Fraud Rampant In Apple Pay

PvtVoid writes with this report from the New York Times, excerpting: An industry consultant, Cherian Abraham, put the fraud rate [for Apple Pay] at 6 percent, compared with a traditional credit card fraud rate that is relatively minuscule, 10 cents for every $100 spent. [i.e. one tenth of one percent]. The vulnerability in Apple Pay is in the way that it — and card issuers — "onboard" new credit cards into the system. Because Apple wanted its system to have the simplicity for which it has become famous and wanted to make the sign-up process "frictionless," the company required little beyond basic credit card information about a user. Nor did it provide much information to the banks, like full phone numbers and addresses, that might help them detect fraud early. The banks, desperate to become their customers' default card on Apple Pay — most add only one to their iPhones — did little to build their own defenses or to push Apple to provide more detailed information about its customers. Some bank executives acknowledged that they were were so scared of Apple that they didn't speak up.

Comments

Aren't these already compromised cards?

[Galaga88]

The story doesn't really indicate how this could be much of Apple's problem - it sounds like the cards that are getting used are already stolen?

I guess what's happening is criminals are getting stolen CC info, and are then able to use it in a physical environment via Apple Pay where it previously would have required printing a forged card?

The article mentions that it's easier to get away with fraud in person because the lack of shipping delay leaves less time to catch it, which shows why they'd be so eager to jump to a method like this.

Re:Aren't these already compromised cards?

[rgbscan]

This is exactly what it is. Already compromised cards being added as payment token. Banks are supposed to follow a protocol called "Yellow path" to prevent this fraud, but since everyone wants their ApplePay to work right away without having to call a call center, a lot of banks are lenient on the security checks. This is not a problem with Apple's technology, or the secure element on the phone, or the fingerprint reader. This is a bank allowing a card to be added to an ewallet, presumably because the party adding the card has all the relevant info (stolen identity) to make it work.

Re:Aren't these already compromised cards?

[Ronin Developer]

I read another article on this. As the article tries to expose, the fault lies not in Apple Pay, but rather in (as the article suggests), the process by which cards are authorized for use with Apple Pay during the onboarding process. There are two paths, the Green Path and the Yellow Path when authorizing a card. The difference is the types of information collected and passed. Most cards go down the Green path. But, when a card has incomplete information, it goes down the Yellow path and is subject to less stringent and, sometimes, manual intervention. It is down this pathway where the fraud occurs.

While a card is being approved during the Yellow pathway, the card can be used using the card number, expiration date and, not always, the security check value.

It is up to the banks and card issuers to secure their onboarding process. Apple (via Apple Pay) is not responsible for ensuring this takes place. Thankfully, the fraud is easy to detect and remedy. Next year, when our cards all have chips in them, the exposure via the Yellow Path will all be eliminated.

Apple supporters were right to call out Mr. Abraham - he is biased and attempting to create FUD against Apple and Apple Pay. The real fault and finger pointing needs to be directed to the banks and they need to get their houses in order.

Re:Aren't these already compromised cards?

[DogDude]

It's easier to punch stolen numbers into a phone than it is to print up an actual card. When chip + pin happens, all of the criminals will be using Apple Pay.

Re:Aren't these already compromised cards?

[Solandri]

When you use a credit card online or in the store, the merchant can use various information like your address, phone number, the security code printed on the card, your signature, to confirm the card is valid. (The U.S. is finally rolling out EMV smart card chips.) This is actually optional - the merchant doesn't have to do it. But if the cardholder issues a chargeback, the merchant's chances of successfully contesting the chargeback are much better if they've used these options. If you've ever wondered why the gas pump asks for your zip code when you use a credit card, this is why. It's not trying to collect marketing data, it's doing a rudimentary identity check to elevate the chances that you are the card's actual owner.

