Apple Pay Shown to Work Internationally Using U.S.-Based Credit Cards

[lavvo]

TouchID

I love reading the reactions of people that keep saying they don't get it. Why is Apple Pay special or NFC has been here for years or Finger Print readers have been here for years.

The key here is TouchID. Apple may not always be the first to do something, but when they do, they do it right. For one, Apple's implementation of TouchID is super simple. When I hear people ask what's special about it, it's obvious they have not tried it out yet. Not only is TouchID so simple, but the fingerprint reader is hands down the best I have ever used on any consumer device. It is super sensitive, fast and precise.

Secondly, Apple releases features as proof of concept before rolling them out fully, and this is what makes them different and ensures they deliver solid products and implementations. For example, TouchID was available on the 5S as a proof of concept for Apple Pay, which was then advanced to the next level by introducing Apple Pay in the iPhone 6.

This is the future. This will most likely be taken further in the future with other products like the Mac. I can see it already, imagine your power button on the Mac being TouchID capable. It's about the same size as the home button. Imagine being able to boot and login with TouchID on your Mac. Imagine being able to shop online on your Mac using TouchID within any website that supports Apple Pay or making iTunes purchases (which is all real right now on the iPhone). No need to enter any CC info. One-click TouchID shop and Go.

The iPhone is the proof of concept to further this, this will be huge. But that's fine, not everyone has to get it. That's the difference between leaders and followers. Some people just need to see the end result before they finally get it.

 

[Michaelgtrusa]

On top of the money game.

 

[dancefreak]

So, that is $1500 in profits for every million in credit card transactions.

Yeah so $1.5B of income for every trillion. Total credit card transactions are multiple trillion dollars per year. For now Apple's income from it will amount to pennies in the grand scheme of things but Apple is in this for the long game and five years from now when more people have capable devices and more people are comfortable with paying this way, it has the potential to be a valuable revenue stream.

 

[xero9]

Apple sells advertising and Google sell advertising, both based on your personal data.

Wut?

 

[nutjob]

Wut?

"Apple plans to monetize its mobile payment system by integrating iAds with Apple Pay. This iAds portion of the loyalty system allegedly will use iBeacons and Bluetooth LE to push targeted ads with a "tap-to-buy" button to customers while they are visiting a participating merchant."

Read the next story on the front page, genius. Also Apple has sold advertising for years. HAve you been living under a rock?

 

[bbeagle]

No, it wasn't hacked, it was built with such mediocrity that it enabled the social engineering (which is also hacking, by the way) that caused the problem. Gives a person great confidence when handing over your financial information.

Or given that Apple has been caught thrice willfully breaking the law, maybe Apple won't let your financial information leak, they'll just do something illegal with it themselves.

Apple willfully broke the law by allowing people to use passwords to access their application, iCloud. Really? You have such a low tolerance for 'breaking the law'?

I guess practically every company with application sign-ins in the past 10 years has the same low tolerance and is breaking the law too?

 

[displaced]

Why is that? What is the difference between Apple Pay using NFC and credit card using NFC? Why do credit card with NFC works without internet connection but Apple pay need Internet connection? Isn't it the NFC terminal sends customer card info to bank?

As far as I understand it, Apple Pay does not need an internet connection.

Registering a card with Apple Pay (again, as I understand it) does the following:

• Creates a 'token' on the device, stored in the Secure Enclave
• The token is agreed between your phone and the bank. Effectively, this turns your phone into a credit/debit card 'proxy'
• The phone can use this token to generate 'one-time only' codes to be sent to NFC readers.
• The NFC reader sends this code (which looks like a set of normal card identifiers) to your bank during a purchase
• The bank then verifies this code against its copy or version of the original token to verify that the purchase came from you.
• This code cannot be converted back into the 'token' which signed it.
• The token cannot be converted back into anything personally identifiable or usable for purchases by any party other than your bank.
• The code that's sent to the NFC reader is secure. Even if the NFC reader were compromised and the code was recorded, it's a one-time code that cannot be reused for further purchases.

So, your phone does not store your bank details. Apple do not store the details. Your phone doesn't need to contact anything over the internet to make a purchase. It just uses its token to generate one-time-only cryptographically-secure codes to send to the NFC reader.

