convenient

Not really. I'll deal with the list below fom the POV of a Brit.

1) It eliminates the need to carry additional, otherwise-useless pieces of plastic.

Well it doesn't because (a) it's not used everywhere and (b) I need to carry other useless bits of plastic for other purposes, such as a driving license. I also need to carry cash for obvious reasons. The marginal difficulty of carrying one more milimeter thickness piece of plastic is essentially zero.

2) It mitigates the need to make use of anti-skimming technology.

Though apparently fraud is rampant so it's actually worse.

3) It eliminates entering PINs.

I don't need to enter a PIN for the majority of purchases.

4) It eliminates magnetic swiping.

I can't remember the last time I used that.

5) It eliminates signing.

What is this ancient technology of which you speak? Signing for stuff with a credit card was obsoleted years ago.

6) It eliminates showing driver's licenses.

I've never been asked to show my driver's license in the UK. Actually it wouldn't have helped anyway until recently since I had one of the paper ones (no photo!) until about 2 years ago.

7) It eliminates entering zip codes.

Never have to do that except for online shopping.

8) It eliminates providing CCV/security codes.

Never have to do that for online shopping.

The thing is in Europe, none of those things apply. The process you do is:

1) Unlock phone next to reader

I don't even have to do that most of the time. All I do is place it next to the reader.

All of which is to say, yes, it's simpler, and it's also more secure. Had we been using systems like this already, the sorts of hacks that happened last year in America would've been absolutely worthless to the thieves, since all they'd have gotten would have been used single-use data.

It's not simpler: there's an entire extra step which isn't required for the majority of purchases. You could argue it was "as simple", which would be dubious.

Security is theoretically better, except the rate of fraud is higher.

Re:Simplicity?

[bondsbw]

Except it is not that way. Apple Pay uses the same CC number for every transaction, it's just a different number from your physical CC number.

Apple Pay supposedly responds to authorizations by supplying a one-time token for merchants to store in their systems. That is a positive step and should prevent accounts from being compromised if hackers get access to the merchant's database. But, if the card machines are compromised (such as the Target hack) then the Apple Pay CC number can be read prior to authorization.

Re: Simplicity?

[Anonymous Coward]

Can't wait to be behind you in the tube and reach next to your back pocket with my stealth POS device and syphon your account 10£ at a time. What say you about that?

Re:Simplicity?

[Rich0]

How on earth does Apple Pay have more simplicity than a credit card? Here's how it works with a credit card:

1. Touch card or even whole wallet on reader.
2. Done!

And for more expensive transactions (over 20GBP, soon to be 30):

1. Insert card.
2. Enter PIN.
3. Done.

It doesn't get much simpler than the first one, really. I don't even have to extract my card.

The problem is that it doesn't work this way in the US. The way it works here is:

1. Usually swipe card. MAYBE use a contactless system.
2. Sign piece of paper.
3. When you leave the merchant keeps a copy of all the data required to impersonate you in future transactions.

A big part of Google Wallet and Apple Pay is getting rid of #3. In Europe chip and pin protects you against #3 for the most part - the merchant doesn't get all the credentials necessary for future transactions as some of them stay in the chip.

Re:Simplicity?

[Anubis IV]

Though apparently fraud is rampant so it's actually worse.

Except that it's not, since the fraud isn't affecting Apple Pay users specifically. It's affecting everyone, but Apple Pay users are actually subject to less fraud.

The fraud being encountered here is that data which was stolen in credit card hacks last year is now being used to establish fraudulent Apple Pay accounts, even if that person doesn't own a single Apple device. It stems from a twofold problem:
1) It's a failure of the pre-existing systems to properly secure their data in the first place. Apple Pay and similar systems inherently protect against those forms of attack by never using that data to begin with.

2) It's a failure by the banking institutions to enact higher verification standards for cards that are already known to have been compromised, even though they've known about the stolen data since at least last April. Banks are responsible for verifying that new payment methods are being established by the valid card owners, as they should be, but they failed to do their due diligence here.

Neither of those is an inherent failure in Apple Pay. Rather, both are failures in the systems on which the entire financial industry is built. In contrast, problems such as skimming are inherent in the use of EMV cards as a method of payment.

And it's a bit hard to claim that you never have to do any of those things, when by your own admission you have to enter PINs and zip codes at least some of the time, not to mention that you have to fill in all of your personal information when doing online shopping. And what's the "entire extra step"? Unlock the phone? Since it's using Touch ID, it's unlocked in the same motion that takes it out of your pocket and puts it next to the reader. There is no extra step. It's something that just happens along the way.

Re:Simplicity?

[IamTheRealMike]

The entire process is:
1) Unlock phone next to reader
2) Done

I'm waiting to start hearing stories about people who went out for a night on the town with no cash or cards, then their battery ran out. I'm not sure why a phone has to be involved in the payment process.

And in addition to the extra convenience, you also gain better security and privacy:

Contactless EMV cards have actual digital signatures involved in the protocol instead of this dumb tokenization hack, so I don't see any reason why it'd be more secure.

Apple Pay probably doesn't have much of a future outside the USA. You might get some people in the UK using it, but in many other territories iPhone market share is too low for merchants to care, and contactless EMV cards already work pretty well, so there's no incentive to adopt Apple Pay and end up sharing revenue with Apple. Fraud is under control, the system is secure and convenient, there's no enrollment process to screw up with, etc. It's not clear to me that there are any real advantages of Apple Pay over the existing system (I mean, existing outside the USA).