Anyhow, allowing transactions using only the card numbers themselves is horribly flawed because anyone can just take a photo of a card to get its numbers. So the credit card companies have come up with these other methods to "verify" the card's authenticity. (I put it in quotes because it doesn't actually verify the card's authenticity, just reduces the chances the card is not authentic.) Apparently Apple refused to forward much if any of this information to the banks when a fresh card is first being loaded into Apple Pay, making it easy to load a stolen credit card - easier than actually using the card for a purchase. And the banks were too cowed to make an issue of it, landing them in the mess they're in.

On the one hand it's the bank's fault for not speaking up and pressing a vital security issue. On the other hand it's Apple's fault for being an 800 pound gorilla which uses its market clout to force concessions from its partners. Stuff like this is why you always want at least two strong competitors in a given market - so if one makes unreasonable demands of a business partner, the partner is not afraid to tell them to go jump in a lake. It's the same reason we allow unions - because the hiring employer has a lot more clout than the individual employees.

Re:Aren't these already compromised cards?

[Galaga88]

On the one hand it's the bank's fault for not speaking up and pressing a vital security issue. On the other hand it's Apple's fault for being an 800 pound gorilla which uses its market clout to force concessions from its partners. Stuff like this is why you always want at least two strong competitors in a given market - so if one makes unreasonable demands of a business partner, the partner is not afraid to tell them to go jump in a lake.

I like the looks of Apple Pay, and think it's a great move forward but even as an Apple fan, it seems bizarre for Apple to move forward on their own payment standard rather than the industry creating one. I mean, I know they did it so that they could skim profits off the top, and that they got away with it because they're worth 700 gazillion dollars and could probably make demands of the ocean, but I really wish this had come about via an industry standard.

Of course then, it'd probably suck.

Re:Aren't these already compromised cards?

[jellomizer]

So if you use Apple Pay, you have less of a chance of getting YOUR credit card data stolen... However if your credit card had already been stolen, Apple Pay means there is a higher chance of it getting used. Because you won't need to face someone who may question your identity.

Re:Aren't these already compromised cards?

[znu]

Apple Pay is built on top of standardized front-end payment infrastructure, and competing systems can be (and are being) built on that infrastructure as well. It's analogous to being able to visit, say, either Google or Bing from the same computer; the world doesn't need to agree on a single standard search engine if multiple search engines can be accessed via the same front-end (in that case, the web browser and user's Internet connection), and in fact user choice is better enabled if it doesn't.

Re:Aren't these already compromised cards?

[myowntrueself]

Apple supporters were right to call out Mr. Abraham - he is biased and attempting to create FUD against Apple and Apple Pay. The real fault and finger pointing needs to be directed to the banks and they need to get their houses in order.

Indeed.

If the banks had the courage to confront Apple and demand that Apple Pay include more information then this wouldn't have happened. Its entirely the banks fault for being scared of Apple (which probably has a larger war chest than all those banks combined).

Re:Aren't these already compromised cards?

[Immerman]

In fairess, it doesn't sound like there's a problem with Apple's implementation - it may well be perfectly(hah!) secure. But security is only as good as the weakest link, and if the banks aren't doing their job of verifying that the CC account being bonded to the Apple-Pay account is actually legit - well then there's a giant F'ing hole in the security that theives will enter by the busload. Nothing Apple can do about that, technologically at least - though if they're pressuring banks to provide a "painless" bonding experience, well then they do bear some responsibility.

Re:Aren't these already compromised cards?

[Austerity Empowers]

...and stop calling me Shirley.

Re: Aren't these already compromised cards?

[Lumpy]

Actually an apple employee will show up and push you off the cliff if you dont jump. It's a part of the customer care program.

Re:Aren't these already compromised cards?

[AmiMoJo]

ApplePay is part of the problem. Because it tries so hard to keep information away from banks and retailers it makes it harder to detect fraud. If Apple were providing things like names and phone numbers to the banks they could very easily see that a particular CC was not being used by the authorized owner or on a phone they had never used it with before.