So, how's this better than the NFC-enabled debit cards that I used daily here in the UK? Well:

• My debit card isn't protected with my fingerprint
• My debit card is at the mercy of the NFC terminal as to what happens once the card's details are transmitted to the reader.
• My debit card won't keep a reviewable history of my purchases (mainly due to its lack of touchscreen
• I've had three broken debit cards in the past 2 years. I've never broken an iPhone
• I have three debit cards. I only need one phone.

As for how it's better than Google Wallet -- I have no idea. Never used Google Wallet. Do Google know what's been purchased in a personally-identifiable way? Would they know that foo@gmail.com just bought a box of doughnuts, and start inserting adverts for sugary treats into foo@gmail's search results or GMail ads? I don't know.

On the other hand, would Apple know that foo@icloud.com just bought doughnuts? I don't know. But the architecture of Apple Pay suggests that it's not required for the system to work.

So, assuming Apple do not keep purchase records, then Apple Pay maintains the status quo of only my bank (and possibly the card network -- Visa/MasterCard, Amex, etc) knowing what I'm buying. Same as it ever was.

 

[nutjob]

Apple willfully broke the law by allowing people to use passwords to access their application, iCloud. Really? You have such a low tolerance for 'breaking the law'?

I guess practically every company with application sign-ins in the past 10 years has the same low tolerance and is breaking the law too?

You seem to have problems with your reading and comprehension, or maybe you just like making up stuff about what people say.

Either way it speaks volumes about the lengths you'll go to try to defend Apple's behaviour.

 

[ct2k7]

As far as I understand it, Apple Pay does not need an internet connection.

Registering a card with Apple Pay (again, as I understand it) does the following:

• Creates a 'token' on the device, stored in the Secure Enclave
• The token is agreed between your phone and the bank. Effectively, this turns your phone into a credit/debit card 'proxy'
• The phone can use this token to generate 'one-time only' codes to be sent to NFC readers.
• The NFC reader sends this code (which looks like a set of normal card identifiers) to your bank during a purchase
• The bank then verifies this code against its copy or version of the original token to verify that the purchase came from you.
• This code cannot be converted back into the 'token' which signed it.
• The token cannot be converted back into anything personally identifiable or usable for purchases by any party other than your bank.
• The code that's sent to the NFC reader is secure. Even if the NFC reader were compromised and the code was recorded, it's a one-time code that cannot be reused for further purchases.

So, your phone does not store your bank details. Apple do not store the details. Your phone doesn't need to contact anything over the internet to make a purchase. It just uses its token to generate one-time-only cryptographically-secure codes to send to the NFC reader.

So, how's this better than the NFC-enabled debit cards that I used daily here in the UK? Well:

• My debit card isn't protected with my fingerprint
• My debit card is at the mercy of the NFC terminal as to what happens once the card's details are transmitted to the reader.
• My debit card won't keep a reviewable history of my purchases (mainly due to its lack of touchscreen
• I've had three broken debit cards in the past 2 years. I've never broken an iPhone
• I have three debit cards. I only need one phone.

As for how it's better than Google Wallet -- I have no idea. Never used Google Wallet. Do Google know what's been purchased in a personally-identifiable way? Would they know that foo@gmail.com just bought a box of doughnuts, and start inserting adverts for sugary treats into foo@gmail's search results or GMail ads? I don't know.

On the other hand, would Apple know that foo@icloud.com just bought doughnuts? I don't know. But the architecture of Apple Pay suggests that it's not required for the system to work.

So, assuming Apple do not keep purchase records, then Apple Pay maintains the status quo of only my bank (and possibly the card network -- Visa/MasterCard, Amex, etc) knowing what I'm buying. Same as it ever was.

I'm glad that my debit card knows that it has been used.

How do you go through many cards? No one I know has gone through that many.

 

[bbeagle]

I'm not sure what the significance of storing credit card numbers is. Most online stores do that.

Which is why credit card numbers get stolen. It's a bad idea!

I'm not sure what you want me to get over, but your attitude in saying that reveals that you get upset when someone criticizes Apple. Maybe you should talk to someone about that.

