Apple Pay will support NFC tags
twitter.com
twitter.com
I'm curious about the security implications of this though. Seems like it would be easy to make a NFC sticker "skimmer" that you sticker over the official sticker.
If I skim your card in Chicago I can bill $2000 in a “coffee place” in Manila.
The same doesn’t work with NFC tags which not only can and likely will be geofenced but there’s no details to skim and the payment goes through Apple Pay not the credit card network which anyone can access.
I think the attack would be to place a sticker that causes unsuspecting users to pay you instead of the intended merchant.
Essentially as soon as somebody reports you to Apple your account will be burned.
Of course, it's up to Apple to implement and administrate it, they are generally pretty sensible about this kind of stuff.
It doesn’t scale due to limits.
And it doesn’t work as easily as credit cards as you will have to go trough the Apple Pay merchant KYC process for these to be billable which means you will have to verify your business.
Credit card skimming works because the stolen details can be used anywhere in the world and the cash is pretty much immediately transferred.
They can also be used to buy physical goods which can then be resold.
You can’t do the same with NFC tags.
But I agree this is nice. convenient.
https://www.businessinsider.com/alipay-wechat-pay-china-mobi...
If you rely on NFC, then on Apple devices you need Apple's blessing - and for financial transactions that means Apple Pay only, you don't get access to install applications in the secure element of the NFC chip in the phone.
eg my bank installed a virtual contactless Visa/Mastercard on my Android device that worked with everything long before Google/Android Pay was a thing, and without Google getting a slice of the transaction. Transit systems can install their own virtual transit card on Android too.
With wechat I have to pull out my phone, unlock it, open the app, navigate to the payments part and open the camera, point it at the QR code.
What’s the relevance of Apple here? What’s to stop Android doing this with wearables? We’re taking about NFC not a particular brand of phone.
In the past 6 months or so (so basically overnight), a QR payment system (PayPay) has gotten massive adoption. They did this in two ways: a massive expensive signup campaign (20% cashback on all purchases deal), and the fact that any tiny back-alley bar can just install the app, link their bank account, and print out a QR code and now they're accepting payments.
The big advantage for QR is the quick and cheap deployment process.
NFC is a superior technology regardless.
The hot dog stand might not want it but they’re the rare case. In others NFC is just better in every way.
The tag contains the data who the payment is for and how much the payment is. You could do the exact same thing with QR, but with more fussing and aiming and worrying about the amount of light and whether the image is dirty or not.
But with much better UX and Security. QR Code does have its uses, but for many things it is the wrong solution.
?
And since the nfc tags will have a predetermined, set payment amount associated with them, even biometrics shouldn’t be necessary.
That only works with active NFC readers though. Presumably these tags are passive and aren't emitting a signal that would wake up the iPhone
[1] https://www.greenbot.com/article/3072233/zip-pow-google-show...
In the US. Many other countries are using NFC payments on their phones for years.
I'd argue that Apple's lack of NFC support effectively stifled any would-be innovators from even exploring the possibilities.
What I read:
> Imagine putting your phone down on the bar and being charged $1000 by some anonymous dude that hid a NFC tag there while noone was looking.
Basically, the entire planet is now 'fair game' as a skimmer.
I would also guess that:
- the first payment to a new payee to have a bit more UI.
- the phone’s setting to contain settings such as max amount to be paid per week or month, and max amount to be paid in one transaction.
- those tags to have some cryptographic signature with Apple vetting those wanting to get a key. A service like this can be highly successful if only a limited number of companies (¿a few hundred?) can produce such tags.
- Apple acting as an intermediary between iOS user and payee to protect their user’s privacy.
It also is possible that Apple will withhold payment for a few days or even weeks, to give time to detect and correct fraudulent transactions, and give its customers time to challenge payments.
If such challenges are handled by always repaying the iOS user, this won’t be more dangerous than allowing selected companies to withdraw money from your bank account whenever they see fit, something that millions of people in the world do because it is so convenient.
For example, if Londoners enable auto top up for their Oyster card (https://oyster.tfl.gov.uk/oyster/link/sso/0002.do), transport for London could transfer £1000 from their bank account the next day, even if they destroy that card seconds after signing up.
I would even expect that they can do that from any bank account even if it’s owner hasn’t applied for auto top up, or even has an Oyster card. This system is built on trust.
This statement is sensationalist and not true, as the maximum load on a Oyster Card is £90.
London transport must send thousands of payment requests to banks each day. Banks will honor them without checking anything, as there’s no way (apart from contacting the customer) for them to verify that London transport has the right to request those transfers of money to them (“here’s the form this customer signed last year” doesn’t say anything about whether the customer withdrew permission later)
The contract between the bank and London Transport likely says something about the amount of money they can request to be transferred to them each week, month or year, _may_ limit the amount per item, and says the contract will end if London Transport misuses the trust the banks give them, but that will be about it.