Re:Simplicity?

[m.dillon]

I just squiggle when I have to sign a credit card slip. I don't bother using my signature at all, and haven't for about 20 years (even longer). Nobody cares. I did try using a big 'X' a few times but actually got some pushback on that. But I've never gotten pushback when I use a random scribble.

-Matt

Re:Simplicity?

[m.dillon]

In terms of convenience, ApplePay is about as easy as a contactless credit card. It takes me about 3 seconds to pay with ApplePay and at least for me it's faster than even a contactless card because I keep my phone in a more accessible pocket than I do my wallet.

More importantly, ApplePay is significantly easier to use than chip-and-pin or traditional cards, which is where its competition really is (because that is what most people use in the U.S. who are just now starting to migrate). And also significantly more secure for the user.

It is certainly far more convenient to use than Google Wallet or any Android payment scheme to-date which require you to turn on your phone and/or push into an App to use. Not sure why anyone is even arguing about Google Wallet or other Android pay schemes any more, they've already very obviously have lost that war and will need significant hardware upgrades to even come close to ApplePay's convenience or security.

Touching your wallet to the reader is a bit of a misnomer... works great if you have just one card in your wallet. Doesn't work reliably if you have more than one. Another interesting little tidbit on the contactless payment cards is that if you are standing in line and the person in front of you is paying, and your card is anywhere near the reader, the reader can pick up your card accidently. That has happened to a friend of mine several times, to the point where he now keeps his contactless card in a faraday-cage card slip. That doesn't happen with ApplePay because you have your finger on the fingerprint reader to complete the transaction.

-Matt

Re:Simplicity?

[Cederic]

but let's go down the list, that way we can include the Americans too, since they're getting more benefit from it:

Yes, lets.

1) It eliminates the need to carry additional, otherwise-useless pieces of plastic.

What, the waterproof lightweight ones that take up less room in my wallet (which I'm already carrying) than a bunch of other items (including cards that lack payment functionality)?

In return I just need to carry a £500 device, keep it charged, keep it dry, avoid physical impact and not break it?

2) It mitigates the need to make use of anti-skimming technology.

What is anti-skimming technology? Btw, based on my question, guess how often I consciously use it. Not really a major drain on my resources.

3) It eliminates entering PINs.

It does yes. But.. see below.

4) It eliminates magnetic swiping.

Nah, don't do that here.

5) It eliminates signing.

Nah, don't do that here.

6) It eliminates showing driver's licenses.

Nah, don't do that here.

7) It eliminates entering zip codes.

Nah, don't do that here.

8) It eliminates providing CCV/security codes.

Nah, don't do that in shops, ever.

The entire process is:
1) Unlock phone next to reader
2) Done

So wait? I have to unlock the phone? And that's somehow quicker or easier than entering a PIN? Ok.

What if I don't have my phone locked (I don't)?

So I disagree, it's not simpler. It's also not more secure for the rest of us, as my card is now more likely to be fraudulently used due to Apple inventing a whole new attack vector. Thanks dead Steve.

Re:Simplicity?

[Spy Handler]

What, the waterproof lightweight ones that take up less room in my wallet (which I'm already carrying) than a bunch of other items (including cards that lack payment functionality)?

In return I just need to carry a ã500 device, keep it charged, keep it dry, avoid physical impact and not break it?

Dumb argument. People who use Apple Pay were already carrying their iphones around. Nobody is expecting someone who had no desire to own an iphone to suddenly start carrying one just to use Apple Pay. And yes, having one less card to carry around is a bonus.

4) It eliminates magnetic swiping.

Nah, don't do that here.

5) It eliminates signing.

Nah, don't do that here.

6) It eliminates showing driver's licenses.

Nah, don't do that here.

7) It eliminates entering zip codes.

Nah, don't do that here.

Yeah, some people have to do all of those.

Your problem seems to be that you are utterly unable to comprehend another person's point of view. You don't have to deal with x, therefore x must be a non-issue.

So wait? I have to unlock the phone? And that's somehow quicker or easier than entering a PIN? Ok.

Yes, it's both quicker and easier than entering a PIN for most people. Compare 5 or more strokes on a keypad vs. placing your thumb on the Home button. And it's less error-prone (you may be a world-class keyboard cruncher with 100% accuracy, but many people are not and sometimes they hit the wrong key while entering a PIN and have to start over again)

Re:Simplicity?

[m.dillon]

No, the ApplePay CC number is not transmitted in any way, only the one-time token is transmitted. If the credit card reader is compromised it is theoretically possible to issue a payment using the one-time token before the payment can be issued by the vendor, but not really practical. And once a payment has been issued the token becomes worthless so the vendor will find out very quickly that they have been compromised (as in, within a few hours, possibly even in real time, rather than months later).

-Matt

Re: Simplicity?

[mjwx]

The bar likes it because they don't have to handle the cash.

Actually the bar hates it because they're now having to pay merchant fees where as with cash, they didn't.

This means they have to raise prices, raising prices means they will lose customers. Its a total loss for them.

Re: Simplicity?

[Jack Griffin]

A friend of mine manages a bar. He loves it because transactions are quicker meaning more drinks served meaning more profit. Patrons love it because it means lower queue times, meaning they come back more often, meaning more profit. The merchant fees are a part of doing business like paying rent or electricity. If a service provider can increase you business while charging a negligible fee in the process then it's a win for everyone.

