Apple warns of risks from German law to open up mobile payments
reuters.com
reuters.com
> The law highlights the growing desire in Germany for tighter regulation of U.S. technology companies.
No, this highlights that the EU is willing and able to regulate markets to keep them open to all participants.
Looking forward to laws opening up this sector even more.
[1] https://en.wikipedia.org/wiki/Payment_Services_Directive#Rev...
Next step is something like OpenBanking in the UK which does ask for common APIs.
Rabobank (Dutch) quoted to us the end of 2020 for their 'official' connection platform, but the requirements have been made legally binding in September...
Before that, I had to use multiple banks' apps. Many of those would randomly want to verify me by sending an SMS to Indian 1800 number, impossible from my Indian Sim card while in roaming in US.
Now I just use PhonePe. Two banks, One Credit Card. Inter transfers, Card Payment, Bill Payments, Phone Recharges, Sending money to others, all from within one app.
*No affiliation, just a happy customer.
As a EU citizen myself that now has to live with an incredibly disrupting online banking experience, I am more than unhappy with the EU's regulations.
On things which require authentication every 90 days (like checking the balance via api), almost all banks require one after every attempt/api call.
Even worse: Many banks don't support their app's 2FA for the api calls, but instead the old tan lists. (ING does this AFAIK)
How so? For most people PSD2 means 2F auth not just for money transfers but also for login, which is quite good for security in general, although of course won't help in all cases (like SIM swap).
I used to refresh several bank accounts several times per day through a third party app (MoneyMoney) on the Mac. This worked pretty flawlessly until September.
Now, I have to take out my phone and 2FA all the things in three different apps.
Of course, partially, Consorsbank is to blame here, because they fucked this up. Other banks have more customer-friendly interpretations on how often you have to 2FA (like once per month).
Only thing I noticed: I used to automatically fetch transactions through a HBCI interface with the open source software AqBanking on a VPS. This doesn't work anymore, because you need to register this software somewhere. So not sure how this is connected to PSD2 exactly. I assume the requirements for HBCI got tightened.
SCA is only required for high risk activities, such as payments (and even then, only if amount is over €30 or if you have transacted over €100 since last SCA). Balances and recent transactions are considered low-risk, so you shouldnt need to enter 2FA for "refreshing" your account balances, etc.
The directive also states that a balance must be made between security and user experience. It seems your bank(s) ignored that part.
If I could, I would opt out.
This is something where the technical regulation falls short, though. They (i.e. the EBA, which I believe specified the technical part of PSD2) could have specified some minimum usability requirements for delegated account access APIs.
Having to do SMS-based 2FA every single time when using a third party client compared to being able to use Face ID for the bank's native app is probably not really the intended outcome, but the reality for my two main bank accounts.
My comment was specifically in response to GP being requested for SCA multiple times per day to refresh their accounts.
And the card companies just invented new fees for merchants so they don't see much of an advantage.
The difference is that currently in EU banks are forced to expose a banking API, but every bank can have their own API. While in UK there is one API standard that banks are supposed to allow to be used.
So writing an app for EU one has to deal with tens (if not hundreds) of bank-specific implementations while in UK one is all that's needed.
It has not helped by any means with the ton of technical debt they had, because now everybody's just winging it and being minimally PSD2 compliant. We still don't have a standardised OAuth (or OAuth-styled) access to banks, and it doesn't look like PSD2 is helping anybody out beyond the "yeah, like, just make the data accessible without scraping, thanks!"
you don't really want to lock in a specific API by law. that will work well for a few years, but then it will more likely hinder innovation, rather than support it.
So by this logic, anyone who has a device which supports NFC payments and can load an app from a third party must allow access to methods the hardware performs the handshake/connection? So why not just say all parts of the phone must be fully exposed, why not demand that apps can make the phone calls?
I have two major issues with these demands. First being it simply is more likely a means for state actors to have more opportunities for back doors violating the trust people put into their devices.
the second is what is to prevent every damn bank and store from demanding you only use their app because you know that will happen.
It's not anything cloak-and-dagger like that. It's really just politicians leaning in on the side of their banks in a commercial negotiation with Apple.
I think for reasons similar to what grandparent mentions, I prefer it be the device, like the hardware btc wallets.
Regulations shouldn’t crack open a toaster, and shouldn’t crack open a PDA.
