Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Apple Announces 'Apple Pay' Mobile Payment Solution, Enabled at Over 220,000 U.S. Merchants
- Thread starter MacRumors
- Start date
- Sort by reaction score
Yes, Apple Pay seems to be using patents granted earlier this year. (Not over iBeacon, of course. Just NFC.)
What Apple Pay sends is a device number + a unique CVV code.
According to the patent, Apple stores the device dependent token (alias) in the Secure Element on the NFC chip in each phone. That same token (alias) is also transferred one time behind firewalls (perhaps even manually) to the cloud entity who will one day de-token it.
See below for who the cloud entity is.
You are right. The missing link was revealed today: Apple partnered with First Data, and they're the ones doing the device token / alias translation into the real card number.
(Or, at least, authenticating the alias and sending it on to the card providers, perhaps.)
If Apple's solution is indeed device dependent, then an advantage of Google Wallet is that you can log in and use it from any Android (and probably iOS) device.... since the virtual card info is downloaded from a cloud SE, not built locally from a device dependent number.
A question then is: how do you get the Apple Pay info from one device to another you own or will own? The whole point of using the Secure Element is that the info inside is NEVER readable by the Application Processor, and thus could not be backed up anywhere.
Which is NOT tokenisation. Read this to understand: http://www.emvco.com/specifications.aspx?id=263
Tokenisation is sending a unique PAN each time that can be de-tokenised for certain environments such as mass transit. Tokenisation isn't quite fully baked, and I'd have been shocked if Apple was doing it.
A virtual card number provided by First Data makes FAR more sense. Same thing as Google Wallet. The only difference is Apple is only supporting partner banks so that they don't lose money on each transaction AND they're storing the virtual card in a secure element instead of on the cloud and presenting it with Host Card Emulation. Not a really substantial difference.
One interesting thing will be if the Apple Pay environment can be processed in full EMV mode instead of contactless MSD. We won't know this until someone has read and presented us with the 2PAY.SYS.DDF01 environment so we can see what it supports.
I'm surprised that they didn't also introduce an Apple smart terminal that could handle Apple Pay, regular credit cards, credit cards with chips and other NFC payment technology. There's a huge market for these things.
Small businesses have a wide variety of terminals, most of them rather primitive. An Apple terminal would help smaller businesses accept Apple Pay and get the technology into a larger base.
Might be a uphill battle getting the small businesses of the world into this ecosystem.
Small businesses have a wide variety of terminals, most of them rather primitive. An Apple terminal would help smaller businesses accept Apple Pay and get the technology into a larger base.
Might be a uphill battle getting the small businesses of the world into this ecosystem.
I'm in the same boat. There customer service is horrible along with their response time.
I think Apple is using the term in its broader meaning of a substitute for the actual credit card number.
The original Apple idea was that there was no virtual number. The device itself (that is, the code in the SE) creates a cryptogram from its embedded NFC chip number and one-time CVV, and sends that to First Data.
First Data would already have the shared device number (a list provided by Apple) and uses it to decode the request and authenticate it. Then either they send a stored credit card to the bank, or the decoded request and the bank matches it up.
However, I've read that Apple tried to get credit card companies to pay for being compatible with this scheme, and they refused to operate under an Apple patent. (Note the date on that source, btw. This guy knew about Apple's plans months ago. Also read his About page. Amazing.)
Thanks! that doesn't take away from the fact that this isn't revolutionary. Most, if not all of the merchants on the list have already had NFC terminals in place, it isn't like they all just added it because apple "came up with" this technology and asked them to install the hardware to accept it.
Wrong, they ARE using tokenization.
http://en.wikipedia.org/wiki/Tokenization_(data_security)
You see no difference between a virtual card stored locally on the device in a secure element, vs one stored in the cloud? You see no difference between Apple does NOT have access to your payment info vs. Google DOES?
I'm assuming you're referring to Google Wallet? I've been using it myself too, but even after a number of years it has failed to gain any stronghold.
That's the true big deal with Apple coming into the fray. Just like the tablet space which was practically dead before the iPad, Apple Pay is going to be a major contributor to pushing digital payments as a viable, widely used alternative to plastic cards.
"Innovation" doesn't come from who's first, it's who does it best. And Apple is undoubtedly one of the best at pushing standards to a mainstream level. That will be important for any tech advancement.
I agree 100%. Not bashing but just because Apple has jumped on board now it will take off. Not so much because Apple built a better way to use it but because more merchants will jump on board to install the hardware to accept it because, well, Apple is doing it now. Which IS good for all bc it pushes innovation throughout the whole payment system.
Did you read the EMVco specs I sent you? Obviously not. The rotating CVV (contactless MSD)/transaction ID (EMV) is NOT considered tokenisation in payments. The virtual PAN used by Apple appears to be static. It's the SAME EXACT THING as Google Wallet from what I can tell so far.
There is no difference security-wise between Apple and Google's implementations. The advantage to Apple's is that it'll all function with data not available. Google's requires data but has the benefit of all your history being available in the cloud and across Google services. That also has market research and data collection benefits for Google.
You're 100% right that all of those countries (and the majority of Europe) are eons ahead of the U.S. in their adoption of chip + PIN payment systems.
But that's also one of the reasons why Apple is likely doing something smart: the U.S. payment industry is a shambles, merchants seem to have huge issues with compliance, and nary a day seems to go buy with "such-and-such retailer hacked".
Given the very impressive list of retailers this will work with, the reported 220,000 places you can use this when it arrives....I think Apple had some very candid conversations with retailers and told them "we can fix some of this for you and it won't cost you a penny". The fact they've basically been able to undercut many of the banks (not card issuers) on merchant terms is quite brilliant.