Re: Simplicity?

[Anonymous Coward]

the problem is the pin vs the fingerprint. I have 5 chip & pin cards... and I can't memorize them all

Re: accounts

[BitZtream]

My bank and CC companies verified my request to add the card to ApplePay after I added it to my phone but before it was usable.

I had to login to THEIR sites, not Apples.

Fees and fraud prevention procedures

[sjbe]

Apple Pay is simply going to get too expensive for all but the most clueless merchants to use, both from the fraud and from Apple's eventual fees.

Anything Apple might charge will be a rounding error compared to the 3-5% the credit card companies charge merchants. Furthermore those fees get passed on to the customers so merchants only give a shit if their competition doesn't have to pay the same fees.

Regarding the fraud, it sounds like the banks aren't following their own security procedures which results in... duh, fraud.

It was a bad idea to begin with, and it's a bad idea now.

I could not disagree more. I'm not an Apple fanboi but I've used ApplePay and it's fantastic for customers. It's easily the best piece of tech I've seen come out of Apple since the iPhone itself. Remains to be seen how it will do in the market but Apple pretty much nailed the customer experience. If the banks cannot be bothered to follow appropriate fraud procedures then that's on them.

Re:Fees and fraud prevention procedures

[myowntrueself]

Apple Pay is simply going to get too expensive for all but the most clueless merchants to use, both from the fraud and from Apple's eventual fees.

Anything Apple might charge will be a rounding error compared to the 3-5% the credit card companies charge merchants. Furthermore those fees get passed on to the customers so merchants only give a shit if their competition doesn't have to pay the same fees.

Regarding the fraud, it sounds like the banks aren't following their own security procedures which results in... duh, fraud.

Apple will probably charge 30%

Re:Fees and fraud prevention procedures

[DogDude]

Anything Apple might charge will be a rounding error compared to the 3-5% the credit card companies charge merchants.

90% of sales in brick and mortar stores are card-based (as opposed to cash). No sane merchant is going to give up 0.5%-1% of total sales or whatever Apple ends up charging so their customers can have a "gee whiz neato" moment at check out.

And no, it's not 3-5%. It's closer to 2-2.5% for medium and large sized merchants.

Re:Fees and fraud prevention procedures

[macs4all]

Anything Apple might charge will be a rounding error compared to the 3-5% the credit card companies charge merchants. Furthermore those fees get passed on to the customers so merchants only give a shit if their competition doesn't have to pay the same fees.

Apple doesn't charge Merchants; it charges BANKS. And the fees are "aggregated" and VERY small (like around a thousandth of a percent). So "rounding error", indeed.

Re:Fees and fraud prevention procedures

[DogDude]

Apple doesn't charge Merchants; it charges BANKS.

Oh, and I'm sure the banks are doing it for free and won't change the rate on Apple Pay payments like they constantly raise the rates on regular cards. I love how banks are always giving away free things!!

Re:Fees and fraud prevention procedures

[macs4all]

Apple doesn't charge Merchants; it charges BANKS. Oh, and I'm sure the banks are doing it for free and won't change the rate on Apple Pay payments like they constantly raise the rates on regular cards. I love how banks are always giving away free things!!

IIRC, the fees are in the thousandths-of-a-percent world, are aggregated (no per-transaction reporting by the banks), and are essentially voluntary, since Apple does not have any way to verify what the Banks report/pay to Apple.

So no.

Re:Fees and fraud prevention procedures

[DogDude]

That's what they may be now. Credit card Interchange rates change monthly.

Re:Fees and fraud prevention procedures

[macs4all]

That's what they may be now. Credit card Interchange rates change monthly.

Hey, DogTurd: Start READING, not just BAYING.

Apple is NOT involved directly in ANY "per-transaction" fees (nor procedures).

Re:Fees and fraud prevention procedures

[DogDude]

Apple is NOT involved directly in ANY "per-transaction" fees (nor procedures).

So, how long do you think that Apple is going to do this for free....?

Re:Fees and fraud prevention procedures

[Anonymous Coward]

Run along now, grownups are speaking.

Some irony...

[MikeRT]

Suppose the industry banded together and said not just no but "Hell. No!" to measures to water down security in the name of convenience. Then they'd be accused of anti-competitive tactics and trying to protect their business model by many of Apple's supporters.

Re:Some irony...

[znu]

There was no need for them to "band together," as Apple Pay allows each card issuer to individually choose how much verification to do.

Why I won't be using Google Wallet

[sjbe]

.. I had to electronically send in a picture of a government-issued photo ID and a recent utility bill showing my home address.

Google can kiss my shiny-white-hiney if they think I'm going to share any of that with them. They already know too much about me. My bank has more than adequate information to confirm my identity to Apple or Google. They don't need more than they already have.

Short story: Retailers should probably trust Google's platform more when it comes to fraud.

Right because it would be so hard to forge a picture of a government photo ID and utility bill...

Re:Why I won't be using Google Wallet

[drunk_punk]

Just think of the absolute treasure trove of personal data... that google has OCR'd, indexed, and MONETIZED! Damn. I'm with you. Fuq em.

Re:Why I won't be using Google Wallet

[swillden]

Right because it would be so hard to forge a picture of a government photo ID and utility bill...

It's pretty difficult to do for each one of a file full of CC numbers you bought from a Russian hacker.

