Apple Pay’s long road to paying off is getting shorter
wsj.com
wsj.com
Having come into banking age with Apple Cash and a Chase debit card both in her Apple Wallet she treats that as first-party financial transactions and anything not tap to pay is written off as archaic.
I think kids growing will be happy without any physical cards and banking will all be app driven.
It’s only having grown up needing something to carry all my physical cards that I treat that as my primary wallet.
And I’m now Apple Pay first, and then keep a debit card, a credit card and my drivers license in a MagSafe wallet on my phone. Everything else is in a drawer at home.
Even specialist cards like ny health and transit FSA cards are in Apple Wallet. I can pay for NYC MetroNorth and MTA subway fares on an FSA card through Apple Pay which cuts down on the misc single use cards I’ve had to carry.
Even things like COVID ID are electronic in Apple Wallet.
It’s fantastic to cut it all down.
I assume you keep all of your money at home?
Oh, you keep it at the bank. And withdraw it using a plastic card? Well then.
I happen to have a second Apple device on me at all times: my watch. Risk of this happening is low. Still a risk though.
I do still keep around $100-200 worth of Danish Kroner in cash in my bag, however, and I almost never need it, but it’s nice to always have enough for a night in a hotel, a really long cab-ride or groceries for those times where the systems break down.
When I arrived to Germany two decades ago, living on digital payments (debit cards) was already common practice in Italy, Portugal, Switzerland and France, so it was kind of shock the money only culture around here, that is still quite prevalent.
Have you been in germany this year?
And dont even try using a card in a restaurant or a bar, the terminal always, and i mean always just happens to be "broken" at this particular time.
The solution is that you pay any of your disposable income to the government to compensate for this.
People in Europe tend to only use a credit card for online purchases outside of their own country; most people don't have a credit card at all. Online purchases tend to be done with national systems like the Dutch IDeal (this even works with large international shops like Amazon and Steam).
There is no difference between the mechanics of paying with credit card and paying with a debit card, at least none that I've ever noticed. I hold up my card to the reader and sometimes enter my PIN. I'm not even sure if there is a way for the person accepting the payment to tell if it's a credit or debit card I'm using.
I've seen Americans try to pay with a credit card in a supermarket in the Netherlands and have it fail.
I've had places fail to accept my Swedish debit card in the Netherlands. It's more to do with some places only accepting local cards or not accepting, for example, Master Card, rather than debit vs credit cards.
Maestro and Visa Electron are already or soon will be full discontinued. How can you even tell a debit and a credit card a part nowadays? The only distinction between my credit and debit Visa cards is a single word sign in a tiny font at the back (I live in a EU country).
So unless those Americans are trying to with Amex/Discovery/smth similar cards I'd find this really surprising.
Even a decade or two ago Germany was the only country I've been to where it was only possible to pay with these regional debit cards in some places. I really don't think this was an "Europe" wide thing for a quite a while now.
I don't know what the hangup is (maybe it needs to be reported to the Dutch government since it's obviously coming from a NL national?).
Until then, we'll have to keep using a low limit credit card or Paypal for many online purchases.
I also have a MagSafe wallet. But if Washington state would support digital driver licenses and Seattle metro had a wallet based transit pay app, I wouldn’t really need that either.
That's mostly valid for middle-class kids, but there's lots and lots of unbanked or "badly" banked (i.e. banking with what are basically pawnbrokers) poorer people, so cash going away or being tightly regulated will be a huge disadvantage for their kids going forward.
for the past decade most countries (china, india, brazil, eu, etc) have central bank issued APIs for instant payments.
without being a client of visa, apple, etc... anyone can instantly transter money around. some banks require an app, others allow via sms, etc.
the US seems like it is stuck in time, still swiping credit cards, and only having a glimpse of the world via toys their kids play with, until they are old enough to go back to the american way and start swiping cards.
Debit cards are practically never in my wallet unless I'm going out to withdraw cash. Way too risky to be carrying around a direct line to my primary bank account.
Gen Z's be like...
https://www.youtube.com/watch?v=OpYyFuHjdB0
I have kids who will be that age soon. Wondering how much more true this will be in the next 3-4 years.
As an explanation, there are two different things called "Apple Pay" in the US.
One is the use of the secure element/wallet in an iPhone/watch to store an EMV card that is tokenized. The other is the Apple branded credit card issued by Goldman Sachs.
Leaving aside the branded credit card, the Apple Pay process is a standard that Apple worked with Visa/MC (and Google and Samsung) to develop. Essentially, a customer of a bank enrolls their card into Apple/Google/Samsung Pay and there is a tokenization service that provisions the phone Secure Element with an EMV "application" and the tokenized card.
The card has a different number to the actual issued card, maintaining the first 6 (issuer ID) and last 4 digits of the issued card (CPAN - Customer Primary Account Number) to establish a "DPAN".
When the phone is tapped, as far as the reader is concerned, it is a standard EMV card. The reader will go through its standard business rules for floor limits, PINs etc and process the transaction.
The merchant only gets the "6+4" digits of the card, the DPAN is sent over the network to the tokenization service, which translates the DPAN to the CPAN and sends the transaction to the issuing bank for authentication and payment.
The lack of being able to get the "real" CPAN is why some US merchants still refuse Apple/Google/Samsung Pay, specifically because they lose the ability to track customers.
The problem in the US, is instead of going to "Chip + PIN" like the rest of the world, the US went to "Chip + Signature" which removes the benefits of Chip+PIN in terms of fraud reduction etc.
