CVS Stores Reportedly Disabling NFC to Shut Down Apple Pay and Google Wallet

[ZCT]

In all reality you'll be fine in the UK, and worried about nothing. I went there with mag stripe only cards, and I had no trouble at all.

I'm not in the least bit 'worried' about going to the UK.

What I am telling you is that when I was last there in 2007, when visiting restaurants or smaller shops outside of the main tourist areas such as London, people would look at my magnetic strip Visa card like I was showing them an 8 track.

They had already been on board with chip and PIN for three years at the time. Checks (or Cheques) were all but gone.

So at this point using a non-chip card seven years later will be harder in certain areas of the country.

----------

We're going to leapfrog contact chip cards except as a fallback. Recent breaches have thoroughly discredited the swipe to the point where customers prefer security almost all else. Apple came out with the right product at the right time and it's already bringing up the rest of the industry: AMEX brought back contactless chip cards recently and Google Wallet's finally gotten some good promotion. In a couple of years most people won't even be dipping the chip--they'll tap the card or phone.

That's a nice spin to put on it.

But yes, let's hope Apple can provide some urgently needed improvements in this area for sure.

What concerns me, is by the same logic that we got stuck with our antiquated magnetic strip technology, we now have evil corporations banding together to try and kill each others payment methods.

We have the Walmart consortium conspiring to shut down Apple Pay in stores like CVS and RiteAid even though they already have the equipment and capability of accepting the system.

And they are trying to offer this BS system of photographing QR codes.

Just remember, we're still using the Imperial system here in America, despite literally acts of Congress to have us move forward to Metric. While the rest of the world enjoys a much easier system of measurements that is also the same as what the scientific community uses.

So who's to say that Walmart will not successfully kill Apple Pay and leave us with that debacle they are working on, which no one else in the world will accept.

I do hope such a scenario never plays out and that Apple pay and other similar non-Apple NFC methods win out. Because I think Apple pay is awesome. I've used it at Walgreens a bunch and love it.

----------

Also side note, if you have your cards in Apple Pay, it works internationally with US cards. Use that to save some trouble.

I have four cards loaded up on Apple Pay, and definitely will be on the look out to try it abroad!

 

[viewfly]

I'm not in the least bit 'worried' about going to the UK.



What I am telling you is that when I was last there in 2007, when visiting restaurants or smaller shops outside of the main tourist areas such as London, people would look at my magnetic strip Visa card like I was showing them an 8 track.



They had already been on board with chip and PIN for three years at the time. Checks (or Cheques) were all but gone.



So at this point using a non-chip card seven years later will be harder in certain areas of the country.

----------





That's a nice spin to put on it.



But yes, let's hope Apple can provide some urgently needed improvements in this area for sure.



What concerns me, is by the same logic that we got stuck with our antiquated magnetic strip technology, we now have evil corporations banding together to try and kill each others payment methods.



We have the Walmart consortium conspiring to shut down Apple Pay in stores like CVS and RiteAid even though they already have the equipment and capability of accepting the system.



And they are trying to offer this BS system of photographing QR codes.



Just remember, we're still using the Imperial system here in America, despite literally acts of Congress to have us move forward to Metric. While the rest of the world enjoys a much easier system of measurements that is also the same as what the scientific community uses.



So who's to say that Walmart will not successfully kill Apple Pay and leave us with that debacle they are working on, which no one else in the world will accept.



I do hope such a scenario never plays out and that Apple pay and other similar non-Apple NFC methods win out. Because I think Apple pay is awesome. I've used it at Walgreens a bunch and love it.

----------





I have four cards loaded up on Apple Pay, and definitely will be on the look out to try it abroad!

Be a bit worried. Only a few Underground stations in London will process a mag stripe to load up a card and you have to stand in line.

