Apple Rumored to Announce Apple Pay for Websites at WWDC

[Michael Goff]

PCI-compliant sites should not have any credit card info anyway. That's one of the requirements to become certified as a merchant with credit card processors.

I imagine the process will work with any browser, and be like this:

1. Customer clicks "Pay with Apple Pay" after entering identifying information.
2. A package describing the transaction is sent to the Apple Pay endpoint.
3. Apple's server sends a notification to all iOS devices associated with the user, presenting the Apple Pay interface on-screen.
4. The user authorizes.
5. The device sends an authorization package back to Apple's server.
6. The credit card is charged.
7. Apple's server then sends an "Authorized" message back to the website if the transaction was approved.

This is very similar to how existing credit card transactions happen, with the only exception of Steps #3-5 being an intermediate authorization step controlled by the user. The website itself still needs to have enough information about the user to identify them to Apple.

"Would you like me to save your credit card info to help with your next purchase?" happens.

 

[tmiw]

PCI-compliant sites should not have any credit card info anyway. That's one of the requirements to become certified as a merchant with credit card processors.

I imagine the process will work with any browser, and be like this:

1. Customer clicks "Pay with Apple Pay" after entering identifying information.
2. A package describing the transaction is sent to the Apple Pay endpoint.
3. Apple's server sends a notification to all iOS devices associated with the user, presenting the Apple Pay interface on-screen.
4. The user authorizes.
5. The device sends an authorization package back to Apple's server.
6. The credit card is charged.
7. Apple's server then sends an "Authorized" message back to the website if the transaction was approved.

This is very similar to how existing credit card transactions happen, with the only exception of Steps #3-5 being an intermediate authorization step controlled by the user. The website itself still needs to have enough information about the user to identify them to Apple.

You're actually allowed to store card data. If you do though, you end up having to undergo far stricter scrutiny to meet PCI requirements.

 

[Marvive]

So this will help shave a few seconds compared to using iCloud to auto-fill the credit card info. Meh.

Aside from that, you also have the aspect of security. Tokenization, encryption and anonymity are crucial for web purchasing.

 

[hlevolve]

I this would be a huge boost to apple pay because it would be much easier for retailers to implement (im assuming opposed to rolling out hardware to store locations) so i would suspect much higher adoption rates and im 100% for that!

 

[kdarling]

Being able to use Apple Pay on websites will help expand my online shopping quite a bit. Right now out of fear I pretty much only use Amazon.

When I want to hide my account info, I use PayPal.

Apple Pay will be good, too, for any website that takes it.

Aside from that, you also have the aspect of security. Tokenization, encryption and anonymity are crucial for web purchasing.

I'd say they're nice to have, but not crucial for most people.

Heck, I've been buying stuff online for decades, using real card info, and there's only been one time that I suspect my number might've gotten stolen that way. Even then, I lost nothing and the card was replaced overnight, so it was not a big deal.

 

[JosephAW]

I want to see apple pay between iPhone.

 

[WestonHarvey1]

I'm confused. Wasn't this announced with the original iPhone 6? Or am I thinking of something else? I thought there was another mode of Apple Pay that worked on websites and didn't use the NFC.

 

[brueck]

This is very big news! Think about it, it's a system that has the potential to remove credit card numbers from the internet! This would be a game changer for security, since much of the hacking and many phishing schemes revolve around getting credit card numbers.

 

[jonnysods]

Totally didn't get enough sleep last night and I'm up late again so I misread this.

I thought it said Apple were introducing websites that you have to pay to use. I got really mad until I read the comments

 

[EricTheHalfBee]

I'd say they're nice to have, but not crucial for most people.

Heck, I've been buying stuff online for decades, using real card info, and there's only been one time that I suspect my number might've gotten stolen that way. Even then, I lost nothing and the card was replaced overnight, so it was not a big deal.

Ridiculous.

