Apple Pay

[SPCTRE]

RiteAid, CVS, Best Buy, and Walmart are moving to actively disable NFC readers (the same used by Google Wallet), just because Apple Pay is being used.

Think about what they’re doing. They’re turning off NFC payment systems — the whole thing — only because people were actually using them with Apple Pay. Apple Pay works so well that it even works with non-partner systems. These things have been installed for years and so few people used them, apparently, that these retailers would rather block everyone than allow Apple Pay to continue working. I can’t imagine a better validation of Apple Pay’s appeal.

And the reason they don’t want to allow Apple Pay is because Apple Pay doesn’t give them any personal information about the customer. It’s not about security — Apple pay is far more secure than any credit/debit card system in the U.S. It’s not about money — Apple’s tiny slice of the transaction comes from the banks, not the merchants. It’s about data.

They’re doing this so they can pursue a system that is less secure (third-party apps don’t have access to the secure element where Apple Pay stores your credit card data, for one thing), less convenient (QR codes?), and not private.

 

[Squiggy]

That whole RiteAid/CVS thing is a debacle. Their proprietary system is horrid - based on QR codes.

QR CODES!

You phone generates at code. It's scanned by the register. Who then generates another QR code and your phone scans that. Even if there's no app to open and to unlock (which there will be), the time would take about 10 times longer than the semi-magical setup ApplePay has.

It's also tied directly to your bank account in order to get around the service fee the card company charges...and needs your SSN for some reason...and has already been hacked.

 

[Timby]

RiteAid, CVS, Best Buy, and Walmart are moving to actively disable NFC readers (the same used by Google Wallet), just because Apple Pay is being used.

Think about what they’re doing. They’re turning off NFC payment systems — the whole thing — only because people were actually using them with Apple Pay. Apple Pay works so well that it even works with non-partner systems. These things have been installed for years and so few people used them, apparently, that these retailers would rather block everyone than allow Apple Pay to continue working. I can’t imagine a better validation of Apple Pay’s appeal.

And the reason they don’t want to allow Apple Pay is because Apple Pay doesn’t give them any personal information about the customer. It’s not about security — Apple pay is far more secure than any credit/debit card system in the U.S. It’s not about money — Apple’s tiny slice of the transaction comes from the banks, not the merchants. It’s about data.

They’re doing this so they can pursue a system that is less secure (third-party apps don’t have access to the secure element where Apple Pay stores your credit card data, for one thing), less convenient (QR codes?), and not private.

That article is three weeks old. Within literally days of the announcement of CurrentC, the MCX was forced to announce that it had already been thoroughly compromised.

Whoops.

So...how does it actually work?

Basically, a dynamic security code (unique to each device) is generated for each transaction. When you hold up your phone to an NFC-enabled terminal, the phone asks for your fingerprint. When you provide it, that tells the phone it can transmit its device number and the newly generated security code to the terminal, the terminal transmits the information (along with the payment information) to the bank or card network and it proceeds like a normal credit card transaction. The bonus here is that the merchant never actually gets your name and 16-digit credit card number.

 

[B.J.]

When you're in a store that has NFC capabilities (most supermarkets). Hold up your iPhone 6 or 6 Plus to the card reader.

I haven't seen very many NFC systems around here, maybe one or two in gas stations, and none in the grocery stores. I think your location has you at an advantage there.

And how do they expect stores to adopt this system if the majority of people don't use iPhones?

 

[Timby]

And how do they expect stores to adopt this system if the majority of people don't use iPhones?

Well, Google Wallet has been out on Android for a while and uses similar NFC technology (an NFC-enabled Android device will work on any terminal that accepts Apple Pay) -- Apple's gameplan here is that by putting it on the single most popular phone in the country it gives NFC the adoption kick in the pants that it needs.

 

[Random_Spock]

Don't want it, not interested.

I don't want any sort of contactless payment. Putting in a chip and pin card ant entering my 4 digit code may not be infallible, but it will always be a physical level of security ahead of a wireless data stream.

That's me as well. I'm not comfortable with it. Not being able to have a receipt for a record just doesn't sit well with me tbh.

 

[B.J.]

And how do they expect stores to adopt this system if the majority of people don't use iPhones?

Well, Google Wallet has been out on Android for a while and uses similar NFC technology (an NFC-enabled Android device will work on any terminal that accepts Apple Pay) -- Apple's gameplan here is that by putting it on the single most popular phone in the country it gives NFC the adoption kick in the pants that it needs.