To be fair, banks could have demanded that information during sign up, but didn't. There is plenty of blame to go around. What I'd like to know is who pays for it. Usually it is the merchant, in which case I'd expect to see some of them refusing Apple Pay.

Re:Aren't these already compromised cards?

[_xeno_]

It may not be Apple's fault (exactly), but it sure as hell is their problem. If more than 1 in 20 ApplePay transactions are fraudulent, what merchant in their right mind is going to accept it as a payment method? (Remember that fraud is paid by the merchants, not the banks.)

Even if it isn't Apple's fault, it sure is their problem to solve.

Re:Aren't these already compromised cards?

[Registered Coward v2]

This is exactly what it is. Already compromised cards being added as payment token. Banks are supposed to follow a protocol called "Yellow path" to prevent this fraud, but since everyone wants their ApplePay to work right away without having to call a call center, a lot of banks are lenient on the security checks. This is not a problem with Apple's technology, or the secure element on the phone, or the fingerprint reader. This is a bank allowing a card to be added to an ewallet, presumably because the party adding the card has all the relevant info (stolen identity) to make it work.

Here's what I don't understand. ApplePay is tied to a specific phone and has, or should have, access to user specific identification that it can share with the bank. If that doesn't match with the banks info, such as phone number on the account, then they could refuse ApplePay. They could send an email to the card holder or call an alternate phone number to verify the card is not compromised, or refuse to activate the card if a second phone with a spoofed phone number attempts to activate. They also have access to location data and use that to refuse ApplePay; in fact with the iPhone they can get data real time on card use and location

It seems they have more, not less, information available to validate a card is in fact being used by the cardholder. If ease of use is so important than they'll have to live with a higher fraud rate.

Re:Aren't these already compromised cards?

[doug141]

I've seen a 4-figure mail-order fraud fail to work because the crook couldn't give the CCV numbers over the phone.

Re:Aren't these already compromised cards?

[Bacon Bits]

I always assumed CCV was designed to offer basic protection against incidental photographs of the card being taken, and other situations where only one side of the card has been compromised.

Re:Aren't these already compromised cards?

[dave420]

You should probably read what the CCV is for before telling everyone you can't be bothered to and just making up your own explanation.

Re:Aren't these already compromised cards?

[Theaetetus]

I always assumed CCV was designed to offer basic protection against incidental photographs of the card being taken, and other situations where only one side of the card has been compromised.

Not really - Amex puts its CCV on the front of the card. The real purpose is that the CCV isn't encoded in the magnetic strip, and isn't embossed, so theoretically, someone using a magnetic swiper to steal data or someone dumpster diving for those old carbon paper-imprint style records would get the numbers but not the CVV.

But of course, the person who is stealing your credit card info is most likely your waiter, and they have a minute or two with your card over at the POS to copy down the CVV manually.

Re: Aren't these already compromised cards?

[slew]

Apples' implementation IS more *convenient* for the *fraudulent* user.

FTFY. By hiding some of the transaction information from the banks that clear the transactions, the fraud detection heuristics used by banks are less effective. By requiring no physical trace of the transaction, the merchants don't have any incentive to intervene to avoid chargebacks thus making it easier those in possession of stolen card numbers to rack up charges.

Actually this was quite predictable (and predicted by several industry folks), but fear of being left off the ship that was going to sail basically led the banks to just hope for the best as a cost of doing business.

Reminds me of a story a co-worker told me. Back many moons ago (~20years ago), he was a field engineer for mainframes. One day he got an emergency call from a customer that needed a mainframe fixed as some ridiculous hour of the morning. When he got there, his boss was there along with a half-a-dozen Bank presidents in suits in the computer room hovering and watching him work.