You should clearly get over your anti-Apple bias. When Apple does something stupid, I'll criticize them, no problem. They're not perfect, no company is.

But to jump Apple for doing something right? It clearly shows you have just bitter hatred for the company. Where does that come from?

 

[Menel]

Limiting this to US cards first is a terrible move by Apple. I understand that perhaps they need to make arrangements with banks for debit card support, but credit cards like VISA, MC, AMEX should be able to be used in any country.



I have a VISA issued in Canada, last time I checked VISA is an American company.



But sadly the reality is that Apple probably wants to profit from each transaction, hence the need for deals in each country.

Has nothing to do with that.

Those foreign banks, card issuers have to implement and recognize VISA Token System.

 

[ZCT]

Yes, certainly nothing to do with the enormous amounts of legislation and negotiating that has to be done for each country individually. Theres also no way they would want to make sure everything works in the US first before rolling out further and potentially having bigger problems.

Also we have to keep in mind that as far back as 2004 other countries are using a much more advanced Chip and PIN system, now some 84 countries have that.

In America we've been left behind with a card with a piece of VHS video cassette glued to it.

So in America we have a lot to gain by switching to NFC with Apple Pay, but other countries who already have a much more advanced and secure system may have a little less incentive to make big changes.

In 2007 when I was last in the UK, in restaurants they would bring a small machine to your table. You put your card in, enter a six digit PIN and the tip and you're done. No scraps of paper, much more secure.

 

[German-Guy]

Works fine in Germany, too ...

but for some strange reason I also had to set the language to "english" in addition to setting region to "US". Without the english language it would show me the add card dialog but would not accept my (US) credit card. Now it works fine.

 

[nutjob]

Which is why credit card numbers get stolen. It's a bad idea!



You should clearly get over your anti-Apple bias. When Apple does something stupid, I'll criticize them, no problem. They're not perfect, no company is.

But to jump Apple for doing something right? It clearly shows you have just bitter hatred for the company. Where does that come from?

Bias? Hatred? Try to keep up. I was responding to someone who was rushing into the arms of Apple to avoid Google and I pointed out they do the exact same thing. You then replied with something off-topic, but I played along and now you claim I have a bias and hate because I disagree with you? I've bought tens of thousands of dollars worth of Apple products, why would I do that if I felt that way?

I point out the facts, you pull up irrelevant non-facts in reaching to try to defend Apple. That's as plain as the day.

Apple does store credit card numbers. Have a look at your iTunes account, you can't even have one without giving them a credit card number which remains there.

Seriously, you are kind of the Apple apologists.

 

[Sheza]

I don't have any US credit cards. Very few people here have.

Your point being..?

 

[henryonapple]

Mine doesn't work yet. I have 3 other Chase cards that work with Apple Pay, but the Amazon one says it's not supported. I hope they change that soon, as that's the one I want as my default card.

Thanks for the answer, I was reading the official Apple Support Forums and it looks like Amazon didn't want to support Apple Pay. Just curious, but why is this your primary card? Do you use it for the 2% cashback at restaurants?

 

[RedOrchestra]

Have a look at your iTunes account, you can't even have one without giving them a credit card number which remains there.

Sure you can, I've never given them a CC number, I only use iTunes cards that I purchase at 15 - 20% off.

 

[dwsolberg]

Am I the only one that doesn't get this whole Apple Pay thing?

How is this different than existing NFC solutions that have been around for years?

It seems like we see articles for retailers supporting "Apple Pay", but then Apple Pay works with any NFC terminal?! Why do retailers need to support Apple Pay specifically instead of just using stabdard NFC? Is it possible for a retailer to support Apple Pay, but not other NFC solutions (such as Google Wallet)?

I understand Apple Pay introduces some security improvements over standard NFC, but it also seems like Apple Pay works with standard NFC terminals, and standard NFC devices will work where Apple Pay does...

This is different in at least five huge ways:

1. Partnerships. Apple has partnered with the major card issuers so many credit cards and debit cards are eligible. The previous biggest NFC push was Google Pay, which only worked by hooking into a special Google-enabled credit card service, which was FAR more cumbersome. In most consumer applications, ease of use trumps all else. I've already got three emails from Wells Fargo about how to use Apple Pay with my debit card.

