New Apple Pay Setup Screens Unearthed in iOS 8.1 Beta 2

[gnasher729]

Still no word of this coming to thw UK though. NFC adoption is pretty poor here.

In fact I am still not sure this is quicker or easier than a chip and pin card.

I thought it is quite common. Marks & Spencer, House of Fraser, Robert Dyas, the canteen at my company, that's just a few where I used it recently.

----------

I'm pretty sure the limit is imposed by your bank (similar to the cash withdrawal limit). It's not hard wired into the nfc readers.

It's the bank that guarantees that the merchant will get their money in case of fraud, so it really _must_ be the bank that sets the limit. In the case of your debit or credit card, anyone stealing your card could use it with an NFC reader, so the amount must be quite low.

----------

Can someone please explain to me why previous generation iPhones and iPads are being cut out of using Apple Pay for online purchases? Clearly I can't do contactless payments with my 5s because no NFC, but what's the deal otherwise? Is this just an artificial limitation to get people to buy new phones?

The short answer is "because of the secure enclave processor that is only on the iPhone 6". The long answer: This thing will let you pay for expensive stuff with your iPhone. It must be _absolutely_ hacker proof. Even if you jailbreak your iPhone and install all the malware you can find anywhere, it must still be safe. That's why Apple built this secure processor. All the iPhone can do is send encrypted data from the NFC terminal to the secure processor, and receive encrypted data from the secure processor and send it to the bank. Your iPhone itself has no way to read or change any of the encrypted data, because it's all done inside the secure enclave processor and your iPhone has no way to look inside it.

On an iPhone 5, the whole thing could be made safe, but not safe enough, because the iPhone would have to do the encryption/decryption itself, and it's not possible to make that safe enough. (For example the encryption of your data on the iPhone isn't safe anymore after a jailbreak, but that's your own fault so don't blame Apple. But for Apple Pay on an iPhone 5, the bank's money wouldn't be safe after a jailbreak, so they will never allow this).

 

[Ivan0310]

No Touch ID authorization and the lack of a Secure Element

But I thought that the 5s had a secure enclave for Touch ID. Is this enclave different in the 6?

 

[ItWasNotMe]

Hmmm. That screen shot says "when you use Apple Pay, information about your card, device and location will be sent to Apple and your bank." (Paraphrased)

I thought the whole point was that Apple didn't know where you bought something.

That's what I though as well, but when I went back and looked at what they said; it was that they didn't store the data, but that it might pass through them, e.g. for credit checks

 

[mmomega]

No, i can't.

i cld just hit my starbucks that's just around the corner with just my ipad.

You can do Starbucks now with Passbook.
I've been using it since they announced that quite a while ago, go to drive thru, order, pull up to window and they scan your phone barcode, get the coffee and drive out.

 

[ptb42]

Any word if this requires internet to use?

No, not once you have loaded the card into your Passbook. To the merchant's terminal, your iPhone looks like a contactless credit card.

----------

That's what I though as well, but when I went back and looked at what they said; it was that they didn't store the data, but that it might pass through them, e.g. for credit checks

No, the authorization is done through existing payment networks. Apple doesn't get involved (unlike Google Wallet).

----------

Now, If your debit card or credit card from your bank is a Visa or MasterCard it will work. Every single bank in the country does not need to be on board.

No, your bank has to support the EMV tokenization standard that is being used by Pay. That requires changes to their backend system.

 

[mdelvecchio]

Can someone please explain to me why previous generation iPhones and iPads are being cut out of using Apple Pay for online purchases? Clearly I can't do contactless payments with my 5s because no NFC, but what's the deal otherwise? Is this just an artificial limitation to get people to buy new phones?

i guess you haven't been paying attention. the 6 has an NFC chip, which is the protocol used to do contactless payments. how on earth could older phones transmit that when they don't have the hardware to do so?

 

[kdarling]

Every store is in the process of buying new ones. After the Target and Home Depot breach, credit card companies moved up the date for credit cards with chips on them.

AFAIK, the US target dates for chip cards haven't changed in years.