To launch and underwrite a new payment processing system, you need huge scale. You also need reasonably liquid capital available. Hmmmm.....who do we know with $100bn sitting around?
Can an iPhone 6/6+ Accept Payments over NFC as well?
Would it be possible for an iPhone 6 to serve as a terminal to accept payments (thus replacing Square, etc)?
I'm surprised this wasn't mentioned but know nothing about NFC and whether it can be a bidirectional signal.
Would it be possible for an iPhone 6 to serve as a terminal to accept payments (thus replacing Square, etc)?
I'm surprised this wasn't mentioned but know nothing about NFC and whether it can be a bidirectional signal.
NO it isn't. In any way. It's a virtual card NFC payment environment. Not materially different from Google Wallet or Isis/SoftCard in any way.
And no one has mentioned that it seems like the ONLY darn thing allowed in software for the new iPhone's NFC chip. What a joke. Can't even tap to share contacts from what I can tell.
His post was more intelligent than yours. And a whole lot more courteous. Sorry to break the news, fellah, but your posts don't exactly make you shine. Maybe you could do better,
if you worked at it? I'm sure you could, with effort and practice! Now, you have a nice day.
----------
I'll tell you what. Let's meet back here September 9, 2015, and see whether this system has caught on by then or not; and if so, we can discuss why.
His post was more intelligent than yours. And a whole lot more courteous. Sorry to break the news, fellah, but your posts don't exactly make you shine. Maybe you could do better,
Now, you have a nice day.
----------
I'll tell you what. Let's meet back here September 9, 2015, and see whether this system has caught on by then or not; and if so, we can discuss why.
That doesn't explain how it is more than NFC. I don't doubt that it will catch on more now that Apple is backing it too but Androids version vs Apples is "basically" the same concept with slightly different implementation. Still basically NFC.
It isn't different, LOL, you're right. BUT, I think Apple's use of it will cause it to catch on.
His post was more intelligent than yours. And a whole lot more courteous. Sorry to break the news, fellah, but your posts don't exactly make you shine. Maybe you could do better,
Now, you have a nice day.
Why would I care what you think?
Eesh. This is all a semantic argument.
An hour ago I would have said, "Apple using tokenization is cool!" While I now understand that this would be technically incorrect, what I really meant was, "Apple not sending around my actual card number is cool!"
I won't call it tokenization, but even after reading these "definitions," they all generally fit the concept the word instills in me. I think most who find this concept cool don't care what the EMVco specs are. Finding out that what Apple is doing isn't actually "tokenization" does not change how cool I think it is.
And, of course, I did know that this general technology was in existence. But I agree with those saying ApplePay goes beyond NFC. This isn't magic or poetic license; ApplePay is an ecosystem that has technological, business, and economic aspects. The implementation of the system will incorporate advertising, logistics, and public image. Apple could still very well fail, but by the end of this week more of the general public will know that ApplePay exists than Google Wallet. This has nothing to do with the technology itself, but everything to do with the brand, which, like it or not, is something Apple cultivates as a strategic part of its business.
It's not cheating, and it's not not putting out a solid product. ApplePay, as an overall concept, just happens to be more than its technological infrastructure. Apple spends our money creating, making, advertising, and distributing, and this is all inexorably part of the company's product. Because the company's overall product is the brand.
Everyone trying to argue that Google Wallet is just as good and was here first sounds like the "nice guy" who complains that all the jerks get the girls. Sure, the jerks are loud and crass and the nice guys might be the better choice, but a girl can only go with a guy she notices, and if the nice guy is sitting in the corner while the jerk is being loud...
And, yes, Apple is a jerk. All corporations are jerks. Apple is just the king of pick-up lines.
An hour ago I would have said, "Apple using tokenization is cool!" While I now understand that this would be technically incorrect, what I really meant was, "Apple not sending around my actual card number is cool!"
I won't call it tokenization, but even after reading these "definitions," they all generally fit the concept the word instills in me. I think most who find this concept cool don't care what the EMVco specs are. Finding out that what Apple is doing isn't actually "tokenization" does not change how cool I think it is.
And, of course, I did know that this general technology was in existence. But I agree with those saying ApplePay goes beyond NFC. This isn't magic or poetic license; ApplePay is an ecosystem that has technological, business, and economic aspects. The implementation of the system will incorporate advertising, logistics, and public image. Apple could still very well fail, but by the end of this week more of the general public will know that ApplePay exists than Google Wallet. This has nothing to do with the technology itself, but everything to do with the brand, which, like it or not, is something Apple cultivates as a strategic part of its business.
It's not cheating, and it's not not putting out a solid product. ApplePay, as an overall concept, just happens to be more than its technological infrastructure. Apple spends our money creating, making, advertising, and distributing, and this is all inexorably part of the company's product. Because the company's overall product is the brand.
Everyone trying to argue that Google Wallet is just as good and was here first sounds like the "nice guy" who complains that all the jerks get the girls. Sure, the jerks are loud and crass and the nice guys might be the better choice, but a girl can only go with a guy she notices, and if the nice guy is sitting in the corner while the jerk is being loud...
And, yes, Apple is a jerk. All corporations are jerks. Apple is just the king of pick-up lines.
I read through this but missed the core facts that show they are not basically the same (Google Wallet, ISIS/Soft Card or ApplePay). The funny thing is, I believe, that most iPhone users use them because they are cool and simple (which many of my iPhone friends have told me directly) and by your statement, the ppl that find it cool don't won't really care about the intricate details of how it's transmitted which raises the question again, how is it more than NFC?