Actually, though, I should point out that the photo ID, etc. aren't part of the normal Google Wallet onboarding flow. Google Wallet does request information about name, address etc. which are cross-checked with the bank to confirm your identity. I'm not sure why the GP had to go further. Likely something triggered a fraud risk alert, which invoked the need for stronger verification. Note that I said "stronger", not "strong". Risk management isn't about perfect security, it's about raising the bar high enough to convince fraudsters to go somewhere else.

Re:Why I won't be using Google Wallet

[swillden]

Just think of the absolute treasure trove of personal data... that google has OCR'd, indexed, and MONETIZED! Damn. I'm with you. Fuq em.

Google doesn't use the ID verification data for anything else. Actually, it's not clear what it would be useful FOR. How does knowing your driver's license number help Google to decide what ads to show you?

Plus, the vast majority of users of Google Wallet don't have to submit this data. It's not the normal case.

Like everything else Apple makes

[Anonymous Coward]

Apple Pay is for stupid people.

Re:Like everything else Apple makes

[hcs_$reboot]

Apple Pay is for stupid people.

and comments like yours make /. for stupid people too.

Re:Like everything else Apple makes

[Fnord666]

Apple Pay is for stupid people.

I take it that you use Apple Pay daily then?

Re:Like everything else Apple makes

[Anonymous Coward]

Don't be silly. You were here long before he posted that comment.

Apple does not obfuscate transaction info

[sjbe]

It's Apple's problem because they're not providing enough information to the banks and credit card companies. For instance if it just shows up as "APPLE PAY" on my credit card statement, instead of "AP: WHOLE FOODS FL"

That does not happen. When I use ApplePay it shows up on my credit card statement as WALGREENS #3493 or similar. I just looked at a statement to confirm. Apple doesn't even appear on the statement line anywhere unless I'm actually buying something from Apple themselves (like through iTunes). They're providing all the information the merchants need to do the transaction and do it securely. If the banks cannot be bothered to secure their credit cards then that is a problem Apple needs to work out with the banks.

Paypal used to have the same exact problem but now provide lots of details on my statement instead of just "PAYPAL."

Different company, different product, different procedures. Not remotely relevant to this discussion because Apple does not do that.

Re:Apple does not obfuscate transaction info

[the_B0fh]

Come on, random haters gotta hate. They don't have to care or know how things actually work. They just need to throw up something that sounds sorta, maybe, plausible, and hates on.

Re:Apple does not obfuscate transaction info

[Applehu Akbar]

All they care about is that Slashdot be made Apfelrein.

Re:Apple does not obfuscate transaction info

[trout007]

Well Miami is pretty bad for scams.

Re:Apple does not obfuscate transaction info

[Anonymous Coward]

It appears the parent has confused Apple Pay with Google Wallet.

ApplePay uses industry standard tech

[sjbe]

I like the looks of Apple Pay, and think it's a great move forward but even as an Apple fan, it seems bizarre for Apple to move forward on their own payment standard rather than the industry creating one.

ApplePay uses industry standard technology that was not created by Apple. Apparently you were not aware of this. Plenty of merchants already have the necessary tech to use ApplePay whether or not they elect to accept it. The only thing Apple did was to make setting up and using the whole thing FAR easier. I fully expect ApplePay to get copied in part or in whole by the Android and Windows ecosystems.

Re:ApplePay uses industry standard tech

[DogDude]

I fully expect ApplePay to get copied in part or in whole by the Android and Windows ecosystems.

Nah, what's going to happen is Visa/Mastercard is going to do it themselves, and cut out all of the middlemen (Apple, Google, etc.)

Re:ApplePay uses industry standard tech

[sjbe]

Nah, what's going to happen is Visa/Mastercard is going to do it themselves, and cut out all of the middlemen (Apple, Google, etc.)

Really? How are they going to get access to the phones without going through Apple, Google or Microsoft? Curious how you think that is going to happen. If you say they're going to do it through an app I'll laugh my ass off.

Re:ApplePay uses industry standard tech

[DogDude]

Yeah, nobody writes apps these days. That'd be crazy.

Re:ApplePay uses industry standard tech

[gnupun]

But what if Apple, Microsoft and Google ban such apps from using NFC for payment or they have proprietary API not shared with app developers that you need to make an Apple Pay clone? After all, despite millions of apps, only 4 or 5 app stores exist in the mobile world and they belong to Apple, Google, Microsoft and other mobile OS vendors.

Re:ApplePay uses industry standard tech

[DogDude]

They could, but they'd shoot themselves in the leg because nobody would want a phone where you couldn't make standard Visa/MC transactions. Visa/MC are much larger and more influential than Google, Apple, and Microsoft combined, when it comes to payments. You can pay for shit without Google, Apple, or Microsoft, but you can't without Visa/MC.

Re: ApplePay uses industry standard tech

[rickb928]

I've been using Softcard for almost a year. Who's copying who?

Re:ApplePay uses industry standard tech

[pasamio]

Right because my Nokia 6610 always flawlessly handled VISA/MC transactions. Just look at the folk who jumped onto the NFC bandwagon as soon as Apple said they were there and then imagine if the triad managed to agree on an interoperable payment system instead of VISA/MC. PayPal is a simple example of paying for stuff without VISA/MC and there are plenty of other options out there.

