Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Besides Samsung Pay running in a hardware KNOX partition for security, no account number is stored, only tokens.

In fact, even its magnetic swipe payment method uses issuer based tokens instead of the real account number.

Thus anyone who claims to be truly concerned about payment security (which is mostly people being dramatic to begin with, since consumers are covered and it's usually just an inconvenience), should be using a Samsung S6 or Note 5 with Samsung Pay, so that they're protected by tokens even at the millions of sales terminals that still only take swipe cards.
None of that is going to protect you from a key logger, and to get your card into the phone you need to type information. If the phone can easily be compromised (as all Android phones can) by software you downloaded, you shouldn't enter anything you wouldn't mind the world seeing.

Being covered is nice, but it doesn't do much good you when you're at a gas station hundreds of miles from home and your card has been shut off because a criminal has been using it.
 
None of that is going to protect you from a key logger, and to get your card into the phone you need to type information.

You normally take a picture of the card to register it, same as with Apple Pay (and Google Wallet before that).

Being covered is nice, but it doesn't do much good you when you're at a gas station hundreds of miles from home and your card has been shut off because a criminal has been using it.

Get real. The chance of a keylogger being involved in that situation is extraordinarily small.

A far, FAR more likely scenario (especially in the US), is that you were unable to use Apple Pay at a store, and so had to swipe or insert a physical card, thus exposing your REAL account number to multiple attack vectors, and leading to your card being shut off.

Using Samsung Pay's MST token would clearly be the much more secure choice in such a common situation.
 
Can someone please explain to me the obsession corporate America has with QR codes? They're clunky, aesthetically unpleasant, require special software to read, and generally are used just to send you to a website. It struck me as outdated and overwrought the first time I scanned one. I'm amazed they're still around. What's the appeal?
 
Can someone explain why some companies are holding out? It doesn't seem like Apple is asking for much income from each transaction.

I talked to a rep at my credit union about why they haven't embraced Apple Pay and they hinted that Apple's cost for transactions is unusually high. At face value, it may not seem high but it sounds like it's higher than industry standards.

Disclaimer: I don't work in the financial or banking world so I have no idea if that's accurate or not. Just reporting what someone told me.
 
A far, FAR more likely scenario (especially in the US), is that you were unable to use Apple Pay at a store, and so had to swipe or insert a physical card, thus exposing your REAL account number to multiple attack vectors, and leading to your card being shut off.

Anyone who is using Pay along with the same registered physical credit cards is defeating the purpose of Pay. I have a credit card solely for use with Pay, a credit card solely for use with physical purchases, and a credit card for online purchases. Each exposing a different layer of credit vulnerability. I never use my banks debit/visa as anything other than a debit card with a pin access.
 
Big deal. I'll swipe (or rather, insert) my credit card instead. Either way they won't be getting my membership.
 
Anyone who is using Pay along with the same registered physical credit cards is defeating the purpose of Pay. I have a credit card solely for use with Pay, a credit card solely for use with physical purchases, and a credit card for online purchases. Each exposing a different layer of credit vulnerability. I never use my banks debit/visa as anything other than a debit card with a pin access.

Why go through so much hassle to prevent someone getting your card number? For one, it's not like you are on the hook for any losses, and two, have you ever actually had your identity stolen? I've had one instance in 10 years. I'll continue to choose convenience.
 
Why go through so much hassle to prevent someone getting your card number? For one, it's not like you are on the hook for any losses, and two, have you ever actually had your identity stolen? I've had one instance in 10 years. I'll continue to choose convenience.
I had a girlfriend one time suggest to me on the occasion of some idiot following too close on my bumper, to just let him hit me, since it would be his fault.

The reason of course I didn't is because it might have cause injury to us, and it for sure would have been an inconvenience despite being fully covered for such an incident.

Identity theft is the worst of it, and the thing I'm least concerned about based on the odds. However, even though I'm not liable for the loss on any of my cards, it will be an inconvenience. Credit card cancelled and reissued, bank account drained, automatic payments bouncing, not having a viable means of making payments when traveling, etc.