Exactly. I find it absurd that credit card companies can charge between 1.5% and 3.5% in merchant fees. Some 2%+ of the retail volume goes to credit card companies! (Who then turn around and give a small fraction of it back to their more savvy and rich customers via miles or points, while charging their poorer or less organised customers horrendous late fees and interest.)
The German Girocard debit card system charges merchants at most 0.2%, an order of magnitude less. That's the way it should be.
There is also nothing stopping companies in the US from either implementing a super low-cost system, or just only accepting cash. I think CC have critical adoption in the US, and nothing but legislation would remove them - it’s a zero sum game. If I stop using a card I don’t get points and pay the same price for products.
I don’t know all of the details of the German Girocard, seems like it’s a good product potentially, but would need some more info. In the US, if someone scams my debit card I am out of cash until it’s recovered. How does it work in this case for this card?
I would also like to challenge the notion that prices should be X, just because someone is perceived as a middleman. Prices should be (excluding healthcare) whatever people are willing to pay. It’s equivalent to someone complaining about mobile app developers costing a certain amount of money and just saying that’s the way it should be. Companies put a lot of money, time, and development into building the infrastructure and products, so they should be free to charge what the market will bear for these types of products.
There is no reason prices would stay the same, unless there was collusion between all the retailers. And neither Walmart nor Visa eat the fees. Anyone not earning credit card rewards eat the fees.
Also, money transfer infrastructure is just as important as healthcare. As is water, electricity, and transportation. I’m assuming you wouldn’t want the electric or gas company to charge what the market will bear when it’s -10C outside for a few weeks.
> Wal-Mart/Visa don’t eat the fees
Well, in Wal-Mart’s case either they pay the fees, or they raise prices to compensate. If we assume that they raise prices to compensate for transaction costs, then anyone who doesn’t use a rewards debit/credit card eats the fees in the sense that they don’t get any sort of reimbursement yet pay the same price.
> Also, money transfer infrastructure is just as important as healthcare. As is water, electricity, and transportation. I’m assuming you wouldn’t want the electric or gas company to charge what the market will bear when it’s -10C outside for a few weeks.
Eh I don’t think it’s as important as those items. But that’s besides the point, unless you want to nationalize money transfer or something. It’s not a necessary service, it’s just very convenient and good for the economy. When someone creates Venmo you want to legislate the prices they can charge per-transaction?
That’s a good point, and I can see two options for it. One is that it’s more costly to maintain two sets of prices, or that it’s better for retailers to encourage purchases with credit cards as people using credit cards are likelier to spend more.
> When someone creates Venmo you want to legislate the prices they can charge per-transaction?
No, I’d rather the government already have setup a system. It’s the reason why payments and transferring money still involves paper in the US. Northern Europe has been able to enjoy the convenience of instant, secure, and cheap money transfers for decades that people in the US are just starting to get.
Certain types of infrastructure in society is best handled as a society. Roads, water, energy, payment networks. I don’t see the point in duplicating them.
You're from the US, right? Then you should be familiar with gas stations which have two sets of prices: an expensive one for credit card customers, and a cheaper one for cash customers. Last time I road-tripped through the California/Oregon area, those were a thing and quite common.
Why doesn't Walmart do the same? Probably because they have 50k prices to consider, while a gas station has like 3 or 4. But the gas stations demonstrate that there obviously is a possibility for reduced payment costs to end up at the customer in the form of reduced prices.
Now imagine taking away the burden of having Walmart (and any other retailer for that matter) add 50k additional prices to their inventory by simply capping all CC fees at 0,3%. If you don't see the likelihood for a reduction in prices for customers in the long run, you either don't have much trust in free markets, or you must assume that the market in question is not free at all, but burdened by collusion.
They can't anymore in the EU. It's capped to exactly the 0.2% you mention for debit and 0.3% for credit cards.
This is also the reason why you don't see rewards on consumer cards anymore around here.
NAL. It is somewhat complex and involved Amex exploiting a 'loophole' in the EU law, which capped the fees. It revolves around how three party and four party arrangements were structured and implemented. Nonetheless, it was challenged and Amex lost it's appeal and currently open for interpretation, notwithstanding the fees that it has to continue swallowing as a result.