However, the merchant account number breaches have undoubtedly made tokenizing more attractive.

Can someone please explain to me why previous generation iPhones and iPads are being cut out of using Apple Pay for online purchases? Clearly I can't do contactless payments with my 5s because no NFC, but what's the deal otherwise? Is this just an artificial limitation to get people to buy new phones?

The older phones do not have a Secure Element where the various card payment applets can run. This is necessary even for in-app Apple Pay.

Apple could've gone with an SE in their Secure Enclave, or in the cloud, but stayed with the EMVCo specification that currently requires a dedicated SE.

Question for our American cousins, do you only have the option of NFC payments if the total is below a certain amount?

AFAIK, in the US there is no limit on mobile NFC payments except what your credit card has. (Google Wallet does have like a $1,000 per day in-store purchase limit until they've vetted you, then the limit is your backing card.)

With Apple Pay you are authorising with your finger print, so there is no need to have a limit.

TouchID is just a convenient and optional replacement for entering a PIN. It's not the reason there's no limit in the US. Overseas, we don't know what will happen yet.

Hmmm. That screen shot says "when you use Apple Pay, information about your card, device and location will be sent to Apple and your bank." (Paraphrased)

I thought the whole point was that Apple didn't know where you bought something.

"If you have Location Services turned on, the location of your device and the approximate date and time of the transaction may be sent anonymously to Apple. Apple uses this information to help Apple Pay improve the accuracy of business names in your transaction history and may be retained in the aggregate to improve Apple Pay and other Apple products and services." - Apple Pay Security

 

[hlevolve]

Gonna Go Ahead and Call it...

The next line of macbook's are probably going to include their own TouchID sensor so you can make purchases with your mac online using Apple Pay and use it to get into your laptop just like the phone and iPad. Which will be super sweet, and which will also need additional supply of sapphire...

If not the NEXT release absolutely the one after that, but they really should build it into the next release macbooks but I know how they like to move slow on some things, they may wait a bit because online merchants will need to implement Apple pay with the phones and iPad's first then when widely available you will be able to do that from your laptop.

 

[monoskier]

Probably because it IS listed on Apple's page.

Yep. Missed it.

 

[Ivan0310]

i guess you haven't been paying attention. the 6 has an NFC chip, which is the protocol used to do contactless payments. how on earth could older phones transmit that when they don't have the hardware to do so?

And I guess you can't read; try some basic reading comprehension before calling someone else out for perceived ignorance--my question was legitimate, deal with it.

I already acknowledged the fact that the 5s doesn't have an NFC chip and therefore cannot do contactless payments.

Can someone please explain to me why previous generation iPhones and iPads are being cut out of using Apple Pay for online purchases? Clearly I can't do contactless payments with my 5s because no NFC, but what's the deal otherwise? Is this just an artificial limitation to get people to buy new phones?

NFC-enabled contactless payments aren't the only method available for the Apple Pay system. It will also allow for online payments through supported apps. There is no physical point of service, just a method of online payment--meaning this doesn't appear to be a hardware issue on the face of it.

However, others have explained that there is a secure element for credit cards separate from the secure enclave for Touch ID. This means it is a hardware issue after all. So thank you to those that actually provided useful input.

 

[j.applewood]

Can I use Apple pay to checkout online even if a merchant doesn't specifically accept Apple pay? ... Like for autofilling my CC info. Maybe keychain already does this and I'm dumb?

I need to shop online more I guess.

----------

i guess you haven't been paying attention. the 6 has an NFC chip, which is the protocol used to do contactless payments. how on earth could older phones transmit that when they don't have the hardware to do so?

He said online payments homie.

 

[cocky jeremy]

Apple Pay is strictly for shopping/acquisition and doesn't swing the other way and accept payments like (say) PayPal, correct?

... for now.

 

[nightstalkerz]

No, not once you have loaded the card into your Passbook. To the merchant's terminal, your iPhone looks like a contactless credit card.

Do you have a source for this?