I don't have three credit cards because I run them up and maintain balances on them, I have them to ensure if something happens to one, I will always be able to pay for things, whether a credit card is lost, stolen, cancelled, or "frozen". This is just common sense. And I go a step further in making sure that if something happens to one, the others won't be compromised. Guess what happens if someone steals my wallet? That's right, they get one credit card. Or if I lose a card? Or if someone hacks Target again? Or that random online store I made a purchase from? I still have two safely put away to fall back on, while I'm mostly unaffected by the minor inconvenience of having one card out of commission for a couple of weeks.

But you go right ahead and roll the dice if that makes you happy.
 
If people are willing to cut coupons and get special cards (like Target's red card) for individual stores, they'll be willing to use one-off apps too if the retailers dangle a few pennies in discounts in front of them ...

This move is not surprising. Target is big on tracking their customers and data mining their purchase histories. They'll try to resist any payment system that keeps them from collecting that data.
They might just as well put a chair on the beach and command the tide to not come in.
 
People still shop there after their massive data breach? Why would ANYONE trust them again?

Perhaps people are unfortunately used to software bugs and even malware, and just consider it to be another such glitch.

Perhaps they were not affected. I know that even though I shopped during breach periods at both Target and Home Depot, my Chase cards were not re-issued because of that. So net effect on me: nothing.

Others, of course, might have used a debit card and were poor enough to have an actual attack via the breach really affect them.

Personally, I don't run across people outside of this forum that seem to be overly concerned about any of this.
 
Last edited:
I know that even though I shopped during breach periods at both Target and Home Depot, my Chase cards were not re-issued because of that.

Interesting. I used my BofA and Chase cards at Home Depot and both ended up getting reissued despite having no fraudulent charges. Perhaps they saw my card numbers on some data dump?
 
There is no premium to avoid Wal-Mart. Proven in numerous sources. On the average the prices of both places are the same.

I shop at both... Why does Pepsi cost $1 at Walmart and $1.99 at Target? no premium huh?

Stouffer's Dinners $2.99 at Walmart and $3.50 at Target. Again, no premium huh?
 
Freaking stop. Nobody wants to pay with a qr code, and nobody will.
Except all those upwardly mobile customers who use one daily to buy their $7.00 Venti lattes at Starbucks.

People will do what they have to do to get what they want, especially if the merchant gives them an enducement to do it, just like at most grocery stores with their barcode "club card" fobs dangling from the average shopper's keychain.
 
People still shop there after their massive data breach? Why would ANYONE trust them again?

I just thought of another reason some people might trust them: the breach itself and the resulting bad publicity. Which means Target is likely to have taken drastic steps to try to make sure it doesn't happen again. It's like thinking that a bank that got robbed, is safer than one that hasn't been (yet), whether that's true or not.

Interesting. I used my BofA and Chase cards at Home Depot and both ended up getting reissued despite having no fraudulent charges. Perhaps they saw my card numbers on some data dump?

Yes, in fact that's very possible. There were listings of the stolen card ranges on sites that sell such things.

I've read that, in the beginning, the stolen card numbers were commanding high prices, because they included CVV, expiration and possibly name data. Several million were apparently sold for around $30 each. Exclusive ones with confirmed purchase ability and high limits even went for over $100 each. (!)

As time passed, of course, cards were more likely to have been re-issued, and prices dropped to only a couple of dollars per account number.
 
Last edited:
I just thought of another reason: the breach itself and the resulting bad publicity. Which means Target is likely to have taken drastic steps to try to make sure it doesn't happen again. It's like thinking that a bank that got robbed, is safer than one that hasn't been (yet), whether that's true or not.
You would think that, but there have been examples of the opposite: with the bank seemingly thinking, since they were just robbed, there was little chance they would get robbed again. Then they got robbed again. Sometimes twice more. :)



Mike
 
From what I heard, the Engineers for Walmart and Target saw SQRL and realized that is what they really wanted. So it sounds like Target is taking SQLR (which is open source) and running with it as an alternative to Apple Pay.

https://www.grc.com/sqrl/sqrl.htm

Makes sense. Target and Walmart don't want to have Apple demanding a slice of their revenue.

Apple doesn't get any of Target's or WalMart's revenue if they take ApplePay. Apple would get some of Visa/MC/Amex/Discover's revenue but each of those issuers have already agreed to Apple's terms because they feel the security offered is worth it. None of these issuers charge any merchant anything extra to take ApplePay.

