Apple says Australia's banks pose a security threat to iPhones | Hacker News Reader

Apple says Australia's banks pose a security threat to iPhones

afr.com

85 pointsrukuu001168 comments

Some context: Australia is different because they regulate interchange fees. Credit card interchange averages 0.5% / max 0.8% [1] whereas in the U.S. it's in the range of 1.4-2.4% + 5-10 cents.[2] So that's part of the reason banks are more aggressive with their negotiation. There's less of a pie to slice up.

Some more context.. This is a game with 3 main actors: banks, merchants and consumers. Apple's strategy was a smart one vis-a-vis Bitcoin and other "low fee" efforts. While many payment startups have attempted to woo merchants to adopt them with the promise of a lower-fee system, Apple focused on wooing consumers and banks by fully supporting the current, higher-fee interchange system. Banks get their higher fees and consumers get their rewards. Merchants get some security benefits (not as vulnerable to data breaches), but they mainly face pressure from consumers to support it as an amenity. That's much more successful than something that's price-friendly to merchants but offers little advantage to consumers or banks.

Problem is in Australia, thanks to regulation there is no "high fee" system to shore up for banks. So they are not as amenable to Apple Pay as in other countries. They want their own system in place so they can get the full 0.5% and, moreover, look for other ways to make money with it.

[1] http://www.rba.gov.au/payments-and-infrastructure/review-of-...

[2] https://usa.visa.com/dam/VCOM/download/merchants/Visa-USA-In...

FWIW, the EU also caps interchange fees (0.3% for credit cards and to 0.2% for debit cards) but that doesn't seem to have stopped Apple Pay adoption in the UK.

That's a very good point. Some possible explanations (let me know what you think):

1) Banks have healthier competition in the EU? They wouldn't be able to form a cartel like they are trying in Australia.

2) Fraud liability is fully borne by the consumer in Europe, whereas Australian banks still have to refund customers?

3) It's a very new change (December), whereas Australian banks have lived with it for a decade or so.

Personally I think #1 is sufficient to explain it.

Australian banks have a good thing going down under: they are the most profitable in the world in terms of profits as % of GDP. They may not make as much in payments but seem to have plenty of money making options.

[1] http://www.news.com.au/finance/economy/australian-economy/au...

Yeah, but they are also tightly regulated by APRA and when the GFC was happening and everyone else was worried about their banking system ours was stronger than ever.

And for yet more context:

- Australia already has widespread NFC payment terminals and has for years. My anecdotal estimate would put the terminals in Melbourne at ~95% accepting NFC. Everything from a McDonald's to a department store to a coffee shop accepts it.

- NFC is a frequently used feature of many Australian credit cards (as in you wave the card itself at the terminal).

- Many of the Australian banks already offer NFC payment apps on Android devices that cost nothing extra to the merchant or the consumer.

And for some opinion:

This has nothing to do with security. The banks want access to the iPhone for their apps. Apple wants access to the banks' users. The impression I got was that the banks may be willing to give Apple access to their users if Apple gives the banks access to their phones.

Apple however doesn't just want to be a competitor in a free payments market on the iPhone, it wants to monopolise it like it always has.

Of course it has something to do with security.

First, Apple Pay secures all purchases with Touch ID. The only way to make NFC cards as convenient is to skip asking for PINs. That's less secure.

Second, providing direct developer access to NFC on the phone would open up an attack surface. It would inevitably result in more hacks.

I find it ironic that you are arguing monopolization when the issue is literally banks seeking to act as a cartel. Apple is not a monopoly. It has healthy competition in the form of Samsung.

Exactly, banks are wanting to create a cartel here to define industry standards so that they can roll out their own silos. Each bank having its own shitty payment app. As if the ridiculous Poli payment stuff was not enough. My bank does not even have 2FA; will never trust them with security more than Apple.

> These banks want to maintain complete control over their customers.

And Apple want to maintain complete control over their customers. No-one has clean hands in this.

I trust that Apple's cage has much nicer gilding than the banks', but I'd rather not live in a cage at all, thank you very much.

iPhones aren't cages, they're serviced apartments. You pay a bit more and you don't get a choice on the decor, but you also don't have to vacuum the carpet, put out the trash, replace broken light bulbs, or lug heavy furniture around.

Apple makes it abundantly clear that they're selling an integrated solution. Anyone who cares about this knows this. It's not strictly Apple's fault if people who want a different deal buy their product in error.

Isn't every mobile the same?

That's a false equivalency. Apple being a closed platform is not an excuse to allow the banks to form a cartel.

If you don't like Apple, you can use Android. But if every bank in Australia decides what you can and can't do with your phone when making payments, where will you go?

It's not every bank, you can use ANZ.

This isn't banks acting like cartels, it's banks defining industry standards.

I don't think banks are blocking Apple pay. But are asking access to the NFC chip so they can have their own NFC apps. I think they are in the right in this.

No, because they don't know anything but about keeping a mobile platform safe from attack.

Australian banks have been releasing NFC payment apps for Android phones for years now and there haven't been any major attacks.

I'm reasonably confident they can handle this well. I don't trust Apple nearly as much as I trust my bank.

Android is under constant attack and there are huge botnets and malware. Just because a particularly bank hasn't been hit doesn't mean that money isn't being stolen.

ApplePay is already operating at scale in numerous countries without any incidents. Why wouldn't you trust Apple with an already proven system?

> Android is under constant attack and there are huge botnets and malware. Just because a particularly bank hasn't been hit doesn't mean that money isn't being stolen.