Re:ApplePay uses industry standard tech

[DogDude]

Right because my Nokia 6610 always flawlessly handled VISA/MC transactions

I don't know what you mean by that because Visa/MC haven't done anything like that (yet). My point is that there's really little chance for any other middleman, whether it's Google, Apple, or anybody else to make themselves into an industry standard, because it's always going to be more expensive than using a top tier merchant processor that can give you Interchange Plus a basis point or two.

Paypal is a cute little thing for informal, small transactions. It's an unregulated, untrustworthy service that is still primarily used on eBay. It's not at all what

Six percent figure from where?

[stinkyj]

While I'm sure there is fraud, and maybe it is rampant, Abraham's 600bps statement is backed by no source. He might as well pulled out the old, "some people say" line to use with it.

Re:Six percent figure from where?

[Anonymous Coward]

Where does 0.1% come from, too? Mag-stripe and signature is completely insecure. The only way you could ever hit 0.1% is if it had SO MANY legitimate uses that the massive amount of fraud was simply diluted. Which is also why new payment methods are going to start out with higher fraud rates - if few people use them for legitimate reasons, the frauds are a greater percentage. The total level of fraud on ApplePay is going to be 3 or 4 orders of magnitude smaller than on mag-stripe CC.

its worth noting they arent independent.

[nimbius]

Mastercard and Visa are the only two companies that handle credit card transactions at the end of the day, and theyve often admitted theyre effectively the same company. Apple is acting as a credit card processor, and affording nothing more than a luxurious API to developers and consumers at a premium that includes the credit card processing fee assessed by the only credit card processing monopoly in america. Its why credit card companies compete with, but ultimately dont care about, apple pay.they control the VAN (Value added networks) through which credit and debit cards get processed.

What Apple should be worried about here is fraud, for which credit card companies have zero tolerance outside their own fuckups. Screw up too many times and your processing fees go up and banks flag you for fraud analysis. screw up way too many times and they revoke your processing capability entirely.

Re:its worth noting they arent independent.

[Chrisq]

Mastercard and Visa are the only two companies that handle credit card transactions at the end of the day, and theyve often admitted theyre effectively the same company.

Don't American Express handle their own too?

Re:its worth noting they arent independent.

[DogDude]

No, American Express goes through the same network. That's why it's more expensive than Visa/MC. When you get a merchant account, you get another American Express merchant number that you plug into wherever you're processing Visa/MC.

Re:its worth noting they arent independent.

[swillden]

Mastercard and Visa are the only two companies that handle credit card transactions at the end of the day

Actually, Mastercard and Visa aren't even companies. They're associations of banks. There are incorporated entities under those names (many of them, actually, one per country, plus Mastercard International and Visa International, which themselves have many national subsidiaries), but they don't issue credit cards, and only operate some pieces of the transaction processing networks.

theyve often admitted theyre effectively the same company.

As someone who regularly meets with representatives from both, discussing areas where the competitors are trying to collaborate on standards but without giving up any edges, I call bullshit on this claim. They're most definitely separate, and competitors. It is true that their interests align in some cases, and they work together almost as much as they compete, but your claim that they're the same company is just ludicrous.

Re:its worth noting they arent independent.

[macs4all]

Apple is acting as a credit card processor

You're confusing Apple Pay with Google Wallet and Current-C.

By design, Apple is specifically not in the CC processing business. Once set up, Apple has absolutely zero visibility into individual transactions. That remains strictly the purview of the Banks and Merchants. Apple simply isn't involved, period .

Got it?

Re:its worth noting they arent independent.

[Anonymous Coward]

At one time they were an co-op of banks, not any more, both are publicly traded corporations on the NYSE.

Visa International no longer exists, it was rolled into Visa along with Visa USA and Visa Canada before the IPO. The European operations remains a co-op. The original member banks held a minority position in Visa when it went public in 2008.

Mastercard International was changed to Master Worldwide before their IPO in 2006.

Not pointless at all

[sjbe]

Contactless is pointless and expensive as fuck for merchants.

If your customers like it then it is not pointless. Furthermore most merchants either already have the tech or will have it within the next year. The costs get passed on to customers anyway so the only relevant comparison is if one merchant is getting a better deal than another merchant. If both accept the same methods of payment then there is effectively no cost to the merchant at all. You need to familiarize yourself with the concept of Incidence of Payment.

I can't imagine many businesses where the "neat-o" factor from a few phone enthusiasts to be able to pay with their phones is going to outweigh the costs.

Because it won't be just a few phone enthusiasts. Have you not paid any attention to the effect Apple often has on markets it enters? ApplePay is easy enough my mother can use it and I assure you that she is no "phone enthusiast" and certainly not a techie. If you need an example, walk into any Starbucks and watch how many people pay with their phones. And that process is MUCH harder than ApplePay. People LIKE this tech and they'll use it.

Re:Not pointless at all

[DogDude]

If your customers like it then it is not pointless. Furthermore most merchants either already have the tech or will have it within the next year. The costs get passed on to customers anyway so the only relevant comparison is if one merchant is getting a better deal than another merchant. If both accept the same methods of payment then there is effectively no cost to the merchant at all. You need to familiarize yourself with the concept of Incidence of Payment.

Or the ones that don't accept the payment are going to save a percentage point or more annually. It's not in any way free.

Because it won't be just a few phone enthusiasts. Have you not paid any attention to the effect Apple often has on markets it enters? ApplePay is easy enough my mother can use it and I assure you that she is no "phone enthusiast" and certainly not a techie. If you need an example, walk into any Starbucks and watch how many people pay with their phones. And that process is MUCH harder than ApplePay. People LIKE this tech and they'll use it.