I really wish people would get this through their skulls! No merchant pays anything more to take ApplePay!
 
  • Like
Reactions: jonatron
Anyone who is using Pay along with the same registered physical credit cards is defeating the purpose of Pay. I have a credit card solely for use with Pay, a credit card solely for use with physical purchases, and a credit card for online purchases. Each exposing a different layer of credit vulnerability. I never use my banks debit/visa as anything other than a debit card with a pin access.

That really isn't true. My physical Chase Visa that I have loaded in ApplePay was compromised by a restaurant delivery driver. I called Chase and reported it. While I was still on the phone they cancelled the physical card number and automatically updated my card in ApplePay. I was given a new device account number and the last 4 digits of the card image in ApplePay changed. I could continue to use ApplePay even though the physical card was cancelled. When my new physical card came, the last 4 digits matched those that had updated instantly in my wallet. Given that experience, I see no reason for your over cautious behavior. Of course you're entitled to do what you want, but I can't imagine why.
 
I had a girlfriend one time suggest to me on the occasion of some idiot following too close on my bumper, to just let him hit me, since it would be his fault.

The reason of course I didn't is because it might have cause injury to us, and it for sure would have been an inconvenience despite being fully covered for such an incident.

Identity theft is the worst of it, and the thing I'm least concerned about based on the odds. However, even though I'm not liable for the loss on any of my cards, it will be an inconvenience. Credit card cancelled and reissued, bank account drained, automatic payments bouncing, not having a viable means of making payments when traveling, etc.

I don't have three credit cards because I run them up and maintain balances on them, I have them to ensure if something happens to one, I will always be able to pay for things, whether a credit card is lost, stolen, cancelled, or "frozen". This is just common sense. And I go a step further in making sure that if something happens to one, the others won't be compromised. Guess what happens if someone steals my wallet? That's right, they get one credit card. Or if I lose a card? Or if someone hacks Target again? Or that random online store I made a purchase from? I still have two safely put away to fall back on, while I'm mostly unaffected by the minor inconvenience of having one card out of commission for a couple of weeks.

But you go right ahead and roll the dice if that makes you happy.

You mention "frozen" here and that reminds me that Discover allows you to "freeze" your physical card without "freezing" your ApplePay and vice versa.

I do agree that it makes sense to limit exposure by carrying fewer physical cards but I've had a hard time doing that until more merchants take ApplePay. I have a Visa that's 3% back on gas and restaurants, a MC that's 2.2% back on everything else, and my Amex is my Costco ID and is currently only card taken there. Discover is a rotating cash back. It's not currently in my physical wallet but is in ApplePay for 22% back till end of year and is in my Amazon account for 5% off this quarter. It will go in my car next quarter when it's good for 5% off at gas stations.

I would much prefer to not carry any physical cards but just keep them at home for emergency use. Or take one along on a trip and keep safe separately from my phone just in case my phone gets lost. It would obviously be a pain to lose my phone, but I would rest quite easily with respect to my card info being secure in it. I wouldn't feel the same about losing my physical wallet.

As for those who say we need to carry a wallet because we need our ID's, I believe there are states working on digital drivers' licenses. In fact, here's a link.

http://www.cnet.com/news/your-future-drivers-license-could-go-digital/

As for carrying cash, for the most part I just keep a $20 bill folded in my wallet and a few quarters in my car for an occasional meter that doesn't take a card. Other than that, I try to use a card for all purchases large or small. I got into that habit while living in Australia where EFTPOS (electronic funds transfer point of sale) was ubiquitous and often preferred over cash. When I moved back to the States I decided to give going cashless a go, and for the most part have been successful.
 
Last edited:
Somebody at Publix told me they were going to support Samsung Pay but not Apple Pay. If true Publix would have to specifically block Apple Pay, which is interesting since I thought nothing special is required to support it.

Same person also said they aren't supporting NFC payments now because they don't want to trash the terminals they bought 5 months ago. If true, I can't understand what sort of moron buys a bunch of non-NFC terminals when they know NFC payments are coming down the pike and they aren't much more expensive than non-NFC terminals.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.