I wished to purchase a 500 pound item with AMEX OR VISA. No good. The jewelry shop was informed 2 weeks ago not to take mag stripe anymore . Had to run to a bank for cash. That was 2012. No problems before then. I called Amex to complain and they were aware and working on bringing back pin cards

 

[tmiw]

Be a bit worried. Only a few Underground stations in London will process a mag stripe to load up a card and you have to stand in line.

I wished to purchase a 500 pound item with AMEX OR VISA. No good. The jewelry shop was informed 2 weeks ago not to take mag stripe anymore . Had to run to a bank for cash. That was 2012. No problems before then. I called Amex to complain and they were aware and working on bringing back pin cards

Get a contactless AMEX (or use Apple Pay) and it will solve your mass transit problems.

http://www.tfl.gov.uk/fares-and-payments/contactless/how-to-use-it
http://community.americanexpress.com/thread/5503

That's a nice spin to put on it.

But yes, let's hope Apple can provide some urgently needed improvements in this area for sure.

What concerns me, is by the same logic that we got stuck with our antiquated magnetic strip technology, we now have evil corporations banding together to try and kill each others payment methods.

We have the Walmart consortium conspiring to shut down Apple Pay in stores like CVS and RiteAid even though they already have the equipment and capability of accepting the system.

And they are trying to offer this BS system of photographing QR codes.

Just remember, we're still using the Imperial system here in America, despite literally acts of Congress to have us move forward to Metric. While the rest of the world enjoys a much easier system of measurements that is also the same as what the scientific community uses.

So who's to say that Walmart will not successfully kill Apple Pay and leave us with that debacle they are working on, which no one else in the world will accept.

I do hope such a scenario never plays out and that Apple pay and other similar non-Apple NFC methods win out. Because I think Apple pay is awesome. I've used it at Walgreens a bunch and love it.

CurrentC is pretty much dead on arrival but they have to look like they're making an effort. It'll launch, but the vast majority of MCX members will quietly turn NFC on once their exclusivity agreement runs out. Walmart and Best Buy will probably be the only holdouts since MCX was their idea and all.

 

[laurim]

In all honesty the vast majority of cards issued in America that have a chip are Chip and Signature not Chip and PIN.

A true Chip and PIN has a six digit PIN, and is the type of card you can easily use all over the world. A Chip and Signature card has far less utility abroad, and is about useless on automated machines like you might see in a subway station or train station for example.

In any case, as a lover of technology and travel, I wish America would keep up with the rest of the world. Perhaps even start using the metric system like everyone else!

Yeah. I was all excited when BofA offered a travel card with a chip and I thought it would allow me to buy train tickets at a machine in Europe. The previous time I had been to Europe, I ran into a few subway stations where if I didn't have coin euros I was screwed and couldn't buy a ticket. Unfortunately, I took the new chip card to Europe and found out it wasn't a true chip and PIN so I still couldn't use it in a ticket machine that required a PIN to complete the transaction. Very disappointing. The chip did make using the card easier in a restaurant. When are we going to get REAL chip and pin cards????

Last month, I went to Berlin and the day before I left the states I got a call from BofA saying someone had tried to use my chipped card number to withdraw $10,000 at a hotel in Paris (the rep said it was a keyed in transaction, maybe online, because I had the actual card). So, they cancelled my card then and there the day before my trip. I had to take my regular credit card and was able to use it at restaurants and stores EXCEPT the Torture Dungeon exhibit of all places, lol.

 

[AllieNeko]

Yeah. I was all excited when BofA offered a travel card with a chip and I thought it would allow me to buy train tickets at a machine in Europe. The previous time I had been to Europe, I ran into a few subway stations where if I didn't have coin euros I was screwed and couldn't buy a ticket. Unfortunately, I took the new chip card to Europe and found out it wasn't a true chip and PIN so I still couldn't use it in a ticket machine that required a PIN to complete the transaction. Very disappointing. The chip did make using the card easier in a restaurant. When are we going to get REAL chip and pin cards????