Later he found out from his boss that it was a mainframe that did real-time credit card approvals and the bank was basically approving nearly all transactions blind whilst they waited for the computer to be fixed. The theory was that if they didn't do this, people would just take out another card and they would lose all the business for potentially several days (the once bitten twice shy on c-c declines). Apparently all the Bank presidents were there as part of an agreement to verify if he wasn't able to fix the computer within that hour, they would start denying large transactions and they expected to lose tens of millions dollars in lost merchant fees if they did that (and something like that needed their immediate approval). That's why his boss didn't tell him that before he started working on the machine. No pressure...

Re:Aren't these already compromised cards?

[Strider-]

But of course, the person who is stealing your credit card info is most likely your waiter, and they have a minute or two with your card over at the POS to copy down the CVV manually.

And this is why the United States needs to move to EMV (Chip & Pin) like the rest of the world. Rather than the waiter taking your card away, they bring you a hand-held terminal, which you then take and perform the last portion of the contract yourself, with the card never leaving your hands.

Re:Aren't these already compromised cards?

[Theaetetus]

But of course, the person who is stealing your credit card info is most likely your waiter, and they have a minute or two with your card over at the POS to copy down the CVV manually.

And this is why the United States needs to move to EMV (Chip & Pin) like the rest of the world. Rather than the waiter taking your card away, they bring you a hand-held terminal, which you then take and perform the last portion of the contract yourself, with the card never leaving your hands.

Yep. Great system, though a little awkward when tipping and they're standing over you staring as you go to push the 10- no, 15- no, [gulp] 20% button. Maybe that's why they don't tip much in Europe.

That said, there's a reason why the US is moving to Chip & Signature cards, but not Chip & PIN. The banks will tell you it's because they don't want to confuse or scare their customers who can't learn new systems, but the real answer is that legally, if there's fraud on regular credit cards or chip & signature, the banks can charge it back to the merchant, who must have failed to verify the signature or ID of the purchaser. If there's fraud on chip & PIN cards, legally, the banks have to eat it. So they're not moving to that until they have to.

Re:Aren't these already compromised cards?

[Anonymous Coward]

The reason why in Europe tipping is less "rampant" is that the tip is a tip and not a the service charge. In most European countries, the service is calculated into the price of the meal, so you are paying the tip to encourage above average service and not to make sure the waiter gets paid at all.

Re:Calculated risk

[DogDude]

. They just pay it from their profits, and the customer doesn't have to worry.

No, they charge the merchant all different rates based on the risk of that particular transaction. There are hundreds of categories of cards, swiped vs non-swiped, address info vs no address info, etc. Apple Pay is going to be absurdly expensive for the merchants dumb enough to take it.

Re:Calculated risk

[Anonymous Coward]

they charge the merchant all different rates based on the risk

And then on top of that, when fraud is caught they just take the money back out of the merchant's account.

In no way do they ever "pay it from their profits".

Meanwhile on Google Wallet..

[DigitAl56K]

.. I had to electronically send in a picture of a government-issued photo ID and a recent utility bill showing my home address.

Short story: Retailers should probably trust Google's platform more when it comes to fraud.

Re:Calculated risk

[ShanghaiBill]

For credit cards, frauds are nothing to banks. They just pay it from their profits

No. Nearly all the cost of fraud is pushed onto the merchants, who pass it on to consumers in the form of higher prices. So you are paying for credit card fraud even if you pay cash.

This is the problem with credit card fraud. The banks are in the best position to fix the problem, but have little incentive to do so, since they don't bear the cost.

Simplicity?

[serviscope_minor]

How on earth does Apple Pay have more simplicity than a credit card? Here's how it works with a credit card:

1. Touch card or even whole wallet on reader.
2. Done!

And for more expensive transactions (over 20GBP, soon to be 30):

1. Insert card.
2. Enter PIN.
3. Done.

It doesn't get much simpler than the first one, really. I don't even have to extract my card.

Re: Simplicity?