Ah, wasn't aware of that, thanks! I still have questions/concerns about using something like this, but that's one less.

 

[Timby]

Don't want it, not interested.

I don't want any sort of contactless payment. Putting in a chip and pin card ant entering my 4 digit code may not be infallible, but it will always be a physical level of security ahead of a wireless data stream.

That's me as well. I'm not comfortable with it. Not being able to have a receipt for a record just doesn't sit well with me tbh.

Once the exchange of information is made at the terminal, it proceeds as any other card transaction does: The register chimes, the receipt is printed, you're on your way.

And, again, the important thing to remember here is that the merchant never sees your data. Unlike Target, for example, which has a repository of customer names, card numbers and expiration dates from credit card swipes (and thus makes it vulnerable to attack), all it gets with an Apple Pay transaction is the record that the bank or card network sent the money. There is absolutely no exchange of personally identifying information in an Apple Pay transaction -- and, remember, the transaction key is dynamically generated every time. The key used to buy some DVDs this afternoon at Target is totally different from the one your phone will make when you stop at the grocery store tonight for some produce.

 

[Mr. Laser Beam]

That article is three weeks old. Within literally days of the announcement of CurrentC, the MCX was forced to announce that it had already been thoroughly compromised.

So what are going to be the effects of this? Will Rite Aid, CVS and Best Buy continue with this other system or will they have to backtrack and support Apple Pay after all?

And as for Target - I thought they were one of those merchants who abandoned Apple Pay for this 'CurrentC' crap. Have they changed positions again?

 

[Random_Spock]

Don't want it, not interested.

I don't want any sort of contactless payment. Putting in a chip and pin card ant entering my 4 digit code may not be infallible, but it will always be a physical level of security ahead of a wireless data stream.

That's me as well. I'm not comfortable with it. Not being able to have a receipt for a record just doesn't sit well with me tbh.

Once the exchange of information is made at the terminal, it proceeds as any other card transaction does: The register chimes, the receipt is printed, you're on your way.

And, again, the important thing to remember here is that the merchant never sees your data. Unlike Target, for example, which has a repository of customer names, card numbers and expiration dates from credit card swipes (and thus makes it vulnerable to attack), all it gets with an Apple Pay transaction is the record that the bank or card network sent the money. There is absolutely no exchange of personally identifying information in an Apple Pay transaction -- and, remember, the transaction key is dynamically generated every time. The key used to buy some DVDs this afternoon at Target is totally different from the one your phone will make when you stop at the grocery store tonight for some produce.

Still not a fan. For one thing I don't have an Apple iphone, so said Apple Pay wouldn't exactly work.

It's good that they're changing the transaction key every time it's used though. To be honest it reminds me of a credit card that was out some years back. You could use a different pass word every time you used it on different sites, etc.

 

[Squiggy]

That article is three weeks old. Within literally days of the announcement of CurrentC, the MCX was forced to announce that it had already been thoroughly compromised.

So what are going to be the effects of this? Will Rite Aid, CVS and Best Buy continue with this other system or will they have to backtrack and support Apple Pay after all?

And as for Target - I thought they were one of those merchants who abandoned Apple Pay for this 'CurrentC' crap. Have they changed positions again?

The CEO of CurrentC says the exclusive period is going to be months, not years.

Regardless, it's a doomed system.

 

[Tom Hendricks]

Apple Pay Gives Glimpse of Mainstream Appeal for Mobile Payments http://www.nytimes.com/2014/11/15/technology/apple-pay-gives-glimpse-of-mainstream-appeal-for-mobile-payments.html?_r=0

In the three weeks since the company released Apple Pay, its first stab at a mobile wallet, some major retailers are seeing a wave of consumers eager to check out at the register with their iPhones.

And even some of Apple’s competitors, like Google and Softcard, say Apple has helped create general awareness of mobile payments, including for their services.

 

[TheSeeker]

I went to set it up on my phone but apparent TD has not gotten on the bandwagon yet.

 

[Bisz]

Just a bit more info regarding NFC stuff for people not aware.

The US is behind the rest of the world when it comes to chip/nfc cards. Canada and Europe have had chip cards for years. It's great, chip cards are way more secure than non-chip, and nfc payment is way more convenient.

US merchants will be compelled to adapt by the end of 2015 however. That is when banks and card issuers will stop covering fraud claims on all non-chip transactions, pushing that cost onto the merchants. So, expect a lot more chip/nfc friendly terminals coming to stores near you in the coming year.