Last month, I went to Berlin and the day before I left the states I got a call from BofA saying someone had tried to use my chipped card number to withdraw $10,000 at a hotel in Paris (the rep said it was a keyed in transaction, maybe online, because I had the actual card). So, they cancelled my card then and there the day before my trip. I had to take my regular credit card and was able to use it at restaurants and stores EXCEPT the Torture Dungeon exhibit of all places, lol.

Chip and PIN may or may not ever happen in the US. With the Bank of America, ask for a cash advance PIN. They may warn you there will be charges for using it, but I assure you that's nonsense unless you actually use it to withdraw cash. Purchases are still coded as purchases no matter what.

Most US Visa cards do NOT allow on the card the use of the cash advance PIN for purchases, but B of A ones do (the others just never ask, you still don't get charged any fee).

Note, however, this PIN only works in online terminals, so ticket machines that aren't online still will fail. Also, you can't change the priority to prefer PIN, so you will still need to deal with the hassles of signature in shops.

 

[BobVB]

Without Bill Gate's money Steve Jobs would not have been able to turn things around for Apple. The summer of '97 Apple's stock price was in the toilet and Apple was expected to exist for 6 more months. MS pulled Apple from the edge.

And we all remember the rumors that MS got caught with their hand in the QuickTime cookie jar and this bit of cash and the promise to 'share' media technologies was based on this. An official end to the platform wars, a bit of cash, access to the MS tech in exchange for the tech they had already 'shared'.

Jobs was a genius.

 

[laurim]

Chip and PIN may or may not ever happen in the US. With the Bank of America, ask for a cash advance PIN. They may warn you there will be charges for using it, but I assure you that's nonsense unless you actually use it to withdraw cash. Purchases are still coded as purchases no matter what.

Most US Visa cards do NOT allow on the card the use of the cash advance PIN for purchases, but B of A ones do (the others just never ask, you still don't get charged any fee).

Note, however, this PIN only works in online terminals, so ticket machines that aren't online still will fail. Also, you can't change the priority to prefer PIN, so you will still need to deal with the hassles of signature in shops.

I have a cash advance PIN but that doesn't work in the machines in Europe when the card expects charges to be authorized with a signature so it's of no use to me. I SPECIFICALLY wanted a card that can be used in machines so I could use the subways and not stand in long lines to buy train tickets.

 

[AllieNeko]

I have a cash advance PIN but that doesn't work in the machines in Europe when the card expects charges to be authorized with a signature so it's of no use to me. I SPECIFICALLY wanted a card that can be used in machines so I could use the subways and not stand in long lines to buy train tickets.

You have a Bank of America with a cash advance PIN? That is allowed in those kiosks per the CVM list and reports.

Most likely what's wrong is that the kiosk is not online. The Bank of America CVM list is:

1. Online PIN for unattended cash (ATMs)
2. Signature for everything
3. Online PIN for everything
4. No CVM for everything

So, if a terminal doesn't support signature, the card will then allow online PIN (using your cash advance PIN) and then no CVM (no verification).

How this plays out with each terminal varies, but the most common situation, especially in France and Belgium is that the kiosk only supports OFFLINE PIN (PIN verified by the card, not the network). Barclay's offers a card with offline PIN in the CVM list. It's very low down but it'll function in these.

Another issue is ATTENDED kiosks, which do support signature - but which require an attendant to verify it, making it a huge PITA.

A final issue is to remember that in the Netherlands and Germany, credit card acceptance is very poor. Just because there's a card slot doesn't mean they accept Visa/Mastercard/American Express...

 

[Boomish69]

How is refusing to accept NFC payments monopolizing? Or are you saying they are trying to monopolize cash and card payments

eh? the news is that they won't accept any other form of electronic payment system but their own, that to me is a monopoly is it not?

like saying nothing but Visa cards cos they hold shares in that company.

 

[Jibbajabba]

You have a Bank of America with a cash advance PIN? That is allowed in those kiosks per the CVM list and reports.