Excerpt: What is more complex is that American Express doesn’t even charge interchange fees because there is no intermediary. There are no interchange fees to cap. Instead, it has to cap its general fee charged to retailers. This will presumably need to be set at a level similar to the total fees now charged to retailers for accepting Visa or Mastercard.
https://www.headforpoints.com/2018/02/08/american-express-eu...
Scheme fees are still unregulated, though, and I assume that these will be the next focus area of the EU regulator(s).
Without an exclusive payment system, they would just be a payment alternative that would be way more user friendly than their competitors and everything would be dandy. I'd even consider it to be a reason to buy an iPhone, given their super simple UX flow compared to even the most user friendly bank apps.
I hope not just Germany, but also the EU will take action against companies like Apple. These exclusive networks that serve no purpose other than vendor lock-in are a lose-lose scenario for customers and even the most rabid Apple fans should see how shitty their behaviour is.
They've made their bed and now they will have to lie in it. Good on Germany for taking action.
The benefit of the Apple Wallet for customers is having all your cards in one app, available from the lock screen. The benefit to the bank is that they don't have to make an app, they just need the back-end integration with Apple Pay.
In my country, every bank has supported contactless payments for at least 3-4 years. My bank has a pretty nice UX, as do many of its competitors. Some other apps are more focused on security than user experience, which manifests itself in an irritating slow mess, but that's just another factor to take into account when picking a bank.
A few months ago, the first bank in my country announced Apple pay support. Up till then, Apple customers have been behind the curve on simple features that even the cheapest Chinese phone had. Now that banks started supporting Apple Pay, every single customer, including me, is paying Apple for the extra fees that banks need to pay to Apple for integration (because they're not allowed to charge Apple customers directly). I don't have any Apple decides whatsoever and so do most households I know of, yet we're all funding Apple's little money making scheme.
The benefit of Apple wallet is the same as the benefit for Google Pay and people still use that despite bank apps existing on Android. If Apple Pay is better, customers wouldn't install separate bank apps and banks still wouldn't have to make apps. The result: customers have more choice, but now the responsibility for not bringing features to users lies with the bank instead of Apple.
The real difference here is that Apple doesn't allow banks to compete on iOS devices because Apple wants a portion of all payments their customers make on their phones. No matter how fancy Apple's solution is, there's no excusing their anticompetitive restrictions on their app store from a consumer standpoint.
The only defences I can think of are "I don't use bank apps so I don't care", "I don't trust my bank to make software but I don't care enough to switch" or "It's technically not illegal in most countries", all of which are pretty bad excuses in my opinion.
* All iPhones with Face ID (23 models)
* All iPhones with Touch ID, except for iPhone 5s (33 models)
* iPad Pro (18), iPad Air (6), iPad (7), and iPad mini (8) models with Touch ID or Face ID
* Apple Watch Series 1 and 2 and later (20 models)
* Apple Watch (1st generation) (3 models)
* Mac models with Touch ID
* Mac models introduced in 2012 or later with an Apple Pay-enabled iPhone or Apple Watch
I don't understand this. If you can just add a credit card or a bank account via direct debit then why does Apple Pay require cooperation from banks at all? The primary reason why those banks want their own app is because Apple doesn't want to integrate them into Apple Pay.
It seems to be part of a multi-step key exchange mechanism [0] mediated by Apple but stored locally at either end, ensuring that Apple does not retain your card details at any step of the process. Of course, without bank participation, there aren't two parties to actually mediate between.
This is a common misconception. Every device receives a unique DAN, but when multiple transactions happen across time using the same device, the merchant will receive the same DAN.
This allows individual devices to easily be invalidated by the issuer, but it doesn’t really provide much privacy benefit from, say, merchants aggregating personal information based on your purchasing patterns.
If Apple Pay is so much better than what the banks offer (which it probably is), then there's no issue, people will continue demanding and using it. It will force Apple to improve their product over what the banks can do constantly and that's how we customers win.
> Their argument is that forcing them to allow other companies to implement parts of the system could compromise those advantages for consumers.
Why would that ever be the case? The demand is for Apple to extend that secure payment processing to other companies on their locked down platform, not to compromise their payment product.
Can you clarify? As far as I can tell, Apple Pay looks more or less like a regular credit card, and it even has a credit card number that apparently never changes. Plenty of merchant apps will recognize Apple Pay users because they once used it at a different merchant.