 

[Tech198]

"If you have Location Services turned on, the location of your device and the approximate date and time of the transaction may be sent anonymously to Apple. Apple uses this information to help Apple Pay improve the accuracy of business names in your transaction history and may be retained in the aggregate to improve Apple Pay and other Apple products and services." - Apple Pay Security

Exactly, just one more way Apple can use to track you.. that's all it is.. Weather its a fraud transaction or not (although it would help)

 

[kdarling]

The short answer is "because of the secure enclave processor that is only on the iPhone 6". The long answer: This thing will let you pay for expensive stuff with your iPhone. It must be _absolutely_ hacker proof. Even if you jailbreak your iPhone and install all the malware you can find anywhere, it must still be safe. That's why Apple built this secure processor. All the iPhone can do is send encrypted data from the NFC terminal to the secure processor, and receive encrypted data from the secure processor and send it to the bank. Your iPhone itself has no way to read or change any of the encrypted data, because it's all done inside the secure enclave processor and your iPhone has no way to look inside it.

Really close, but you mixed up "enclave" and "element".

"Secure ENCLAVE" is the term for a separate coprocessor next to the main CPU that's used, in Apple's case for example, to calculate if fingerprint data matches, and to send commands to the Secure Element.

"Secure ELEMENT" is the term for something that runs payment applets. That is, takes the pieces of a transaction and your account number, and creates signed transaction elements.

--

The Secure ELEMENT can be implemented in various places, including a Secure Enclave or SIM (*), but in Apple's case it's included in the NFC chip supplied by NXP (used to be Philips) Semiconductor.

You are correct that the NFC payment communications flow directly to/from the NFC radio to the Secure Element. Nothing else on the phone can read that info.

(*) In fact, the idea for a secure element came from 3G SIMs, which are also applet coprocessors with cryptographic capabilities, used to authenticate the user on cellular networks. The GSMA had intended that carriers be in control of the Secure Element... which is what helped hold back Google Wallet for years. Now Google and Apple have ignored the GSMA and done their own implementations where they are in control of the secure element.

 

[Rigby]

Can I use Apple pay to checkout online even if a merchant doesn't specifically accept Apple pay?

No. The online merchant has to sign up with Apple to use Apple Pay. In contrast to in-store NFC transactions, online transactions actually go through Apple servers. This is required to decrypt the payment information encrypted by the Secure Element. Apple then re-encrypts the information using the merchant's key and forwards it.

----------

Exactly, just one more way Apple can use to track you.. that's all it is.. Weather its a fraud transaction or not (although it would help)

Simply turn off location services if you don't like it.

 

[ptb42]

Do you have a source for this?

There have been multiple articles posted about this in various MacRumors threads about pay. Here's one that provides a high-level summary:

https://www.creditcardinsider.com/insider/guide-apple-pay-merchants/

You can also look at Apple's patent applications for Apple Pay.

 

[poppy10]

Hmm, I've found NFC to be in quite a lot of places.
Sainsburys, Tesco, Whsmith, McDonald's, Pret a Manger, café Nero, Greggs, Eat, Uppercrust and I'm sure there's more that I haven't been in.

Most Co-op and Waitrose stores too.

Have to say using my Paywave card/tag will be much easier than pulling out a phone

 

[gaximus]

Go to the USAA website, they will be supporting Apple Pay.

USAA sent an email out saying it's not ready yet but they are working towards implementation. At least I got one from them...

Awesome thank you.

 

[dontwalkhand]

Starbucks doesn't use NFC...

I just think it would look a little funny bringing your iPad to the register to pay.

Yes but they do take barcodes, and in the same passbook app that I'd use ApplePay, I can easily use my debit card linked Starbucks card. Fine with me.

----------

I would think they would have to be limited, as the contactless option doesn't became available once you hit the limit, at wilkos if you spend 14 quid, the terminal says insert card or present contactless card, but if you spend 16 quid it only says insert card.... They would either have to remove the limit, or Apple pay will have to be limited.

Question for our American cousins, do you only have the option of NFC payments if the total is below a certain amount?

No limits in the U.S. that I know of. I just paid a $214 car repair bill with my NFC Wells Fargo debit, tapped the card and off I went., with my now working, fully alligned car, that is, until I hit another curb.