Do you have even anecdotal evidence of Android payments being compromised?

> ApplePay is already operating at scale in numerous countries without any incidents. Why wouldn't you trust Apple with an already proven system?

I didn't say I wouldn't trust it, I said I wouldn't trust it more than my banks. My banks have been operating at scale years longer than Apple has. Not the same scale but enough that I'm confident.

It's even worse. If Apple gets their way, ApplePay will be available to Apple users only. If banks get their way, their payment system will be available to everybody. It's quite clear to me which one is better...

Apple Pay doesn't stop other payment provisions from functioning. The same contactless reader will read Apple Pay, Contactless cards, and Android Pay.

Of course Apple Pay will only be available to Apple users. That's literally what Apple Pay is: contactless payment on an Apple device. There's no reason for there to be Apple Pay on Android or another platform.

Which still means I'm not allowed to pay for anything on an Apple device (since Apple hasn't and probably won't make it available locally), while an application built by my bank would.

I've worked for banks. I'd trust Apple to build a secure environment but not a bank.

Which kinda misses my point. A "secure" Apple service only available in select few countries with no ability to compete or implement your own is more useless than theorycrafting your experiences from banks to other world banks.

My worry is that if because of Apple's market power, merchants would be less likely to implement other NFC technologies (Contactless, Android Pay) once they have Apple Pay. The technologies are clearly different (even if they use the same reader), otherwise all places that support one would automatically support all of them.

If Apple get their way ApplePay AND whatever system the banks come up with be available to everybody with the required devices. Also Android pay will be available.

If banks have their way, there will be no ApplePay, no AndroidPay etc

It's quite clear which one is better.

> It's quite clear which one is better.

The unified system supported by all banks and all devices?

The one where consumers and merchants are free to chose.

Yes a unified system on which Apple, Android, or whomever wants can develop a system that is open to all to use.

The only one who can build such a system would be the banks.

Both Apple and Google want to keep Apple Pay and Android Pay exclusive to their platforms.

That is pure FUD and you know that. Here we don't have ApplePay (yet) but alternative payment solutions for bankcards have also certain restrictions and sometimes this also means regarding hardware.

That being said I have still the choice to way I pay and that won't be different than when ApplePay is available... . If I heard it correctly it can even use the same POS HW that other NFC based payment solutions use.

The only "negative" thing will be that I as a consumer, will have more choice.

Apple Pay is already available for Apple users only.

Although they did announced Apple Pay on the WEB. It will require Safari - which is available on iOS/macOS exclusively.

I hear the exact opposite is true, that in some large US chains earlier in its lifetime an Apple Pay competitor paid the retailers to not provide Apple Pay facilities in favour of theirs. In UK the same object takes chip+pin and NFC of any kind (iPhone, Android, contactless).

http://daringfireball.net/2014/10/nfc_apple_pay

So, the smartest thing that can come out of this is a published open standard to allow access and innovation.

You know kind of like how we got SMTP, HTTP, etc.

All of the above is already done for all practical purposes. The banks presumably want to have an app do card emulation with a given AID. The protocols are ISO standards and they're trivial. Android has allowed this since 5.0 IIRC.

Presumably Apple doesn't want to lose their cut. I don't see why allowing card emulation is a problem in and of itself for security, though.

The security problem I do see, though, is that third parties will have a hard time using the secure element to protect their keys. Of course, Apple could help them, but it obviously doesn't want to.

Yeah, when I read that, I immediately thought of pots calling kettles black.

As an American living in Australia, you quickly see the lack of innovation on payments in the US. Contact-less payments have been prevalent since moving here in 2012. The ability to pay bills via a common protocol is so nice, BPAY. The ability to move money between people electronically without third parties is also refreshing, direct bank transfers.

I have a Nexus 5 and use NFC payments via Google Pay and Bank Apps. In my opinion, they both are terrible from ease of use standpoint. Tapping my card on the terminal is far superior to opening an app and fumbling with it. As far as Apple is concerned, I think they are completely in the wrong in not letting other apps use NFC. Ideally, they win market share by creating the better experience. The banks getting together to negotiate terms is ridiculous too. In my opinion, an ideal outcome would be open NFC use on Apple devices. The better experience wins. I do not think collectively negotiating terms does anything for the consumer.

And Apple is trying to simultaneously compete with the banks and with Android. If the banks get a superior experience on Android, Apple has a problem.

> Ideally, they win market share by creating the better experience.

Right now Apple can't provide the better experience, because the banks in question will not support their system. The banks don't want to support Apple Pay, so Apple opening up NFC would just shift the balance of power entirely in favor of the banks.

My impression is that the banks want the access to be bidirectional. If they give access to Apple Pay, Apple should give them access to the NFC module.

That seems fair to me. Apple should have to compete instead of monopolising its platform.

If that's what the banks want, it's not unreasonable.

I'm not sure I agree that Apple shouldn't be able to monopolize its platform, though. If Apple had a true monopoly, sure, but they don't. They have at this point the minority of smartphones. I similarly don't think Ford is obligated to support Android Auto or Apple Play.

No. That's not what the banks want. The banks want to form a cartel to collectively negotiate with Apple, which effectively means no negotiation at all. They want to strongarm Apple to open up its NFC module to individual banking apps; they won't roll up Apple Pay.

I don't buy it. Apple is just painful to negotiate with and the banks want an at least semi-even table to play at.