The number of people who will not shop somewhere because they can't swipey their phones will in no way measure up to the additional cost Apple or Google or anybody is going to take off the top.

I think you're really underestimating how much this is going to cost. A brick and mortar retailer operating on razor thin margins isn't going to give up that much in sales just so a few phone fanatics can go "neat!" at check-out.

Yes simplicity

[sjbe]

How on earth does Apple Pay have more simplicity than a credit card?

No swipe. No handing the card to the cashier to verify signatures. No request for ID. No pulling the card out of the wallet. No signature. Takes about 3 seconds for the payment to complete. ApplePay is significantly less hassle than a credit or debit card.

I've actually used ApplePay and there is not a faster or easier payment method out there right now. Not credit cards, no other contactless payment system, not cash, and certainly not checks. They all have their uses and advantages but given a choice and having used all of them I'd use ApplePay preferentially in most cases. I almost always have my phone with me anyway so it works great for me.

1. Touch card or even whole wallet on reader.

Yeah, that doesn't work. Hell, I have a chipped card and most of the places I've tried it it does not work because the merchant disabled the capability. Certainly doesn't work from inside my wallet and even if it did I'd still be asked to show the card and/or my ID.

It doesn't get much simpler than the first one, really. I don't even have to extract my card.

You must not do much shopping in the US because you definitely have to here.

Re:Yes simplicity

[serviscope_minor]

ApplePay is significantly less hassle than a credit or debit card

I don't have to do any of that to pay with my debit card. I touch my wallet to the reader and I'm done.

Yeah, that doesn't work.

Yeah it does.

Certainly doesn't work from inside my wallet and even if it did I'd still be asked to show the card and/or my ID.

My wallet is not a farady cage, and I've never been asked to reveal my card. Hell many of the places I use it aren't even manned.

You must not do much shopping in the US because you definitely have to here.

Nope, almost none, seeing as I live in Europe.

Re:Yes simplicity

[sjbe]

I don't have to do any of that to pay with my debit card. I touch my wallet to the reader and I'm done.

And I don't have to do any of that with my phone. Touch and I'm done. PLUS nobody else can use my phone to pay unless they have my fingerprint. Is your wallet secure like that? Plus I'm curious how you would determine which card pays if you have more than one.

Yeah it does.

I didn't say it cannot work, I'm telling you it DOES NOT work at least on this side of the pond because almost nobody has NFC readers and the compatible cards over here.

My wallet is not a farady cage, and I've never been asked to reveal my card. Hell many of the places I use it aren't even manned.

That does not describe the shopping experience anywhere I've ever gone. We get asked to see the signature on the back and/or ID regularly for debit or credit cards. Most places your only option is magnetic swipe. Hell I even have a chipped card and the chip may as well not be there because I have yet to try it in a place where it works, even with major retailers.

Re:Yes simplicity

[serviscope_minor]

And I don't have to do any of that with my phone. Touch and I'm done. PLUS nobody else can use my phone to pay unless they have my fingerprint.

So you don't mean touch plus done. You mean "finger print, touch then done".

I'm prepared to trade the off chance of losing 20 quid to a stolen card for the convenience of not having to authenticate. For bigger transactions, there's a personal identification PIN number.

I didn't say it cannot work, I'm telling you it DOES NOT work at least on this side of the pond because almost nobody has NFC readers and the compatible cards over here.

Well, that's a bit different frmo "doesn't work". It works more or less everywhere now over here.

Re:Yes simplicity

[Dixie_Flatline]

We have the same readers here in Canada--or at least the same basic concept. I have my card in a thin (Bellroy) wallet, and even with it open I can't get the touch-to-pay to work without pulling out the card a bit to expose the little symbol. Or at least, it doesn't work reliably.

Paying with my phone wouldn't be any less burden, but it wouldn't be any MORE burden either, and it would save me some space. When I go on long bike rides, I always have my phone, but I may leave my wallet at home and only bring a couple cards instead. This would eliminate the need for me to carry (and worry about) my cards all together. That's pretty nice.

It's the same reason why I have a keyfob on my car-keychain that is hooked up to my credit card. If I forget my wallet before I get in the car, I'm not hopelessly doomed if I need to fill up. It's happened, and the keyfob saved me.

Re:Yes simplicity

[Anonymous Coward]

I think this is a case of Apple inventing a solution to a problem no one except the USA has.

But given that the USA is so far behind in tech, they think it's the bee's knees.

In reality, the rest of the world has been using contactless and/or pin transaction for years and Apple Pay is actually a slower and more complicated solution, not an improvement. It's also being proven as less secure. Way to go Apple.

Re:Yes simplicity

[Jack Griffin]

You must not do much shopping in the US because you definitely have to here.

So is this problem with the technology or your stupid country? Seriously, so many discussions in this group seem to based around how the US uses some third world way of doing things, while the rest of the developed world has already solved those same problems. Contactless payments which require a simple wave of the hand with either card or NFC phone (even through a wallet) have been working everywhere else for years. The problem is not the technology.

Look Ma, No Card

[Immerial]

Here's how it gets easier. No cards to carry. I don't know about you but I carry four credit cards with me. Heck I could even imagine no wallet. One less thing to carry. Touch phone to reader... done. Works for other things too... unlike your credit card. Hotel door room, electronic key for your car/house, airline boarding passes, movie passes. (Yes, I mixing the two... but that shows the simplicity of it.) One phone to rule them all! (small print: "And in the darkness bind them.") :D

Re:Look Ma, No Card

[rkww]

I think you've missed out the bit where your credit card contains a contactless chip. At which point it can facilitate all the things you describe, without your having to give a percentage to Apple.