[rkww]

I wish I could attach a video of how it's done in Europe-land. I can buy a beer in a pub with a contactless card: I simply touch it on the card reader; it never leaves my hand. And I don't need to provide a fingerprint or carry a many-hundred-dollar identity widget.

The bar likes it because they don't have to handle the cash. And if I lose my card I can have it disabled remotely with a single phone call.

Oh, and one more thing, if I lose my card and I need cash, I can phone the bank and get a six-digit code for an emergency cardless withdrawal from a cash machine.

It's all much easier when you don't assume everybody's a criminal.

Re:Simplicity?

[Anubis IV]

Though apparently fraud is rampant so it's actually worse.

Except that it's not, since the fraud isn't affecting Apple Pay users specifically. It's affecting everyone, but Apple Pay users are actually subject to less fraud.

The fraud being encountered here is that data which was stolen in credit card hacks last year is now being used to establish fraudulent Apple Pay accounts, even if that person doesn't own a single Apple device. It stems from a twofold problem:
1) It's a failure of the pre-existing systems to properly secure their data in the first place. Apple Pay and similar systems inherently protect against those forms of attack by never using that data to begin with.

2) It's a failure by the banking institutions to enact higher verification standards for cards that are already known to have been compromised, even though they've known about the stolen data since at least last April. Banks are responsible for verifying that new payment methods are being established by the valid card owners, as they should be, but they failed to do their due diligence here.

Neither of those is an inherent failure in Apple Pay. Rather, both are failures in the systems on which the entire financial industry is built. In contrast, problems such as skimming are inherent in the use of EMV cards as a method of payment.

And it's a bit hard to claim that you never have to do any of those things, when by your own admission you have to enter PINs and zip codes at least some of the time, not to mention that you have to fill in all of your personal information when doing online shopping. And what's the "entire extra step"? Unlock the phone? Since it's using Touch ID, it's unlocked in the same motion that takes it out of your pocket and puts it next to the reader. There is no extra step. It's something that just happens along the way.

Re:Simplicity?

[m.dillon]

In terms of convenience, ApplePay is about as easy as a contactless credit card. It takes me about 3 seconds to pay with ApplePay and at least for me it's faster than even a contactless card because I keep my phone in a more accessible pocket than I do my wallet.

More importantly, ApplePay is significantly easier to use than chip-and-pin or traditional cards, which is where its competition really is (because that is what most people use in the U.S. who are just now starting to migrate). And also significantly more secure for the user.

It is certainly far more convenient to use than Google Wallet or any Android payment scheme to-date which require you to turn on your phone and/or push into an App to use. Not sure why anyone is even arguing about Google Wallet or other Android pay schemes any more, they've already very obviously have lost that war and will need significant hardware upgrades to even come close to ApplePay's convenience or security.

Touching your wallet to the reader is a bit of a misnomer... works great if you have just one card in your wallet. Doesn't work reliably if you have more than one. Another interesting little tidbit on the contactless payment cards is that if you are standing in line and the person in front of you is paying, and your card is anywhere near the reader, the reader can pick up your card accidently. That has happened to a friend of mine several times, to the point where he now keeps his contactless card in a faraday-cage card slip. That doesn't happen with ApplePay because you have your finger on the fingerprint reader to complete the transaction.

-Matt

Re: accounts

[BitZtream]

My bank and CC companies verified my request to add the card to ApplePay after I added it to my phone but before it was usable.

I had to login to THEIR sites, not Apples.

Apple does not obfuscate transaction info

[sjbe]

It's Apple's problem because they're not providing enough information to the banks and credit card companies. For instance if it just shows up as "APPLE PAY" on my credit card statement, instead of "AP: WHOLE FOODS FL"

That does not happen. When I use ApplePay it shows up on my credit card statement as WALGREENS #3493 or similar. I just looked at a statement to confirm. Apple doesn't even appear on the statement line anywhere unless I'm actually buying something from Apple themselves (like through iTunes). They're providing all the information the merchants need to do the transaction and do it securely. If the banks cannot be bothered to secure their credit cards then that is a problem Apple needs to work out with the banks.