This conflict isn't unbalanced. The same access is being sought on both sides. The banks want their ~10M ish iPhone users to have access to payments on their phones. Apple wants the same ~10M ish users to have access to payments on their phones. Both sides want something of equal value, it simply seems like Apple wants it all and isn't willing to give anything up.

The big 4 want to boycott Apple Pay, and want to strong arm others into boycotting Apple Pay too. They want a mafia ruling, not amicable solution.

This is the submission:- http://registers.accc.gov.au/content/index.phtml/itemId/1197...

Thank you, that actually backs up what I've been saying:

> competition: the applicants wish to ensure that the potential for competition and innovation in the emerging market for mobile payments is maintained. Therefore, they wish to collectively negotiate in response to any technological or other exclusivity that a Third Party Wallet Provider may seek to impose by:

> - refusing, restricting or failing to provide software access to any payment functionality built into devices manufactured by or for, or operating systems developed or distributed by, the Third Party Wallet Provider, for example NFC functionality; and/or

> - otherwise preventing or impeding card issuers from developing, deploying or participating in any other mobile payment or mobile wallet services or Third Party Wallets on any mobile devices or platforms;

They're mainly concerned with fraud standards and making sure nobody (Apple) tries to limit access to their platform.

As for your boycotting and "strong arm" claims, this document shows that scope is significantly narrower than you're implying:

> Accordingly, the applicants seek authorisation to: [...]

> enter into a limited form of collective boycott where the applicants will agree not to negotiate with the relevant Third Party Wallet Provider on an individual basis while collective negotiations with that Third Party Wallet Provider are ongoing.

The "boycott" in this document is referring solely to individual negotiation. i.e. Bank1 can't go behind the other banks' back and sweeten the deal while they're negotiating as a group.

An important thing to realise about the Australian banking market is that we're already a world leader in the adoption of contactless payments using our credit cards. (And unlike the US, our floor limit is $100, which covers almost all transactions. When exceeded, most terminals just prompt for your PIN.)

I'm sure Apple Pay is great, but with an entire continent already familiar with tapping their credit card, tapping a phone doesn't seem like much of an improvement.

Honestly it's he same in most places but it's still convenient not to have to worry about your wallet.

It really isn't the same.

A May 2015 survey by RF Intelligence Group, called ‘Global Payments Evaluation Study’, based on 32,000 respondents in 16 countries found that 66 per cent of Australians are aware that they own a contactless payment card and 53 per cent have made a contactless transaction. By contrast, just 14 per cent of Americans own a contactless card and only 9 per cent have used one for a payment.

http://www.bpaybanter.com.au/news-views/why-do-australians-l...

Australia had EFTPOS which was a way of using your debit card to buy stuff, way before the VISA network really took off.

I don't live in the US, I mean in most developed economies contactless is fairly common place.

Well, take Germany. Every store supports contactless, but MasterCard refuses to offer EC Cards with contactless, and wants to move customers to credit cards (which earn them far more profit – over 20 times the transaction fee).

Oh, and we don’t get Android Pay either.

As a result, the experience is horrible. And for every single bit US corporations are to blame.

Really? I had a discussion with an American about this a while ago and they seemed stunned at how easy and efficient tap'n'go sounded compared to what they had available. I mean, we're fairly behind in most things here, but if you tried to pay for groceries with a cheque, in 99.9% of places you would be (rightly) laughed out of the store.

From what I understand (which could well be wrong), it's not uncommon for Americans to get literal pay cheques either.

Here we've had direct bank transfers for my entire adult life (15+ years).

I'm 37 in Australia and I've literally never had a chequebook in my life. I think one time I used a bank cheque for a real estate transaction but that was a decade ago.

In the States its not uncommon to just have your card swiped in grocery stores and not even have to sign. Effectively they've just made the old insecure magstripe & sig system more convenient (and insecure).

I still have to worry about my wallet because I need my driver license, I need an amount of cash, and I need my corporate swipe card. I would also need my physical credit cards for accessing ATMs and the small minority of merchants that don't have a contactless terminal. (A few places still only have chip+pin; one of my favourite coffee shops is cash only business.)

My wallet is very slim; it would be more hassle having to think about whether I needed it or not, than to just have it on me at all times.

As someone coming from Canada to Australia, and who held the same viewpoint; you just need to experience Apply Pay. Ozland seriously sucks now when compared to Canada for me regarding NFC payments. Idiots are trying to create a cartel here.

I've used and experienced Apple Pay. It's certainly convenient. Don't see how it's more convenient than tapping my credit card, an object I would still be carrying even if I had Apple Pay.

I'm genuinely curious; what is The Apple Pay Experience?

What sucks so bad about our current setup?

What is so hugely different about tapping your phone instead of a card that it could possibly convince me to go through 3-4 extra steps? I really don't get it.

For me, Apple Pay has two advantages over a contactless card:

- it's only active after explicit user interaction. There is no way for somebody with an rogue device to steal money from me.

- conversely, there's no limit after which a transaction requires pin entry. Here in Switzerland, the limit for contactless cards is CHF 50 after which you have to still type in your pin. With Apple Pay, there is no limit.

Both of these make Apple Pay very valuable to me.

There's one more thing: I also have a contactless debit card (which I would love to be available on Apple Pay, but that's probably never going to happen) and the moment a reader detects more than one card, it refuses contacless operation.

By having the credit card on the watch, they are separated far enough from each other, so I can always pay contactless. This is a problem that would be fixable with better UX on the readers.

If explicit user interaction is a big deal, why don't banks make contactless cards with a thumb button you have to hold when swiping? Just a physical breaker in the NFC antenna circuit, it would be dead simple, as slim as you want, not need any power, and cheap.