Most likely what's wrong is that the kiosk is not online. The Bank of America CVM list is:

1. Online PIN for unattended cash (ATMs)
2. Signature for everything
3. Online PIN for everything
4. No CVM for everything

So, if a terminal doesn't support signature, the card will then allow online PIN (using your cash advance PIN) and then no CVM (no verification).

How this plays out with each terminal varies, but the most common situation, especially in France and Belgium is that the kiosk only supports OFFLINE PIN (PIN verified by the card, not the network). Barclay's offers a card with offline PIN in the CVM list. It's very low down but it'll function in these.

Another issue is ATTENDED kiosks, which do support signature - but which require an attendant to verify it, making it a huge PITA.

A final issue is to remember that in the Netherlands and Germany, credit card acceptance is very poor. Just because there's a card slot doesn't mean they accept Visa/Mastercard/American Express...

I am from Germany and I do indeed remember a time where cards were just for ATM. In fact, the old debit card - the Scheckkarte (check card) was merely a signature verification card for paper checks and only used in your branches ATM. It got a lot better though. Most chip terminals though need a specific chip. The chips on the card in Germany can be pre loaded with cash. This function does not exist in the UK. So for me as a contractor I am screwed. Only got a UK card but a lot of companies in Germany require that debit chip for payments in their internals cafés. Etc.

 

[AllieNeko]

I am from Germany and I do indeed remember a time where cards were just for ATM. In fact, the old debit card - the Scheckkarte (check card) was merely a signature verification card for paper checks and only used in your branches ATM. It got a lot better though. Most chip terminals though need a specific chip. The chips on the card in Germany can be pre loaded with cash. This function does not exist in the UK. So for me as a contractor I am screwed. Only got a UK card but a lot of companies in Germany require that debit chip for payments in their internals cafés. Etc.

You're conflating a few different things - networks and capabilities. GeldKarte, the stored value card network in Germany just doesn't exist outside of Germany. Even if there was a common stored value card network in the UK (there isn't, but there was with Mondex...), your German stored value card wouldn't work in the UK.

It's not about having a specific chip - the chips are international ISO standard. It's about the network and applications on the chip. Stored value cards are ancient tech, and have major downsides in case of lost/stolen. The fact that Germany still uses them is something I find bizarre. German is a very modern country, so it seems quite silly to me looking as an outsider.

 

[dontwalkhand]

Chip and PIN may or may not ever happen in the US. With the Bank of America, ask for a cash advance PIN. They may warn you there will be charges for using it, but I assure you that's nonsense unless you actually use it to withdraw cash. Purchases are still coded as purchases no matter what.

Most US Visa cards do NOT allow on the card the use of the cash advance PIN for purchases, but B of A ones do (the others just never ask, you still don't get charged any fee).

Note, however, this PIN only works in online terminals, so ticket machines that aren't online still will fail. Also, you can't change the priority to prefer PIN, so you will still need to deal with the hassles of signature in shops.

Not having online machines is a fail in my book. They still process transactions offline, so someone has to come out and manually collect the card information? I see many issues with this.

-what's to stop someone from breaking into the machine and now not only make some cash, but a stash of credit card numbers too?
-Your account does not reflect right away. So at this point might as well use a knucklebuster!

 

[AllieNeko]

Not having online machines is a fail in my book. They still process transactions offline, so someone has to come out and manually collect the card information? I see many issues with this.

-what's to stop someone from breaking into the machine and now not only make some cash, but a stash of credit card numbers too?
-Your account does not reflect right away. So at this point might as well use a knucklebuster!

Well, for one, some older machines may run transactions online but not know how to verify a PIN online. That's not at all an unheard of situation in Europe.

Two, stealing card numbers is useless. The transaction data obtained wouldn't be usable.

 

[tafan]

I'm not sure how to respond to that. Sigh...

Because , he is right.

 

[rdlink]

Because , he is right.