- First off, credit card number theft online is a very real and serious problem that affects millions of people and costs billions of dollars a year in fraud. Who cares if you've been lucky enough to never have it happen to you?
- Second, it IS a big deal if your card gets stolen. I have numerous payments set to automatically charge my credit card. If I have to change my card, then I have to go back to all those places and re-enter my card information. I also have to go back to Apple, Amazon and other online retailers and change my payment information there as well. It's a hassle.
- Third, to say it doesn't matter if your card gets stolen and used since you won't have to pay is asinine. Why are you OK with criminals getting free money from your card just because you know you won't have to pay? That's some twisted logic. Plus you ARE paying for it. Fraud charges get passed on to consumers in higher interest rates and to merchants in fees. So you're paying for it somewhere.

Personally, I like the idea of using Apple Pay and giving a big middle finger to all those a$$hole crooks who commit credit card fraud.

 

[BvizioN]

Wow. Great news if I can get rid of Paypal.

PayPal have been great for me for the last 10 years or so I been using it. Not sure why so many do hate it. But yeah, Apple Pay is away more secure and simple, I just think it will take time to reach the popularity of PayPal.

 

[MLVC]

Cool. Will be happy to use this as soon as we get ApplePay in Holland in 2036

 

[kdarling]

- First off, credit card number theft online is a very real and serious problem that affects millions of people and costs billions of dollars a year in fraud. Who cares if you've been lucky enough to never have it happen to you?

I've had my account stolen multiple times. However, it did not stop me or others from continuing to buy online.

That's the reason I commented that I didn't think extra security was "crucial" for web purchasing.

But I see his and your point that it's very desirable going forward, and agree.

- Second, it IS a big deal if your card gets stolen. I have numerous payments set to automatically charge my credit card. If I have to change my card, then I have to go back to all those places and re-enter my card information. I also have to go back to Apple, Amazon and other online retailers and change my payment information there as well. It's a hassle.

Oh sure, if someone uses only one card for everything, it's definitely a hassle.

After the first few times that I had to do the same thing, I (and others here) got smarter. Now we use a different card for in-person purchases, online purchases, and automatic payments.

That way, any single card theft does not harm the others. Since then, even after multiple in-person account thefts (I think from diners and laundries), I've no longer had to redo the automatic payments.

- Third, to say it doesn't matter if your card gets stolen and used since you won't have to pay is asinine. Why are you OK with criminals getting free money from your card just because you know you won't have to pay? That's some twisted logic. Plus you ARE paying for it. Fraud charges get passed on to consumers in higher interest rates and to merchants in fees. So you're paying for it somewhere.

I didn't say that it didn't matter. I said it was not a big deal to me. See above card segregation.

At the same time, it's pretty naive to believe that issuers are going to reduce their fees because of their move to EMV and tokenization. Sure didn't happen anywhere, that I know of.

On the contrary, Visa, for example, pushed back at the idea of reduced fees, stating that fraud would simply shift elsewhere.

Personally, I like the idea of using Apple Pay and giving a big middle finger to all those a$$hole crooks who commit credit card fraud.

I totally agree. That's why I started using Google Wallet long ago, because it hid my real account from thieves, AND hid what I was buying from the banks (who use that info both to sell ads and to determine possible future credit problems).

So while others were worried about the Home Depot breach, I had no such problem, since I'd paid with Google Wallet. They simply switched me to a different virtual account number, same as can now be done with other tokenized systems such as Apple / Android / Samsung Pay.

 

[EricTheHalfBee]

I've had my account stolen multiple times. However, it did not stop me or others from continuing to buy online.

That's the reason I commented that I didn't think extra security was "crucial" for web purchasing.

But I see his and your point that it's very desirable going forward, and agree.

It doesn't stop people from purchasing online, but it certainly affects their habits. Which is one reason people stick to well-known sites like Amazon. Apple Pay for websites would give small operators the same security/reputation as major sites. Now if I see a niche product on a small independent site I know I can make a secure purchase if they accept Apple Pay. This will be very empowering to small shops.

Oh sure, if someone uses only one card for everything, it's definitely a hassle.

After the first few times that I had to do the same thing, I (and others here) got smarter. Now we use a different card for in-person purchases, online purchases, and automatic payments.

That way, any single card theft does not harm the others. Since then, even after multiple in-person account thefts (I think from diners and laundries), I've no longer had to redo the automatic payments.