Security? The day Apple Pay prompts, on the phone, “authorize $X to merchant Y?” I’ll grant them a meaningful security improvements. Other than that, it’s just a contactless card with biometric authentication.
The credit card account number doesn't change but every time you use it, a new number token is generated and that is what the merchant sees.
The Device Account Number is different for every device, but it is the same for all vendors, unless reset by the issuer.
TechCrunch describes it this way:
> Apple provides a virtual card number and confirmation code (CVV) for the card in the app. You can use this for non-Apple Pay purchases online or over the phone. This number is semi-permanent, meaning that you can keep using it as long as you want.
> But you can hit a button to regenerate the primary account number, providing you with a new credit card number at any time. This is great for situations where you’re forced to tell someone your card number but do not completely trust the recipient.
Currently, I add my bank card to the Apple Wallet, tap my phone/watch on a terminal and payment goes through.
It's not entirely clear to me how this ruling will force Apple to 'improve their product' from a consumer point of view. I'm not even sure what it will achieve, other than perhaps forcing Apple to engineer interoperability with institutions that don't want to accept ApplePay restrictions on privacy or simple UI.
On Android my bank released their own app to process contactless payments. It works well and it's secure by all legal standards required here in EU. Even though Google doesn't support my region, payments work fine. This is an option that I want Apple platform to offer as well. Not that it's an OPTION - Apple Pay is still there and can still be supported and used by whoever. Noone is interfering with that.
More likely your bank won’t work with Apple because they don’t want to pay Apple a cut of the fees.
> Note that it's an OPTION - Apple Pay is still there and can still be supported and used by whoever.
It’s highly likely that if Apple opens up NFC access to bank apps, they’ll stop supporting Apple Pay and force you to use their app, so there won’t be an option.
So now it'll work because they can choose another processor which doesn't demand Apple's fees. That's how free market should work. If Apple provides value, then they'll keep using Apple Pay.
If anything, wouldn't being able to use an app specific to your bank remove one more middleman (Apple, Google, whoever) from the process?
Even if the bank itself doesn't sell data do Visa or Mastercard (or whatever company handles processing?) How about other entities, like retailers? Bank/debit cards can still be used to build a profile, no?
I don't mean to criticize your personal usage policies because I've largely come to accept that we can't avoid all risk of data theft or misuse as long as we're using electronic payment. I just think it's more complicated than "but Google, therefore selling data".
For my part, I try to limit the number of hands in the pot, so to speak. If my bank and the card processor and the seller get info, do I benefit from adding my device's OS maker to the mix? On Android I can choose to use my bank's app rather than Google's service if I want to avoid yet another potential for leaks or profile building.
I look at skipping Apple or Google Pay the way I look at skipping "loyalty cards" which offer some minor discount or convenience in exchange for another hand in the pot.
Oh?
I’m honest not sure if opening up the system would be a net benefit. There are certainly advantages to keeping it closed but we also miss many great opportunities with NFC because of that. I would expect Apple to open it up eventually, when users become used to using Apple Pay and expecting the same convinces from their bank app
I don't trust apple for that more than I trust my bank anyway.
Having worked for many banks, I’d advise you to reconsider that position.
As a customer, if I consider Apple Pay so much more convenient, I'll choose a bank which supports it. So banks are under pressure to either support Apple Pay, or create an equally customer-friendly offer.
If I consider another offer better for me, I will use their App instead of Apple Pay. So Apple can't just enjoy their monopoly, but is under pressure to be the best option for customers.
It’s most certainly not that simple. Anybody who wants to is free to compete with Apple, and many, many companies already do. But this is legislators dictating what 3rd party software Apple must support in its operating systems. Why stop there? Why not force Apple to support 3rd party providers as an alternative to iCloud? Why not mandate a 3rd party App Store? Why should Apple be allowed any control over which operating system or hardware features it exposes to 3rd parties at all? Why should Amazon be allowed to ship a kindle that only supports their book store?
And indeed, why not doing this for other closed ecosystems as well, if this is beneficial for the public?
If public benefit is your only concern, then why don’t you consider the benefit of closed ecosystems, or at least of consumers having the option to choose one? I don’t see any public benefit in removing options for consumers. If open ecosystems offer such a superior benefit to consumers, then surely they would be able to out compete closed ones.