No, because he wasn't right. Only in the sense that he accomplished what he appeared to set out to do. Which was try to switch and bait on his argument. Every time I told him where his accusations didn't apply he changed the argument.

 

[AllieNeko]

What I want to know is where all the Apple fans who, a year ago, were talking about how NFC was pointless and QR codes were the future. LOL.

I'm typing on a Mac. I have an Android and an iPhone sitting beside me. I'm as platform-agnostic as they come. I've known for a long time that NFC was the best way to pay, and I'm glad Apple finally realised that. What I want to know, is why the Apple fanatics who hated it don't still hate it. Same with bigger screens.

Take this is a lesson... Apple isn't a religion, don't treat it as such. Their products have disadvantages. Lack of NFC payments and lack of a reasonable screen size were two of those. Apple fixed these (and brought a ton more energy to NFC payments in the process). That said, I think the iPhone Plus/Galaxy Note/etc screens are ridiculous. How, exactly, does someone type on those one handed?

 

[MasonDoc]

That's exactly right. I have the 5s, but will be moving to the 6 VERY SOON just because of apple pay. I have had two credit cards replaced twice this year (so that's 4 cards), due to hacking at home depot and target and then once because my wallet was stolen. This is a non-issue with Apple Pay and can't wait to have it available. These companies are also shutting down Google Wallet as well. Let's see what happens when Google starts to exclude CVS from search results.... because you can bet they will. There's won't be anyone coming in the door to use their mobile app.

Just out of curiosity, does anyone know what technology their app uses? If they are shutting down NFC, then what's the communication protocol to make a payment?

----------




Well, no-one every used google wallet, so it was a non-threat.

It uses QR codes and is cloud based. They also want to jack this setup directly to your bank account and want your drives license and SSN number/ Gov't ID number for those in and out of the U.S. however. Oh did I mention it's already been hacked once ? Yes MCX is saying only emails of the beta testers was compromised. I think it was more though. Folks fact is Apple Pay Google Wallet ect. Are all much more secure than using 2005's tech.

 

[JoeTomasone]

What I want to know is where all the Apple fans who, a year ago, were talking about how NFC was pointless and QR codes were the future. LOL.

When most people were saying that NFC was pointless for Apple was when Samsung was pitching it as Airdrop or Bump - for file sharing.

Apple was probably looking at payments for quite some time, but didn't jump until the timing was right (which I interpret as "when almost every retailer in the US needs to upgrade their terminals to accommodate EMV and can bolt on NFC for little or no additional cost and when the public would have a raison d'être to use it"). They surely didn't want to suffer the sins of mediocrity suffered by Google Wallet and, well, every other mobile wallet before it. The timing was indeed right, with both the terminal upgrades coming and the major retailer breaches fresh in people's minds.

Besides Wallet, Android's use of NFC has been limited to file transfers and pseudo-useless action-enabling buttons - both of which are more gimmicky than actually useful. What percentage of Android users, would you suppose, actually use those features on a regular basis? I'd wager that it's small.

I'm typing on a Mac. I have an Android and an iPhone sitting beside me. I'm as platform-agnostic as they come. I've known for a long time that NFC was the best way to pay, and I'm glad Apple finally realised that.

NFC isn't the "best way to pay"; tokenization is. NFC is just the mechanism to transport the token, and, coincidentally, happens to be the way that both is included in terminals and that can be embedded in phones. Again, I don't think that Apple finally "realized" it as much as waited for the right time to introduce it.

What I want to know, is why the Apple fanatics who hated it don't still hate it. Same with bigger screens.

I can't speak to the bigger screens... I couldn't deal with a 6 Plus or a Note. The 6 is about the largest I can ever see myself using as a phone.

Take this is a lesson... Apple isn't a religion, don't treat it as such. Their products have disadvantages.

As do all products in pretty much every category.

I'm platform-agnostic as well. I'm typing this on a PC desktop, my MacBook Air is in my bag ready to head out on a trip later this week along with my iPad and my iPhone. My servers? All Linux. Best tool for the job and what-not.