You could even tape the card to your phone :-)

Re: Look Ma, No Card

[Anonymous Coward]

My cards have no such ability, and Apple isn't charging me a percentage directly

Fraud rampant in Apple Pay

[Anonymous Coward]

There is much FUD and disinformation in this story and the comments posts that the entire page is useless. Most of you people reveal a strong bias against Apple in your writing (much of which also is produced by embarrassingly undereducated writers) and you have gotten many of the facts wrong as well. Move on. Nothing to see hee.

Re:Fraud rampant in Apple Pay

[Anonymous Coward]

take it up the arse fanboi

Re:Fraud rampant in Apple Pay

[CaptainDork]

There is absolutely no enlightenment embedded in your comment.

Why did you post at all?

Why you graduate from middle school, you may be able to reformulate post this way:

1.) "Y'alls shit is fucked up."

2.) Here's why: ... "

I suspect the reason you left out step 2.) is because you are more ignorant than those you accuse.

Who is eating the losses?

[Anonymous Coward]

I would presume Apple.

Free for life

[Anonymous Coward]

Does this mean I never have to pay for anything out of my own pocket for the rest of my life?

Insurance and regulation problem

[kefalonia]

This is a good example of what happens when a market is totally unregulated:

* big fish eats small fish; Interestingly, small fish here are the banks, and even smaller fish are the consumers

The remedy to this situation may be to force insurance costs across all transacting parties, so that there is an incentive for liability and correct behaviour.
Otherwise, what we have here is banks passing down the risks to consumers, who are little to not able to react and avoid their troubles.
Or, you can hope that one day the banks will automatically fix the problem. Oh, boy.

Laissez-faire, in the wild financial west, anyone?!

Laugh

[koan]

At this point Apple has become synonymous with "insecure".

Stop talking shit about Apple!

[Anonymous Coward]

They invented digital transactions, give them a little leeway.

How was this even allowed?

[Anonymous Coward]

Aren't all companies who back-end credit cards... aren't they suppose to have certification to make sure everything is okay?

A 10% fraud rate compared to any of it's nearest competitors (tap-to-pay cc, google wallet) is insane.

Re:How was this even allowed?

[Cederic]

Yeah, if they sustain these fraud rates then Visa/Mastercard are likely to pull the plug purely to protect their own brands.

"Buy with VISA, so that crooks can too"?

Re:How was this even allowed?

[m.dillon]

Well, its pretty obvious that the so-called fraud rate is a made-up number. It would be insane if it were true. But most likely... it's insane because the author made it up.

-Matt

Bright side of the rainbow

[Anonymous Coward]

I dont' want to sound too optimistic, but if someone's using one of this compromised CC's, with Apple Pay at least you have their fingerprint in record. The rest of the thief catching process is trivial.

LA

Technology first, Security later

[ripvlan]

Seems that the concept of re-inventing the wheel causes the folks new to the picture to either be ignorant of, or discounting all existing risk.

I can hear product management now: "Get the feature out - all of those concerns from the big fat banks aren't important - this is new! none of those problems will occur this time around !!!"

Not Apple Pay: banks

[Just Some Guy]

Apple isn't responsible for banks' security or lack thereof. Some backs apparently let you activate any card you have the information off of. My credit union (not an employee, just a very happy customer) went live with Apple Pay this morning and it was nothing like the story described. I added my debit card, and the Passbook app popped up a notice that I had to call my CU, including a button to push to dial them. The customer service rep asked for my "phone and chat authorization password", which is a password they required me to set up earlier and is not the same as my banking login password. Then she asked me to describe my most recent debit card purchase and for the name of the company that direct deposits my salary. Only then did she authorize my debit card for Apple Pay.

It was mildly inconvenient in exactly the way I want my banking security to be. It wasn't enough for me to take a picture of some random credit card I'd found. Instead, I had to call my CU and convince an actual human that I'm who I claim to be. It wasn't perfect, sure: she didn't require a DNA sample or a retina scan, but it was vastly more secure than any other debit or credit card transaction I've ever made before.

Some banks (again, not Apple) are playing fast and loose with security for the short term convenience of their users. It sucks in the long term, sure, when the bank lets a thief authorize a stolen debit card and their customer has to get a new one issued, but someone did the math and decided this was a good idea. That's a problem with those banks, though, and not a design flaw in the system. Apple can't do much to improve that unless they wanted to man-in-the-middle security checks between a bank and its customers.

Re:Not Apple Pay: banks

[Anonymous Coward]

You lost me when you said you use debit card for purchases.

Re:Not Apple Pay: banks

[Just Some Guy]

Is this not common in your country?

Re:Not Apple Pay: banks

[Anonymous Coward]

Not really, because I get incentives to use credit card, like 2.625% cashback minimum on all purchases currently and up to even 5% on some categories like groceries, gas, restaurants. Also I get better protection than your run of the mill debit card.

We are in the same country, btw.

It's real, and it will be fixed...

[rickb928]

This is Big Deal at work. We saw nothing like this with Softcard or Google Wallet, and most of the causes are related to sloppy onboarding. Right now we are writing off almost all losses, but that's only until we resolve the major problems.