1) No need to carry wallet when I was out in the field. 2) Stores do not get my card number and name. I always hated when something like even a restaurant would get my name. 3) If the card is reported lost and bank issues a new one, Apple Pay automatically updates before the card reaches me by mail. 4) It is additional security, as it asks for thumb verification before the payment.

There are no 3-4 extra steps involved at all. It is just taking phone out, as you normally do with card, and just tapping the thumb on home button.

The sales pitch for Apple pay is exactly that, you don't have to carry your cards since you will be carrying your phone anyway. If you are used to tapping your cards, then it will be easier to tap your phone as well.

Credit card with a temporary battery life just doesn't cut it for me. Also, I bring my credit card in my running shorts pockets when running. Phone doesn't even come close to fitting, and even if it did would awkwardly flap around

I held same opinion as you, but then Apple Pay rolled out in Canada and I did a complete 180 after using it. It gives you freedom, as you never leave your home without your phone even while running.

> you never leave your home without your phone even while running.

He literally just said he does leave his home without his phone while running.

Part of the pitch is it will also work with an Apple Watch, if the consumer has one, and will likely wear it while running.

Doesn't the Apple Watch require the paired iPhone to be nearby in order to function?

No, the paired iPhone doesn't need to be around for a few features, including tracking activity and Apple Pay.

It does. AFAIK, the Touch ID from the phone authenticates Apple Pay transactions from the watch.

[edit] I stand corrected. Looks like the watch had a Secure Element also to store the pay info. It automatically locks if you take it off.

He should take his phone with him, how else will he track his fitness data and steps, and then twitter it as he does?

>It gives you freedom, as you never leave your home without your phone even while running.

I understand that I might be a special case, but given the option, I would ALWAYS leave my phone at home. I hate that freaking thing.

Get a race belt!

Hah. To be fair, I also don't want to take phone with me to be distracted by it. Running is exactly the time to undistract myself. :)

But you can already do that with an Android phone with any of those banks...

Banks just want to create a cartel and oligopoly:- http://registers.accc.gov.au/content/index.phtml/itemId/1197...

Canada also has large penetration of contactless payments, as does UK and Europe. Australia is not unique in this sense. Every major Canadian bank has rolled out Apple Pay. Australia lacks in this area massively with every bank rolling out a shitty app.

Don't know about other banks, but the Commonwealth Bank app is nice.

I'm Australian but I live in the US now. I go back fairly often. Last year I tried out PayPass for the first time.

Contactless payments as implemented in Australia is (IMHO) a disaster. Here are the problems:

- No opt out. You couldn't get an ATM card without it. This led to various guides on drilling a hole in the RF antenna to disable it. Last I heard the ACCC was intervening to force the big banks to give consumers an opt out. Not sure if this has happened yet.

- Report your card stolen and the thief can still keep using PayPass. Why is this even possible in the modern age of the Internet?

- The burden of proof on unauthorized transactions is on the consumer. I seem to recall reading something from the T&Cs that claimed you could be charged a fee for a "false" (ie denied) claim and you could only claim unauthorized transactions once or twice a year.

- In the case of disputed transactions the merchant is on the hook for it leading some to not accept it.

Basically contactless payments in Australia are an effort by the big banks to not be responsible for fraud. There's no real benefit to consumers.

> Report your card stolen and the thief can still keep using PayPass.

That's the bank's problem, not yours.

> The burden of proof on unauthorized transactions is on the consumer.

Same as with chip + pin.

> The burden of proof on unauthorized transactions is on the consumer.

The burden of proof for unauthorised transactions is _never_ on the consumer.

> In the case of disputed transactions the merchant is on the hook

It is always the merchant who's on the hook for disputed transactions. The banks/issuer is _never_ on the hook.

Contactless payment is literally just a more convenient version of magnetic/chip payment, with everything else being the same.

> The burden of proof for unauthorised transactions is _never_ on the consumer.

It's true that the merchant has to prove that the consumer made the purchase. However, the burden is still on the consumer, since they still have to service the transaction until the dispute process is resolved.

You obviously have never had a contactless card stolen as absolutely none of what you have said is true, well except the opt out thing. You report your card stolen then pay pass will not work ( unless the merchant your using is "offline" which no merchant I know is. Burden of proof is actually on the bank not the holder and the banks are always more than happy to help. How do I know.....I live in Australia and have had my card stolen 2 times in 2 years and apart from a couple of days delay in getting a new card, there is no issue at all. Over here its actually reducing fraud as people dont see you use your pin number.

If a pin is used with stolen card, bank will refuse to credit the charges. It is not covered under fraud.

I'm in New Zealand and I can disable and enable a number of individual features on my credit card through my banks phone app

It's a huge improvement in security. You mentioned how the majority of contactless payments don't require a PIN. Apple Pay secures 100% of transactions with a PIN, made convenient with touch ID.

There are also behind-the-scenes protections against identity theft. E.g. if a merchant has a data breach, your Apple Pay card number can't be used to buy things online.

Average Joe will pick convenience over security every time, unless it's such an absolute shambles that they actually fear (or have been convinced they should fear) using it. Not to mention the already-formed habit/association of "hey, I'm paying for this, better whip out my card".

True, but Apple Pay is also at least as or more convenient than tapping a card. You (theoretically) don't ever have to enter PINs, you get a transaction confirmation on your own device, and if you have an Apple Watch you don't even have to pull anything out of your pocket.