That said, I think the iPhone Plus/Galaxy Note/etc screens are ridiculous. How, exactly, does someone type on those one handed?

Really big hands, presumably. I played with a 6 Plus at the Apple Store for a half-hour and just couldn't fathom it with my hands and with the way I use my phone. But hey, everyone's different. Some people never need to use it one-handed and like the larger screen. <shrug>

 

[AllieNeko]

NFC isn't the "best way to pay"; tokenization is. NFC is just the mechanism to transport the token, and, coincidentally, happens to be the way that both is included in terminals and that can be embedded in phones. Again, I don't think that Apple finally "realized" it as much as waited for the right time to introduce it.

Frankly, tokenisation doesn't matter much to me. Tokenisation isn't required to prevent the most common fraud methods (counterfeit card fraud, most Internet card not present fraud). A normal contactless card without tokenisation still does not provide the data needed to clone the card or to use it in most Internet transactions (the exception being the rare transaction that only requires PAN and expiry).

Contactless/NFC is fast, convenient, and far more secure than magnetic stripe transactions. Even without tokenisation, it is far faster than anything else and almost as secure as contact EMV.

P.S. as for NFC to share contacts - I use it pretty often. Usually people are amazed their phone can do that. But I'm unique in that I know what phones, if the settings haven't been touched, will be able to receive a contact over NFC. Most users would get frustrated not knowing what phones they could tap their data to and what they couldn't.

 

[JoeTomasone]

Frankly, tokenisation doesn't matter much to me. Tokenisation isn't required to prevent the most common fraud methods (counterfeit card fraud, most Internet card not present fraud). A normal contactless card without tokenisation still does not provide the data needed to clone the card or to use it in most Internet transactions (the exception being the rare transaction that only requires PAN and expiry).

Contactless/NFC is fast, convenient, and far more secure than magnetic stripe transactions. Even without tokenisation, it is far faster than anything else and almost as secure as contact EMV.

Actually, EMV and contactless cards are actually pretty much the same as good 'ol mag-swipe cards from a security perspective once the terminal takes the data. It's still PAN, expiration, and CVV1 (for EMV), in plaintext. There are lots of source links (and a lot more detail) in my blog post discussing card security.

One of the bigger fraud problems globally today is EMV transactions being monitored, and the card numbers used online and in cloned cards in the US.

 

[AllieNeko]

Actually, EMV and contactless cards are actually pretty much the same as good 'ol mag-swipe cards from a security perspective once the terminal takes the data. It's still PAN, expiration, and CVV1 (for EMV), in plaintext. There are lots of source links (and a lot more detail) in my blog post discussing card security.

One of the bigger fraud problems globally today is EMV transactions being monitored, and the card numbers used online and in cloned cards in the US.

No. The CVV on the chip is not the CVV from the stripe thus your premise is wrong. The data isn't there to make a working counterfeit card.

 

[JoeTomasone]

No. The CVV on the chip is not the CVV from the stripe thus your premise is wrong. The data isn't there to make a working counterfeit card.

I included CVV by mistake, you are correct. However, there are attacks that can be used to clone an EMV card in certain circumstances, and intercepted card data has been used for CNP (card not present) transactions in the US and elsewhere.

 

[AllieNeko]

I included CVV by mistake, you are correct. However, there are attacks that can be used to clone an EMV card in certain circumstances, and intercepted card data has been used for CNP (card not present) transactions in the US and elsewhere.

That attack isn't cloning an EMV card, it is an advanced preplay attack by predicting the unpredictable number used for dynamic data authentication. It is a non-issue with modern terminals and with online authentication.

As for CNP, ONLY with merchants that don't ask for CVV2 or check address. If you'll take a card on just PAN and expiry you're responsible for theft and frankly, quite stupid. EMV is one piece of the puzzle. But it is the right piece for the card interface. CNP needs addressed too.