I and others got smarter. You just couldn't resist the chance to get a dig in implying using a single card is stupid. You must be still upset at the smackdown you got over at AppleInsider.

You know why I use a single card? Because it allows me to maximize my rewards. I literally buy everything on one card (the one that gives me the highest rewards) and pay my balance in full every month. No interest charges and I rack up points like it's no tomorrow. Now with Apple Pay online I don't have to worry about buying something from that tiny little online store. So I get security AND can earn even more rewards.

What I find funny is you had to change your habits (keeping multiple cards and separating their purchases) to combat fraud, yet you seem to think that this is an acceptable method to deal with possible fraud. In essence, the criminals have forced you into doing more work to minimize the impact those same criminals might have on you.

I didn't say that it didn't matter. I said it was not a big deal to me. See above card segregation.

At the same time, it's pretty naive to believe that issuers are going to reduce their fees because of their move to EMV and tokenization. Sure didn't happen anywhere, that I know of.

On the contrary, Visa, for example, pushed back at the idea of reduced fees, stating that fraud would simply shift elsewhere.

It won't happen overnight, but it will happen. It will probably take several years before an impact is made to fraud. VISA, for example, is a publicly traded company. Their earnings reports are available for anyone to see. When actual fraud numbers go down they won't be able to keep their fees and interest rates up. Competition will force them to offer better rates (or rewards).

I totally agree. That's why I started using Google Wallet long ago, because it hid my real account from thieves, AND hid what I was buying from the banks (who use that info both to sell ads and to determine possible future credit problems).

So while others were worried about the Home Depot breach, I had no such problem, since I'd paid with Google Wallet. They simply switched me to a different virtual account number, same as can now be done with other tokenized systems such as Apple / Android / Samsung Pay.

Except Google Wallet was/is a kludge system. I mentioned rewards points above. This is the biggest (and very well documented) problem with Google Wallet - that rewards points usually don't work. So you get the extra security, but lose out on the rewards. Terrible trade off to make. With Apple Pay I get the security AND the rewards.

 

[kdarling]

You know why I use a single card? Because it allows me to maximize my rewards. I literally buy everything on one card (the one that gives me the highest rewards) and pay my balance in full every month. No interest charges and I rack up points like it's no tomorrow.

Yep, that's what I do, except I have multiple of the same reward cards that are tied together. This gives me different account numbers that reap the rewards to one place, but keeps them independent in case one gets compromised.

Now with Apple Pay online I don't have to worry about buying something from that tiny little online store. So I get security AND can earn even more rewards.

Sure, if every site we use will support it, we won't have to worry.

However, we're still susceptible to the weakest link in the chain. E.g. using Apple Pay to hide our true account number will not matter a bit, if we ever use the real account card just once somewhere and the account number is stolen. Then we still have the inconvenience of getting a new card and registering it everywhere.

What I find funny is you had to change your habits (keeping multiple cards and separating their purchases) to combat fraud, yet you seem to think that this is an acceptable method to deal with possible fraud. In essence, the criminals have forced you into doing more work to minimize the impact those same criminals might have on you.

We live in the now, not in the future. We can only pick and choose techniques that are currently available at the places where we make purchases.

 

[American Hero]

VISA, for example, is a publicly traded company. Their earnings reports are available for anyone to see. When actual fraud numbers go down they won't be able to keep their fees and interest rates up. Competition will force them to offer better rates (or rewards).

Visa & MasterCard need to have their own cards instead of solely ones with bank partnerships.

I understand there used to be a Visa "Black Card" and also a MasterCard "Black Card," but the average consumer doesn't own one of those.

Without the banks being the "middle-man", Visa & MasterCard would be able to handle disputes better, lower rates, and increase rewards.

 

[rtms77]

I like the idea but probably won't see this until 5 yrs later in Canada. Between all the red tape and trade rules etc Canada pulls, I would be very surprised if it was supported at announcement time. Unless all the recent haggling over Apple Pay included websites and person to person deals. Here's hoping they included this.

 

[Gymgenius]

I want to see apple pay between iPhone.

Me too. This will be great when you owe someone a couple of £ and want to pay them back quickly and easily.