>>> You (theoretically) don't ever have to enter PINs,

But practically, for day to day expenses, it's not required.

>>> you get a transaction confirmation on your own device

As opposed to getting a confirmation on the terminal...

>>> and if you have an Apple Watch you don't even have to pull anything out of your pocket

I don't know if you're talking from experience, but those terminals are usually facing up and/or towards you. It's uncomfortable to bend your wrist like that.

> if you have an Apple Watch you don't even have to pull anything out of your pocket

How is this PIN/touch ID protected, then?

You unlock the watch with a pin on the watch itself or touch id on your iPhone. It locks itself automatically when you remove it from your wrist.

This doesn't seem very convenient. You scribble a PIN on your wrist or you pull your phone out of your pocket to use touchID?

You only enter the PIN when you wear the watch to unlock it, not at the register.

Consumers are already protected, the security is more for the banks. Contactless was made to not require a pin for transactions under a certain amount. It's made for convenience, no one is using it to steals 1000s. And if someone is using it to steal they aren't stealing from joe blow but from the banks.

It's not identity theft they are protecting, but bank fraud. If a merchant has a data breach and my credit card details are used to buy things online without my authorization, that isn't identity theft, but bank fraud to the bank. Since all I have to do is say that transaction isn't mine and poof it's gone.

It's not just "poof it's gone" here.

In Australia, if you dispute a credit card transaction, it still counts against your limit and your required repayments until the dispute is resolved. This can take months and be more than inconvenient.

Not so in Switzerland. At least not with my bank.

If I complain about a charge (which I will only do if it's truly fraudulent, or not possible to have been initiated by me) the amount is credited immediately while the bank is taking it up with the merchant.

That's exactly the way it should be and if this is not the case you should probably be pushing for stronger consumer protection laws.

Not so in the US either, at least not universally. My credit card companies have followed this same pattern when there has been a dispute.

The motivation for moving to chip and pin is that the banks take this kind of risk away from the merchant.

>>> There are also behind-the-scenes protections against identity theft. E.g. if a merchant has a data breach, your Apple Pay card number can't be used to buy things online.

Contactless cards work the same way. They don't send your card number, they send a token.

Not necessarily. My German MasterCard and Visa cards don't use send the the full number. In fact, I think tokenization is a fairly recent addition to the standard.

I don't see your point. If the Oz banks are way ahead, why do they need to form a cartel? Your argument implies that Apple will fail to displace them. Maybe so. But then they are being silly acting threatened...

None of the banks need to sign up at all. No existing customers need to use Apple Pay. All this is entirely opt in. So why any fuss at all? Hmmm...

> All this is entirely opt in. So why any fuss at all?

That has been the banks' position. Then Apple started asking politicians to force the banks to do business with Apple (on Apple's terms, of course). This is a counter-punch: we'll open up, but only if you do.

The banks want to offer contactless payments on iPhones which they already do on Android.

The question is, I suppose, how many Apple customers will leave the cartel banks and change to ANZ Banking Group or any other banks which are supporting Apple Pay.

Apple couldn't really be more disingenuous here. This has nothing to do with user security and everything to do with squelching competition. Competition for them, not for the banks. The banks just want to compete and Apple doesn't want to let them.

This is exactly why I do not own an iPhone.

Unless you know what the banks specifically want changed in the deal, you can't substantiate that assertion. Apple has undoubtedly put a lot of time and money into validating and auditing the security around Apple Pay. It's a solution that doesn't need to be modified for the Australian market: one major Aussie bank has fully adopted Apple Pay already.

There's no way Apple are going to allow that effort to be trashed by a few banks in a small overseas market. (It's also highly probable that the banks want to be able to implement processes that bypass the consumer friendly aspects of Apple Pay, like its strong privacy controls.)

> small overseas market

That depends really. While Australia is a relatively small market, everyone here pays using paywave (contactless payments via credit/debit cards, 69% owned and 43% used in 2013!), and if a shop has a card terminal they support it. If it could be enabled on iPhones, they would get instant adoption by lots of people.

I can't see any specific numbers to compare right now, but I'd be interested to see some contactless payment comparison between the US and Oz for 2015.

Why do you think people would use their iPhones over the cards they already use, though? That's going backwards in terms of efficiency for the user, and it's not like the majority of people care about security.

Fewer things to carry. It may not work for everyone, but it's one very practical reason.

We already have our phone in our hands.

The efficiency of Apple Pay with a phone already in your hand over cards in a wallet in your pocket is night and day.

> We already have our phones in our hands.

Huh? Phone in hand while scanning stuff at the self-serve checkout? The only time I can think of myself using the phone while buying something is maybe at a convenience store while I'm on the phone, which is definitely not handy.. "Just hold on for a sec mate, I'm about to tap you.."

> night and day

Nah. NFC vs magnetic was night and day. One form of swipe over another, no way. Especially not if I need to fiddle with a fingerprint scan or a non-tactile interface.

Don't need to tell me, I'm an Aussie. :-)

I posted a link with AUS vs US contactless payment statistics from 2015 elsewhere in this discussion.

>everyone here pays using paywave

No we don't, or at least I don't. I still use eftpos with a PIN because I don't trust wireless tech.

"everyone". Of course nothing will be ever 100%. But it's close enough. It's universal and it's universally accepted.

And I'm sure there's a few people who keep money in their mattress. Don't see how the paranoid delusions of less than 0.1% of the marketplace are relevant to this discussion.

You're greatly overestimating the amount of pay pass users.