2. Publicity. This has got far more publicity than other NFC pushes, and publicity changes human behavior by making them aware of opportunities. Anything Apple does good or bad gets far more publicity than it deserves, and assuming Apple handles this correctly, it will be a huge boost.

3. Timing. By this time next year, all card issuers will need to have more secure payment terminals or else they will be responsible for card fraud. This is a huge shift that requires merchants to upgrade their equipment, in turn making it more likely they will support NFC and therefore Apple Pay (because any NFC-enabled terminal will automatically support Apple Pay or Google Pay, etc).

4. Security. Apple Pay uses a one-time token for each transaction that cannot be reused. That means that even if someone intercepts your NFC token, it's useless because you've already paid with it. In addition, Apple doesn't track your purchases. Privacy is a smaller issue for most people, but it will help some people feel more comfortable. Combined, though, this allows most media outlets to describe Apple Pay as secure, which helps people feel comfortable.

5. Ease of Use. I just scanned by card into Apple Pay, it read the numbers, I entered my security code, and it just worked. I went to Whole Foods, held my phone by the credit card terminal, and within two seconds the screen asked me if I wanted to purchase with Apple Pay. I put my thumb on Touch ID and was done. Also, I can easily pay for merchandise in many iPhone apps using my thumb rather than tediously entering in credit card information.

A simple view is that Apple is just using technology that's been around for years, but that ignores the huge effect of partnerships, ease of use, and timing.

 

[nutjob]

Sure you can, I've never given them a CC number, I only use iTunes cards that I purchase at 15 - 20% off.

Ugh, not the point. The claim was that Apple doesn't store your CC number, but it does. Gift cards are just another financial instrument and the same difference.

 

[0970373]

If the Device Account Number is static, then its static... Wouldn't that be a weakness?

That device account number is specific to the device and can only be used when authenticated with your TouchID. If someone got hold of that Device #, they still could not use it. They physically need to have your phone and your fingerprint to use it. Not a weakness, a strength.

 

[displaced]

I'm glad that my debit card knows that it has been used.

How do you go through many cards? No one I know has gone through that many.

Barclays seem to have gone through a rough patch. My first chip and pin card lasted years. Subsequent ones have been hit and miss. Both the chip and mag stripe on my last card failed at the same time. Funnily enough this meant I could only pay with NFC for a few days whilst awaiting my new card.

I did ask Barclays what the deal was with the crappy cards and the bloke said they'd been replacing a helluva lot of cards recently. I've not mishandled them - they sit in my wallet alongside my Cooperative card whose chip has never failed. Odd!

 

[heisenberg123]

thanks to those that clarified my question I use to think Visa gave the bank kick backs to help distribute their cards to clients at those banks, kind of an easier way for Visa or MC to get in the publics pocket.

 

[please22]

So when Google does it it's bad, but when Apple does the exact same thing it's fantastic? I bet you love the fact that Apple dictates what you can and cannot do with an iPhone too.

WOw you don't get it fanboy? Google gets the info on the transaction. The place, how much, everything. Apple doesn't.

 

[acctman]

Limiting this to US cards first is a terrible move by Apple. I understand that perhaps they need to make arrangements with banks for debit card support, but credit cards like VISA, MC, AMEX should be able to be used in any country.

I have a VISA issued in Canada, last time I checked VISA is an American company.

But sadly the reality is that Apple probably wants to profit from each transaction, hence the need for deals in each country.

it's not terrible, there is a lot of regulations and approvals that must be meet before a business can introduce a new tech, device, or anything into a foreign country. Why sit around and wait for everyone to approve. A prime example is Apple selling the iPhone in China that took years of planning and even after it was okayed it still took months to get the licenses and retailers to move forward.

 

[street.cory]

And this is why I would not want to use Google Wallet even if I had an Android phone. I'm trying to cut Google's influence OUT of my life, not give them more access.

...Hopefully this doesn't turn out to be true... or maybe there will be a way to turn it off IF true.