The terminal was a FD terminal, and said "Insert/Swipe/Tap Card" and never changed because of amount. I know folks up north of us in Canada, have a $25 limit for the same reason listed below for Europe.

The difference is because in the US, we process all transactions be it, Chip and PIN, Magstripe, or NFC, ONLINE. While in Europe, it is common to process NFC offline, and they'll just get the money later when the terminal batches out, hence the limit.

This is why it also took so long for the U.S. to get Chip & PIN, Because the "online processing" was deemed to be "more secure"- we all know how well that went with Target and Home Depot. Now we have to have Chip and PIN by oct 2015, for which all of my cards now have.

View attachment 502298 in the US, look for these Verifone terminals, Tap the phone to the screen, and you're good.



----------

Can I use Apple pay to checkout online even if a merchant doesn't specifically accept Apple pay? ... Like for autofilling my CC info. Maybe keychain already does this and I'm dumb?

I need to shop online more I guess.

----------



He said online payments homie.

Keychain already does this. Just press Fill out Credit Card or something above the keyboard when it pops up

----------

i guess you haven't been paying attention. the 6 has an NFC chip, which is the protocol used to do contactless payments. how on earth could older phones transmit that when they don't have the hardware to do so?

The Watch. The watch must have it's own secure element, because on Apple's page about ApplePay, it clearly says you can use a 5/5s to make payments, "in store only" with the WATCH

 

[dannyyankou]

Yes but they do take barcodes, and in the same passbook app that I'd use ApplePay, I can easily use my debit card linked Starbucks card. Fine with me.

I know, I use it almost everyday. Love the rewards program also. Free drink every 12 purchases!

 

[weaverra]

There's a new iPad being announced next week. It will get Apple Pay and Touch ID for online purchases, but probably not NFC for in store payments. That's the point I'm trying to make.

I'm still waiting for the iPad to get a calculator app.

 

[dkh587]

I can't wait to use Apple Pay at PetCo! #

 

[Diode]

Quick question: Don't have a 6 or 6 plus, but does Apple Pay allow you to pay with not Apple Pay merchants? So if you wanted to buy from Wegmans instead of Whole Foods, would the transaction continue?

Anywhere Mastercard PayPass, Visa PayWave, or American Express ExpressPay is accepted will take Apple Pay.

 

[r-m]

No limits in the U.S. that I know of. I just paid a $214 car repair bill with my NFC Wells Fargo debit, tapped the card and off I went., with my now working, fully alligned car, that is, until I hit another curb.

The terminal was a FD terminal, and said "Insert/Swipe/Tap Card" and never changed because of amount. I know folks up north of us in Canada, have a $25 limit for the same reason listed below for Europe.

The difference is because in the US, we process all transactions be it, Chip and PIN, Magstripe, or NFC, ONLINE. While in Europe, it is common to process NFC offline, and they'll just get the money later when the terminal batches out, hence the limit.

This is why it also took so long for the U.S. to get Chip & PIN, Because the "online processing" was deemed to be "more secure"- we all know how well that went with Target and Home Depot. Now we have to have Chip and PIN by oct 2015, for which all of my cards now have.

AFAIK, in the US there is no limit on mobile NFC payments except what your credit card has. (Google Wallet does have like a $1,000 per day in-store purchase limit until they've vetted you, then the limit is your backing card.)

There is the limit in the UK. I didn't realise it was because of the offline thing, as NFC terminals are also Chip&Pin - whether I pay with NFC or Chip&Pin, the terminal always has a moment of "authorising" and sometimes takes longer (when the connection is slowed, I assumed).

The limit was introduced when contactless was launched here in the UK.
I think first it was £10, then went to £15, finally went up to £20 - that limit applies to everyone, and I thought it was just for security and avoiding major fraud. If somebody steals my card, they can only spend up to £20 per transaction, rather than going getting their car sorted and me footing the bill.

Even though it's been raised to £20, some places still have the £15 limit - most McDs I've been too, and according to someone else's post, Wilkos have a £15 limit.