I think you are underestimating the amount. I know of _nobody_ (parents, grandparents, friends, friends of friends, etc) that do _not_ use contactless payments when they can (anecdotal, I know). MasterCard, VISA, and the banks have spent many years marketing and educating the entire populace to just "tap and pay". Every payment terminal here, and by extension the merchants, has to support contactless payments. Every (debit and credit) card issued by a bank within the last few years have an NFC chip built-in. 99%^ of people with bank accounts have it, 99.9% of those use it when they can.

^there are some small banks / credit unions that still issue EFTPOS-only cards, but these are in the minority.

Someone posted this else where in the thread:

> A May 2015 survey by RF Intelligence Group, called ‘Global Payments Evaluation Study’, based on 32,000 respondents in 16 countries found that 66 per cent of Australians are aware that they own a contactless payment card and 53 per cent have made a contactless transaction. By contrast, just 14 per cent of Americans own a contactless card and only 9 per cent have used one for a payment.

http://www.bpaybanter.com.au/news-views/why-do-australians-l...

So only just over 50% have made a single contact less payment (as of a year ago). It looks like you hang around an atypical group.

Someone posted this else where in the thread:

http://www.bpaybanter.com.au/news-views/why-do-australians-l...

So only just over 50% have made a single contact less payment.

PYMNTS.com reckons about 3.5M people used Apple Pay at least once last year.

http://www.pymnts.com/in-depth/2015/wanna-know-how-many-appl...

Australia has a mature chip-and-pin and contactless payment model, to the point where we basically can't function when PayWave terminals go down ("you mean I need cash?" … out comes the phone to figure out where the nearest ATM is).

Comparing the two markets is not informative, especially given the rollout problems the USA has with any new transaction processing system.

In Australia almost half the population were using contactless payment in 2014. No better reference than News Corp. but that does put the number at least as high as 14M users.

Note that the paymen handling market in the USA us three-tiered. My understanding is a little fuzzy but they have the card issuer, the payment processor who authorises payments, and the payment settler who handles the money.

In Australia we only have issuers and banks, with banks filling the role of the bottom two tiers of the US model.

As a result, the entry of Apple Pay into the Australian market involves taking half of the credit card payment settling cash flow away from the banks.

So the banks are holding out and fighting Apple any way they can.

None of the banks have the expertise to safely implement NFC on my phone. They deploy equipment built by others, using transaction models designed by others, and simply collect money for making sure the systems are functioning.

Apple is entirely correct in not allowing third parties to access the NFC circuitry in order to protect the security of Apple Pay.

The banks can prove their competence in Android first, but they recognise that the money they are hungry for mostly lives in Appke users' pockets.

> None of the banks have the expertise to safely implement NFC on my phone. They deploy equipment built by others, using transaction models designed by others, and simply collect money for making sure the systems are functioning.

This is an important point worth re-emphasizing. This isn't a case of Apple vs Banks, it's a case of Apple vs Various Technology Integrators With Multiple Layers Of Subcontractors.

The banks are the ones that wear any fraud, all they're asking is to use the NFC to communicate.

It's the equivalent of apple charging you to browse the web, and forcing you to use their browser in the name of 'security'! This is rent-seeking at it's finest.

Apple have technology that reduces fraud rates and they ask for a very tiny cut of the merchant fees in return. Fraud is an expensive element of the cost of handling credit transactions.

That is not rent-seeking, it's payment for services rendered.

It's rent-seeking because they are using their control of the phone to force out their competitors in an orthogonal market.

They are providing a useful service, no question - but they should allow competition. If they are providing the best service, it won't matter anyway.

You want rent-seeking? Look at the excessive merchant fees on credit transactions. It's nothing more than a shakedown on merchants so banks can bribe their customers with points and perks.

Apple allow competition. It's called Android and it's available everywhere.

> You want rent-seeking? Look at the excessive merchant fees on credit transactions. It's nothing more than a shakedown on merchants so banks can bribe their customers with points and perks.

I don't disagree, but what's your point? The fact that other, arguably worse rent-seeking exists does not change anything about the present circumstance.

> Apple allow competition. It's called Android and it's available everywhere.

Sure, that's true, and that's why anti-competitive laws have not been applied to behaviors like this on Apple's part. But you should recognize that if Android were to do something like this it would be illegal, because of their dominant position in the market place.

This is exactly what Microsoft got stung on Antitrust for: Using dominance in one market to force out competitors in another.

This behavior is objectively and unequivocally anti-competitive and, in general, bad for consumers. It circumscribes choice and it does so in a particularly pernicious way: by preventing the competitors from ever existing in the first place.

Proportionality matters. Everything is rent-seeking with a broad enough definition.

Australia doesn't have the excessive merchant fees, the interchange fees in Australia are regulated under banking laws.

This is a key part of the problem. The interchange fee is only between 0.5-1.5%. The banks already make very little on payments so there isn't much profit left to go around.

In the EU interchange is capped at 0.2%-0.3% and still UK banks (and now French banks) offer Apple Pay (they are said to have gotten a better deal by Apple than in other countries).

According to the link, it seems the banks just want to be able to use the NFC chip in their own apps.

And that's not going to happen. Apple have tied their NFC chip closely to their secure enclave; there's no freaking way Apple are going to let a bunch of third rate subcontractors go anywhere near it.

It would be trivial to create an API for the secure enclave and the NFC chip that sandboxed apps to prevent them from manipulating each other's data. Apple is simply choosing not to do it.

It's definitely not trivial to do this in a secure way. Every bit of additional code is code that could contain security flaws.