This is not just the onboarding however, and we will see changes in how these charges are authed.

Growing pains. I'm not excessively worried yet.

Re: accounts

[Macman408]

Ditto here. I forget what I had to do to verify, but it was basically the same as if I had called in and wanted to do something with my account. In fact, that's exactly what it was! At the end of entering the card into my iPhone, it prompted me to call the card's service phone number, where I verified my identity, and then they activated Apple Pay. This was in December, well before the rash of articles on this topic, so wasn't just a knee-jerk reaction by my bank.

True, it wasn't as much security as the bank wanted when I wired a down payment for my house; after receiving that fax, they asked no fewer than TEN security questions. I didn't know they had that many pieces of knowledge about me!

Show your work?

[turb]

So the person making this assertion is a consultant....

They didn't show their work in any way shape or form to back up their claim. Why would this person be any more knowledgable about potential fraud rates than either the banks or Apple for that matter?

#businesstroll

ftfy

[Anonymous Coward]

Some bank executives acknowledged that they were were so scared of COMPETITORS GETTING THE FEES that they didn't speak up.

I don't know... Seems secure to me

[worldthinker]

When I added an AMEX Business card to my ApplePay, it required me to contact AMEX and then be put through the ringer of answering a bunch of obscure questions including responding as to whether I lived at the addresses they proffered. Some from decades ago. It's pretty freaky that a credit card company would know all that about you. There was probably little question that the card I was adding to ApplePay was assigned to me.

Re:I don't know... Seems secure to me

[Anonymous Coward]

Sounds like a pretty straightforward identity check using one of Lexis-Nexis products. Pretty much the standard in ID validation these days - L-N has a ton of info on you to use to validate your identity.

The good news is that they have a secure API that keeps the banks from seeing that identity check info.

(full disc: i'm not a coder but did manage a project to implement an identity check API for a large organization)

The facts are...

[RSA7474]

Fraudsters find the weakest link to exploit, in this case it is the issuers (which there are 100s btw) in the US. Apple Pay, just like EMV, is a secure _platform_, so therefore, if implemented properly can be used to combat fraud. If as an issuer you are accepting Apply Pay as a secure platform and do not complete the necessary quality checks to ensure the loaded card is not compromised you become the weakest link. I do not understand why people are calling for Apple Pay to increase the level of checks required when it is the issuing banks laziness to implement proper controls in order to increase their speed to market. It is not until we have a market-wide dynamic CVV (or like technology) available will we never see fraud virtually disappear. The fact is that issuers need more stringent controls in place in how the authorize a card into Apple Pay and two-factor authentication is a sure way to do it. Relying on information like social security numbers, address, location, etc. is no longer secure enough.

Re:1 in 20 ApplePay transactions are fraudulent

[DocSavage64109]

I would bet the high percentage of fraud is because not many people are even using the system for legitimate purposes. Why mess with my phone when a credit card works fine?

Identity Fraud is the issue!

[jammz]

This article completely misrepresents the issue, which is identity fraud. Yes, I know it's easy to hate on Apple, but if you're a thoughtful individual, read this story at Forbes for a better explanation of the issue. ApplePay isn't at fault here. Banks and their lax verification practices are when coupled with how easy it is to steal identity data.

Wait aminute...

[Anonymous Coward]

The Apple-Pay software requires the Iphone with the fingerprint reader.

Doesn't Apple, and the Credit Card Companies, and the Banks, all know exactly who the criminal is?
Name and address included.
Once the authorities are notified, then it is a quick drive to arrest the criminal.
If the Iphone ApplePay is used in credit card fraud just once, then that Iphone should be blocked from any further ApplePay transactions.

Where is the problem here?

Call me a Fan Boi

[BadPirate]

But it seems to me that more and more often the knee jerk reaction to these articles should be that they are full of crap and misdirection. Far too many news outlets, bloggers, etc, have realized the kind of click through they can generate by creating a fake Apple-Gate, and the torrent of hits from both sides of the conflict is too appealing for them to correct the content or unbias a headline.

Fingerprint is the real deal

[Anonymous Coward]

I think many people here are missing a key point... I read comments about cards with tap and pay being easy to use as ApplePay, but the big problem with modern chip and pin cards (also contactless) is that you have to type a pin! And most of all you have to remember the damn pin!

I have 5 cards with chip and pin and do you think I'm able to remember all of them???

Apple Pay is still not available in Europe where I live but I would love it If I can get rid of the pin and use my fingerprint to authorize a payment. Now I have to open the phone, launch an application and read the pin...

this is competely false

[johncandale]

I have worked in several places in the back office and the merchant always took the loss when there was a question of fraud.

How to compare numbers

[Anonymous Coward]

Instead of:

> 6 percent, compared with a traditional credit card fraud rate that is relatively minuscule, 10 cents for every $100 spent. [i.e. one tenth of one percent]

How about:

> 6%, compared with a traditional credit card fraud rate of 0.1%.

Too bad they didn't speak up.

[ebvwfbw]

History shows us that a company like apple gets one shot when the market is already owned by someone else like Android. If there's a problem due to their carelessness, the banks could simply shut them down cold and demand big changes before they take a dime again. I'd hope Apple would be smart enough to know that. Someone should have told them to feel free to comment, no goons are here. We really want to know. Now they could be done.

Real shame, I own quite a few Apple products. Just not like they used to be. I'm wondering if I'll own any apple products by 2020.