Hacker News Reader

Comment by sxates | Hacker News Reader

My Tesla app on the iPhone has an "Upgrades" page from the main menu, and on that page it offers to sell me a Full Self-Driving upgrade for $4000. There's a big Apple Pay button on the page to make the payment with a credit card. I'm not sure what happens when you click that, and given this person's experience I don't want to test it, but it seems like they made it pretty easy to spend $4k.

View on HN

I've "accidentally" purchased something with Apple Pay before. Not because I didn't want the item, but because I thought once you press "pay" it'd take you to a page to specify shipping address etc. no such thing – payment went straight through and they just assumed the shipping address was the same as for my Apple account. I don't know if this is the same with all Apple Pay purchases, this was my first time using it for anything physical and some place other than an Apple property.

There was no confirmation page, or any way to really regret the purchase (that I could find) other than contacting the seller, which I did to clear up the shipping snafu. (I still wanted the item, just not to that address.)

I've never opted for Apple Pay since, only ever just using card payments instead. It's marginally more involving when you've got cards setup with a secrets manager, but it's worth it to significantly reduce the risk of accidental purchase.

If the purchase flow in this case made use of Apple Pay than I for one find the "butt dial" explanation very plausible.

"I've "accidentally" purchased something with Apple Pay before. Not because I didn't want the item, but because I thought once you press "pay" it'd take you to a page to specify shipping address etc. no such thing – payment went straight through and they just assumed the shipping address was the same as for my Apple account. I don't know if this is the same with all Apple Pay purchases, this was my first time using it for anything physical and some place other than an Apple property."

Speaking as someone who temporarily changes addresses often, ew. That's not good.

It turns out you can go to https://applepaydemo.apple.com/ at the "Try it: ApplePayPaymentRequest" section and do a "Detailed Request" to try it for yourself.

I think it's really actually nice that everything is there on one page and consistent to your platform [1], but I can see missing it and moving ahead by mistake.

[1] Android supports this as well https://github.com/luruke/browser-2020#payment-request-api

That's a really nice link, thanks for sharing!

I made another purchase with the seller that I mentioned in my comment about the "accidental" purchase and verified that the shipping address was not part of the pay sheet, the way it is in the "detailed request" demo, so I guess they just haven't set it up right. I'm going to contact them with a link to that page and your comment so they know who to thank – hopefully they'll get around to fixing it! Thanks again for sharing!

https://github.com/luruke/browser-2020#payment-request-api

I had almost exclusively made purchases through apps for digital goods, but I was really surprised when I did it for the first time on a website for a physical good. The thumbprint or double-click/face scan should be a clue about money changing hands (also implying it's the final step), but I can see how a mistake gets made.

Absolutely. The purchase I made was some time ago so I had forgotten about the side button double-click which seems to be a requirement to approve the purchase. Being reminded of this makes the whole "butt purchase" explanation much less plausible to me, but of course that doesn't excuse crappy customer service in any way.

Rerouting packages paid by CC/online payment methods is a classic fraud, thus not letting you specify alternative address might be on purpose.

I don't think I've ever made a card purchase online where I wasn't able to specify a different shipping address than the billing address.

This is odd to me. The Apple Pay sheet does clearly show all the information being collected (credit card info, billing + shipping info) before you confirm. They didn't "assume" the shipping address was the same without telling you — it pre-filled the information and showed it to you before you checked out. Then you had to either enter your passcode or scan your face/fingerprint, which is a pretty big sign that something big is happening (incidentally, I have no idea how this could have happened inside Nassim's pocket).

No UI is 100% free of being misinterpreted by users of course. But I'm not sure the Apple Pay UI is to blame for either your mistake or Nassim's.

You're right about the passcode/fingerprint/face id authorization step – I think I forgot about that because double tapping the side button to approve is a simple and pretty forgettable action. This makes me think the whole "butt purchase defense" if you will is much less plausible to be honest.

That said, I did get fooled by the lack of shipping address information. It was my first ever purchase with Apple Pay (not including app store purchases, where shipping address doesn't matter much) and I guess I just assumed I'd be inputting shipping details in the next step. It was never displayed on the pay sheet, and I think this may be due to how that particular web shop is set up – you specify shipping details after inputting payment details, but only for card purchases, for Apple Pay it just gets your Apple data.

I actually verified this by making another purchase from them (wherein I had no need to change the shipping information) and it never displayed shipping details on the pay sheet. It did show card information though.

Either way, inputting card details is only marginally more involving when using a secrets manager so I'm just gonna continue to opt for that when possible. Fool me once, and all that.

> It was never displayed on the pay sheet, and I think this may be due to how that particular web shop is set up – you specify shipping details after inputting payment details, but only for card purchases, for Apple Pay it just gets your Apple data.

I've implemented the Apple Pay API in an iOS application, and there's no way to get shipping info without explicitly requesting it from the user. The only options I can think of are that:

1. If it's an app, it has access to your contacts, and it's finding your personal contact info and using that without asking you (seems unlikely for a bunch of reasons)

2. You've given the website your shipping information previously, and it's just remembering that

But there's no way for a website/app to just "get your Apple data"

Reply on news.ycombinator.com