Also, looking at how the banks are doing over here ("your password can't be longer than 16 characters and can't contain the following symbols: " ' %"), I'm trusting apple more than the banks.

It can very well be that Apple is or will design a more secure system than most back. They are after all good at security and one of the largest technology company. But the question here is that there are generic hardware in iPhone that can be used by anybody to make contactless payment good/bad. Apple is not giving them the access not just because of security but to reduce competition. If you don't trust your bank but apple the bank is not forcing you to use their app so that point doesn't really apply.

What if Intel/AMD or any processor company was saying the the encoding hardware of their device was only accessible to their own app and not to other application in your device since others wouldn't know how to use it properly?

Here is a discussion of Intel limiting the code that can run in security subsystems in their processors:

https://news.ycombinator.com/item?id=11007060

I'm not saying this is acceptable, but it seems to be happening.

The problem here is our banks are very good, they have always been very good. Fees are lower than almost any other developed country, tech is way ahead of most, apps are generally good if you like that sort of thing etc.

Apple has basically said to the banks that though the iPhone includes hardware to do contactless payments -only- Apple can utilize that hardware. The banks are counter-offering that they will consider integrating with Apple Pay if that hardware is opened up to them, otherwise there is no benefit to Apple Pay for the banks at all.

Consumers in Australia aren't going to force the banks to implement Apple Pay because the tech we have is already just as good, it just doesn't work with iPhone. Hell, we already have contactless payments on most Android phones with NFC.

Apple needs to be realistic. If they want to enter into the Australian market they need to play fair and open up the hardware so that banks can offer a unified experience over both Android and iPhone without iPhone being a special little snowflake.

Yup, as one of those Australian who solely uses an iPhone I don't give a crap about contactless payment via the iPhone. I use my card, which I keep in my wallet.

If I break my iPhone I pay a fortune to replace it. I really do to want to lose the ability to pay for stuff at the same time.

Then why would you care if Apple gets their way?

Increased costs and a walled garden is fine for their App Store, but not for systems dealing with financial transactions. That's why.

You haven't actually explained anything - you've just made a statement. Why shouldn't Apple be able to ship whatever product they want? Why should banks be able to force an API on them?

They can, but to make inroads into the Australian market they have to work with the four major banks in Australia.

These banks don't have to use ApplePay, and if they don't get greater access to a variety of things they just won't use Apple.

And I won't really care, because I'll use my contactless card like I always have. HTH.

"These banks don't have to use ApplePay, and if they don't get access to a greater variety of things they just won't use Apple"

If it were that simple, why are they asking permission to form a cartel?

Who says they are?

I'm an Aussie and use one of the big bank's apps on a s6 edge (the edge is weird and I hate it). Contactless payment already works great in exactly the way that a credit card does as a store terminal. Anyone know if Samsung gets a cut?

Not sure which bank you are with but mine seems to have some exclusivity deal with samsung phones which it hides under the guise of 'other phones are not secure enough to do contactless payments'. Not a hard fact but it would also lead me to believe they get some sort of kick back.

Samsung phones have a secure element, which means your NFC transactions happen a bit outside of the normal app's control. There's some extra information here: http://www.sequent.com/secure-elements-vs-cloud-based-hce-se...

It's true that they provide security, but then again, other banks are happy to use other techniques (commbank's app does nfc payments on pretty much anything with NFC - nexus 5 included)

Why would user security be compromised by NFC access any more than WiFi access or Bluetooth access? Or does Apple not provide APIs at the same abstraction level for WiFi/Bluetooth that the banks are requesting for NFC?

Apple does not provide developers with access to the NFC hardware and they also do not provide direct access to Bluetooth either. Using these is limited to being able to make use of IOS services which make use of these hardware capabilities such as Apple Pay, Bluetooth audio outputs, etc...

This is true of NFC but Bluetooth capabilities are much more open. I've personally used Core Bluetooth to connect and communicate with arbitrary devices and communicate over custom protocols.

I was trying a little to hard to be succinct, I've also used CoreBluetooth, I was lumping it into an awfully generic group by categorising that as part of the "services" provided by iOS, but I was thinking from the point of view that all the things the iOS frameworks provide are the ones Apple has allowed them to provide on iOS. Effectively the framework is a way to access the limited set of allowed services, as opposed to direct hardware access. Otherwise we could do much more interesting things with Bluetooth such as implement new Bluetooth profiles and create things like apps where the iPhone functioned as a Bluetooth keyboard for another device.

This iOS app appears to be able to advertise custom bluetooth profiles, though? https://itunes.apple.com/us/app/lightblue-explorer-bluetooth...

It's not just about NFC access, it's about ensuring the whole system is implemented securely all the way from the customer to the bank. That includes things like tokenization and privacy controls. If they let 3rd parties do it, they could do it wrong, and then users wouldn't trust or like iPhones as much for payments, and then they'd still use cards. That's the thinking at least.

Certainly it would not affect “Apple Pay” (or however it's called) technically. But it would dilute/weaken the statement that “paying with your iPhone is secure”.

So I can understand that Apple may want to limit payment systems on their phones to ones that they can prove to have a minimal level of security - and their strategy of putting sensitive data in the secure coprocessor while still having the convenience of a one button unlock is unrivaled in the industry.

What they definitely do not want is to be associated with stories of credit card fraud involving iPhones, even if technically the fault is clearly outside Apple.

It's worth noting that Android Pay has launched with 28 banks in Australia.

http://www.news.com.au/technology/google-launches-android-pa...