Also, it needs to be balanced with the interests of the companies owning the ecosystem.
So it would be your turn now to argue why this specific law is harmful for the public. (We agree that it is harmful for Apple.)
How is it obvious? One could easily argue that because some hardware manufacturers make shitty drivers, opening up access will allow 3rd party developers to create better drivers, or something like that.
Apple Pay does exactly this. It’s called the Device Account Number.
Have you seen the marketshare of the iPhone in Germany?
When 80% of people are using a competitor to your product, it’s hardly a monopoly.
A monopoly is the control or advantage obtained by an entity over the commercial market in a certain area, who uses that advantage (willfully) to fix prices or exclude competitors. Granted, control or advantage of the market is a component, but what really makes a monopoly a monopoly is the intent behind the actions of the entity. If a memo, or meeting minutes were to come out showing that Apple was signing exclusivity agreements, or disabling payment apps on the iPhone (NFC) to specifically put competition out of business, well then that would be monopolistic.
By the way, even when this sort of behavior can skirt the law, it's still unethical. I'm not saying businesses need to actively support their competition, but seeking to put them out of business through backroom deals and price fixing is wrong. It's the antithesis of a free market and unfortunately is rampant in the tech industry.
I think people get confused because the way APIs work on Apple's platforms, effectively open to all subject to you agreeing to their license, that people don't realize there's no obligation for Apple to create APIs for anything. Literally every app or feature could be the result of one-on-one business development agreements.
Every platform has certain technologies it doesn’t allow competitors to access and have exclusive deals.
Should Apple be scrutinized because it harmed potential suppliers for its cameras and screens by making “exclusive deals” with Sony, LG, or Samsung for their respective components?
Apple is not “price fixing”. Price fixing is when competitors get together to “fix prices” not when one company gives another company a good deal to be the “exclusive provider of X”.
You could argue that the market should be "things that can be installed on smartphones" but that ignores that people with iPhones really need things that work on their devices. It's akin to saying that if one company had a monopoly on car tyres, it'd be okay because people could just replace their car and buy a tractor with tractor tyres instead.
Should every website and every web service also have a publicly accessible API? Do you want a government committee to decide when your service or software is interoperable enough before you can release it?
After an item is sold to a user, that item shouldn't be working to undermine the interests of its owner. Those interests include being a market participant for other products to use with it. If giving a user the option to eg change a data source or trust authority would be too much of a mandate for specific development, then manufacturers can just fall back to releasing the basic documentation that would allow straightforward re-implementation.
> Should every website and every web service also have a publicly accessible API?
Sure, why not? Anything a user can do, a program representing the user should be able to do. The alternative is computational disenfranchisement.
So McDonalds has a monopoly on hamburgers sold at McDonalds?
What market is Apple monopolizing here?
The critics of Apple Pay almost certainly haven’t used it on Mac, or Watch, because it’s pretty darned magical.
Competition? If we leave it to the banks we will have a slow, anti-privacy, insecure mess. I deal with banks in the cyber-resilience world, and these institutions do not have a clue.
Meanwhile we, the Apple clients are surprised why it took so long to pass this legislation. I still wonder why nothing is done against the appstore/google lock-in.
Here in Portugal, only one bank supports Apple Pay, and it's a small one (apart from N26/Revolut, the online ones). None of the bigger banks support it. Instead, they all support a national app that uses QR codes on iOS and NFC/QR on Android for payments (but its UX is much worse, even on Android where it uses NFC, and has a load of other problems - since it's properietary it doesn't work internationally, etc.). Of course, there is no Google Pay support at all here, and I blame the fact that NFC payments are supported on their own app. There's even less incentive for them to support Google Pay at all, and that's exactly what happened. I'm afraid that Apple Pay would be dropped if Apple was forced to open up NFC for payments.
Here's a lightly touched-up translation courtesy of deepl.com -- not sure if the references made it intact (and pretty sure the legalese didn't), but it's using "clause" to refer to the numbered sub-paragraph things:
§ 58a: Access to technical infrastructure services in connection with the provision of payment services or the conduct of electronic money business
(1) An enterprise which contributes to the provision of payment services or the operation of electronic money business in Germany through technical infrastructure services (system enterprise) shall be obliged, upon request of a payment service provider within the meaning of § 1 Clause 1 sentence 1 numbers 1 to 3 or of an electronic money issuer within the meaning of § 1 Clause 2 sentence 1 numbers 1 or 2, to make these technical infrastructure services available without delay and subject to reasonable fees and reasonable conditions of access. The provision within the meaning of sentence 1 must be designed in such a way that the requesting enterprise can provide or operate its payment services or electronic money transactions without hindrance.