Paypal used to have the same exact problem but now provide lots of details on my statement instead of just "PAYPAL."

Different company, different product, different procedures. Not remotely relevant to this discussion because Apple does not do that.

Re:Some irony...

[znu]

There was no need for them to "band together," as Apple Pay allows each card issuer to individually choose how much verification to do.

Six percent figure from where?

[stinkyj]

While I'm sure there is fraud, and maybe it is rampant, Abraham's 600bps statement is backed by no source. He might as well pulled out the old, "some people say" line to use with it.

its worth noting they arent independent.

[nimbius]

Mastercard and Visa are the only two companies that handle credit card transactions at the end of the day, and theyve often admitted theyre effectively the same company. Apple is acting as a credit card processor, and affording nothing more than a luxurious API to developers and consumers at a premium that includes the credit card processing fee assessed by the only credit card processing monopoly in america. Its why credit card companies compete with, but ultimately dont care about, apple pay.they control the VAN (Value added networks) through which credit and debit cards get processed.

What Apple should be worried about here is fraud, for which credit card companies have zero tolerance outside their own fuckups. Screw up too many times and your processing fees go up and banks flag you for fraud analysis. screw up way too many times and they revoke your processing capability entirely.

Re:its worth noting they arent independent.

[DogDude]

No, American Express goes through the same network. That's why it's more expensive than Visa/MC. When you get a merchant account, you get another American Express merchant number that you plug into wherever you're processing Visa/MC.

Re:Yes simplicity

[serviscope_minor]

ApplePay is significantly less hassle than a credit or debit card

I don't have to do any of that to pay with my debit card. I touch my wallet to the reader and I'm done.

Yeah, that doesn't work.

Yeah it does.

Certainly doesn't work from inside my wallet and even if it did I'd still be asked to show the card and/or my ID.

My wallet is not a farady cage, and I've never been asked to reveal my card. Hell many of the places I use it aren't even manned.

You must not do much shopping in the US because you definitely have to here.

Nope, almost none, seeing as I live in Europe.

Re:ApplePay uses industry standard tech

[DogDude]

Yeah, nobody writes apps these days. That'd be crazy.

Laugh

[koan]

At this point Apple has become synonymous with "insecure".

I don't know... Seems secure to me

[worldthinker]

When I added an AMEX Business card to my ApplePay, it required me to contact AMEX and then be put through the ringer of answering a bunch of obscure questions including responding as to whether I lived at the addresses they proffered. Some from decades ago. It's pretty freaky that a credit card company would know all that about you. There was probably little question that the card I was adding to ApplePay was assigned to me.

Identity Fraud is the issue!

[jammz]

This article completely misrepresents the issue, which is identity fraud. Yes, I know it's easy to hate on Apple, but if you're a thoughtful individual, read this story at Forbes for a better explanation of the issue. ApplePay isn't at fault here. Banks and their lax verification practices are when coupled with how easy it is to steal identity data.

Re:Yes simplicity

[Dixie_Flatline]

We have the same readers here in Canada--or at least the same basic concept. I have my card in a thin (Bellroy) wallet, and even with it open I can't get the touch-to-pay to work without pulling out the card a bit to expose the little symbol. Or at least, it doesn't work reliably.

Paying with my phone wouldn't be any less burden, but it wouldn't be any MORE burden either, and it would save me some space. When I go on long bike rides, I always have my phone, but I may leave my wallet at home and only bring a couple cards instead. This would eliminate the need for me to carry (and worry about) my cards all together. That's pretty nice.

It's the same reason why I have a keyfob on my car-keychain that is hooked up to my credit card. If I forget my wallet before I get in the car, I'm not hopelessly doomed if I need to fill up. It's happened, and the keyfob saved me.