It's also worth noting that Australia has 4 big banks that have over 80% of the Australian market. With 28 the proportion of the market covered is even higher.

Google were clearly prepared to make deals that Apple are not.

> Providing simple access to the NFC antenna by banking applications would fundamentally diminish the high level of security Apple aims to have on our devices.

This is what I hate about Apple. I am fairly certain that the customers bought these devices -- so isn't it their customers' devices?

Apple wants to sell iPhones, yet keep complete control over it. Simple things such as disabling updates is not possible -- because it is not in Apple's interest.

They completely redefine what ownership means -- you "own" it, but Apple "controls" it.

That is not what "our devices" means, and you know it.

You just hate Apple for ideological reasons, and reach (very hard) for reasons to support that ideology.

Just remember what you said here next time a car company talks about "our cars".

> Simple things such as disabling updates is not possible -- because it is not in Apple's interest.

That seems disingenuous. Yes there is no explicit switch that prevents the user being informed about updates ever again, but there are no forced updates that I'm aware of. If you don't want to update, don't.

It is not possible to block downloads of updates or to switch of daily update reminders on new iOS devices. This is a well known problem: http://osxdaily.com/2016/01/04/stop-ios-software-update-noti...

The only option is to avoid Wifi or configure your wifi router to block Apple.

I think banking is a logical sector for tech firms to move into. Apple, Google, Amazon. They build platforms, and they enhance those platforms with services that they charge for.

Day to day banking is the sort of service that would really enhance their platforms, and would also have a massive side benefit of cutting out a notoriously difficult middle man that no one really likes anyway.

Take Apple as a thought experiment. The banks have already seeded Apple's hypothetical bank will all of their customers via Apple pay. Here in the UK, I can change bank account at the push of a button and everything is taken care of for me in just a couple of days. That's the law and there's nothing the banks can do to stop me. If Apple one day gave me a "Would you like to move your bank account to Apple" button, I'd press it in a flash, and feel a great sense of pleasure as I stuck it to the established British banks. With Apple's huge stock piles of cash, I think a takeover of an existing bank would not be unfeasible.

In addition, should tech firms start setting up or buying existing banks, there's plenty of legislation in place to ensure they play fair with each other.

It's pie in the sky thinking, but interesting to think about none the less.

Interesting idea. I'm curious what the regulatory landscape is like. Is it feasible to run a bank off of a giant multinational tech company?

I remember back in the day Apple needed to charge for iPod Touch software updates for some sort of accounting purpose.

I wasnt suggesting they offer those services for free. If they were to consider this, I imagine buying an existing bank would be the first thing they would look at. There are a number of banks out there that very few people have heared of. It wouldn't have to be a Barclays or a HSBC, just someone with a banking license or the opportunity to acquire one in the relevant territories. Also, the Financial Conduct Authority here has a strong appetite for being progressive and trying out new ideas. Other countries also take a lead from what the FCA says is OK or not.

> Is it feasible to run a bank off of a giant multinational tech company?

Many German companies have exactly that, although the banks are usually only used to offer stuff like buying a VW on credit, or leasing a VW, or holding accounts for employees.

But banking and tech have been connected for many decades.

I think you are underestimating the tech involved with banking...

Plus, I don't really understand your issue with UK banks but I had nothing but stellar service.

I can do everything on the mobile app (which looks pretty good), I can switch easily, contactless is everywhere, transfers are basically instant... What would Apple bring to the table?

I just find it odd to put so much trust in a consumer facing company when banks, by law, have to follow so many laws and regulations that I doubt Apple is willing to follow.

I do actually work for bank, but you couldn't have known that. FS is currently my area of expertise.

It's just the impression I got from your comment.

I'm very interested in knowing what do you expect Apple to offer in addition to what we have in the UK.

I'd like to write a lot about this, but I don't have the time. So I'll rattle off some stuff without going in depth.

Better software. Better integration into peoples lives. Cheaper fees. Less exploitative and predatory lending practices (as in no desire to be a lender at all so that's not an issue). Holding more deposits as capital so deposits are safer. No investment banking to put deposits at undue risk.

Generally just a fresh attitude towards everything.

Apple, Amazon or Google would not need to be a "bank" in the way banks operate today. I'd say that would be the biggest benefit of all. Somewhere safe to keep your money and nothing more.

The speculative side of banking can be left to those people and institutions with an appetite for risk. And they can risk their own money.

Ah ok, I get it.

When it comes to software, I don't get what complaints you might have about mobile / internet banking, as they are pretty good, in the UK at least. Maybe you are talking about the back-end of things and not consumer?

The rest of the complaints I think are symptoms of the industry itself (some of which tech companies like TransferWise ARE trying to disrupt). Don't know what tech companies can do about that but one can hope :)

Consumer retail deposit banking is a highly regulated, poorly profitable business. Where do banks make their money? Not on checking accounts; usually it's on debt issuing and investment activities. Holding deposits is just a way to build capital to do the things that actually make money.

So, I don't know why Apple would suddenly decide to take deposits, unless they also decided to get into capital-intensive businesses like lending or investing.

But here's the thing: Apple has an enormous pile of capital already. If they wanted to get into capital-intensive businesses, they could do it tomorrow, without taking deposits.

If they did that, their stock would tank, though. It's much better for them to stick to consumer technology and try to take a slice of the payments business.

Confounding security and business policies is setting a bad precedent for the security of anyone that isn't able to throw their weight around in negotiations as well as Apple can.

They aren't.

Reply on news.ycombinator.com