(2) Clause 1 shall not apply if, at the time of the request, the system operator is not a company whose technical infrastructure services are used by more than 10 payment service providers within the meaning of § 1 Clause 1 Sentence 1 Nos. 1 to 3 or e-money issuers within the meaning of § 1 Clause 2 Sentence 1 Nos. 1 or 2 or which has more than 2 million registered users.
(3) In exceptional cases, the system operator shall not be obligated in accordance with Clause 1 if there are objectively justified reasons for refusing to make the service available. These are particularly present if the system enterprise can prove that the security and integrity of the technical infrastructure services is specifically endangered by the provision. The rejection must be comprehensibly justified.
(4) If a system enterprise culpably infringes clause 1, it shall be obliged to compensate the inquiring enterprise for the resulting damage. The ordinary legal process is given.
(5) The duties and responsibilities of the cartel authorities under the Act against Restraints of Competition shall remain unaffected.
Consumers don't see it, so this competition on iOS would benefit mostly banks if you think only about costs, but there is another side to this.
If my bank doesn't support Apple Pay, but supports Google Pay, then I can't use my iPhone to do payments because Apple prohibits Google Pay to access NFC.
that'd be ludicrous. I found a source that says 0.15% which is way more reasonable: https://www.macrumors.com/2014/09/12/more-apple-pay-details/
Small business would absolutely not be implementing this if the take was 10%
I love the EU and it's countries more and more for every news article like this.
Slovenia - Missing all of the biggest ones. None of the ones I use-used are on the list:
Nova Ljubljanska Banka - the biggest one SKB banka Abanka Sparkasse
And I have never heard of any on the list.
I mean in the UK, Tesco, the largest food retailer won't take Apple Pay because it doesn't give them enough data. Instead, if you want to pay with your phone over £30 you have to download their own damned app.
https://support.apple.com/en-gb/HT206637#Europe
Perhaps you live here: https://en.m.wikipedia.org/wiki/Principality_of_Sealand
Apple Pay adoption in banks (in EU at least) is much worse than Google Pay, so if I have account in bank that has only Google Pay I can't currently use iPhone to do payments.
It sounds like it forces Apple to open up the NFC stack to other applications?
Again, is there a statement from any of these smaller banks saying 'we'd love to have it but Apple won't let us'?
But saying Apple doesn’t care about smaller banks — that’s just a lie. Some of the smallest banks all across the US are using Apple Pay. It’s possible and probable that your bank just does want to offer Apple Pay.
Here is an interesting article from 2015 about banks and Apple Pay: https://www.bankdirector.com/issues/technology/becoming-an-a...
Please note the lack of “begging” involved in the process discussed in the article linked above.
Nah, that would just have opened the door for more lobbyism. Apple seems to have strongly worked against this law, seems like even the US ambassador was involved [0, about half way on the first page]. Looks like somebody hit a very sweet spot and an easy cash cow for Apple.
We need more open markets for processes like this. It's just fine that Apple has to open up.
[0]: https://www.heise.de/newsticker/meldung/Lex-Apple-Pay-Bundes...
I'm going to go out on a limb here and say the android alternative to apple pay has all the privacy costs of just using credit cards.
"The law became valid on 1 January 2008. Any communications data had to be retained for six months. On 2 March 2010, the Federal Constitutional Court of Germany ruled the law unconstitutional as a violation of the guarantee of the secrecy of correspondence.[41] On 16 October 2015, a second law for shorter, up to 10 weeks long, data retention excluding email communication was passed by parliament.[42][43][44] However, this act was ruled incompatible with German and European laws by an injunction of the Higher Administrative Court of North Rhine-Westphalia."
Or the planned road toll that is incompatible with EU law: https://www.bbc.com/news/world-europe-48674703
Given that Angle Merkal wanted it pulled (for good reasons) sounds like this was bounced though by either the greens or maybe by conservatives with input from the German backing sector