When I went to the US nobody seemed to understand this. Loads of shops would have a sticker saying "Apple Pay Accepted" or something, and when I took out my Pixel phone they would say, oh that isn't an iPhone that won't work. Of course, it worked every time because the card reader has no idea what brand of phone it is or if it's even a phone at all..
Even compared to a few years ago, contactless payments seemed way more prevalent and frictionless. In Amsterdam, on the advice of a local, I did buy a chip card for transit as systems are still in the process of switching but my understanding is various transit systems there and elsewhere increasingly let you just tap a contactless credit card.
It was pretty weird seeing Apple users around me get excited about finally being able to pay with their phones when the first bank here started offering Apple Pay. I guess they never noticed that every other brand of smartphone had been doing that for give years at that point?
As for the public transit system, the stupid mess of checking in and out at varioustterminals still exists, but they are indeed working on using bank cards for public transit. They're of limited use though (no ability to store discounts and such) and not all transit companies accept them yet. I'm not sure what the situation is with credit cards, as the Netherlands is very much debit card oriented. The cards follow the same standards, but as any American trying to do groceries here will find out, that doesn't mean all cards will work on all terminals.
I was told that and then I basically used nothing but my contactless credit card over the course of a week. But I was admittedly mostly in central Amsterdam and doing tourist stuff and restaurants.
A Dutch friend, who knows the industry a little, said that the Dutch banks had gone their own way with payment systems in the past. This heritage had taken some time to unwind. (I guess he was talking about things like Chipknip?)
Silly me at the time didn't realize I could go next door to Jumbo and pay with whatever the hell I wanted... live and learn!
If only Android had a way to pay if the phone was out of battery I could dump the cards entirely.
Perhaps at some point batteries will get so good that running out of battery just won't be a concern any more.
https://www.op.fi/private-customers/daily-banking/cards/card...
Other banks in Finland also offer the same loyalty card integration with their payment cards.
No idea how it works technically. I assume that it broadcasts the loyalty card and the debit card at the same time when you use NFC, since you can get both with one (long) tap against the payment terminal. It also reads the loyalty card if you use chip + PIN to pay. The loyalty card is completely separate from the actual payment card - if I use Apple Pay to pay with the same underlying Visa card, it will not give me any loyalty rewards.
I'm not sure if there's even an API to add store rewards cards as NFC cards, since all of my rewards cards in the Wallet are barcodes.
Apple Card was/is Apple's way to promote contactless EMV in the US, which in turn promotes use of Apple Pay on the phone/watch.
Apple Card is a US only thing though AFAIK.
Apple Card, with fewer than 7mm users, was launched half a decade after Apple Pay [1][2]. Apple sells over 200mm iPhones a year here. Apple Card was not a way to promote contactless payment, it's a margin play.
Its sole purpose is to be swiped. It's well made, but I don't think they want people using it.
No Apple Card is not called Apple Pay
Huh? I remember making contactless payments from my Samsung phone in the USA back in 2013 just fine. It had an unfortunate name at the beginning, but otherwise worked great.
> https://www.macrumors.com/2023/04/15/kroger-fred-meyer-apple...
Perhaps it's better to specify which parts of the world, I'm assuming you mean US and Canada versus Europe and China.
Meanwhile, most developing nations (which make up a majority of the countries in the world) still operate primarily on cash.
One additional thought: I now live in Europe, and use my contactless card for payments. However, sometimes it fails and I am required to use my chip and PIN. (I'm guessing because the bank thought the transaction needed additional security for some reason.) In this case, if I only had my phone, I would be stuck?
Apple Pay does not force the above, as you have already identified yourself via mandatory biometrics or device PIN.
Basically it references the purchase to your history and if there's something funky it forces you to re-auth.
Mostly happens to me on vacations and road trips when I pay in multiple locations 100s of km away from each other.
But I've never had to do it at my local grocery store(s), even though I might visit them multiple times a week.
"In a ‘card present’ scenario, the convenience of contactless at point-of-sale would remain, however customers will be asked to complete a Chip and PIN transaction when they reach the maximum total contactless spend, or have exceeded the card issuer's limits for consecutive contactless transactions since they were last authenticated." [1]
"When you spend around £100 in shops (across multiple payments, not just in one go) without having used Chip & PIN , we’ll do an extra security check by declining the next contactless payment and asking you to use Chip & PIN instead. " [2]
[1] https://www.barclaycard.co.uk/business/business-matters/frau... [2] https://monzo.com/blog/2019/09/11/strong-customer-authentica...
It is pretty annoying because there are a lot of terminals that don't have the PIN keyboard, e.g. on vending machines. If you card decides it needs PIN, you are not buying, unless you can sidestep it using a phone.
It doesn't seem to be universal though. I paid for multiple hotels in Europe (so hundreds of pounds/Euros) with contactless payments and--although I actually made a point of making sure my card had a PIN after a problem on my previous trip--I never needed it.
I think you have a very narrow view of "the rest of the world"! Try "Europe and East Asia" for a little more accuracy ;)
Went to a new city, one place out of the four I visited required a signature, the rest were fine with tap to pay/chip+Pin. Some places are fine until some arbitrary limit, etc. The place that made me sign? The purchases were $5-$6.
Contactless has different floor limits than Contact (chip). For example, in AU, the limit for contactless without PIN is ~AUD100. In the UK, I believe its GBP30.
If you tap for a payment over that limit, the reader will ask for the PIN.
The primary difference is that if a customer uses contactless/contact and PIN, then the risk of the transaction is passed to the network/issuer, instead of the merchant.
On some POSes, you can get a hint of when the POS either doesn't understand CDCVM or isn't configured to verify it when you tap with Apple Pay/Google Wallet and you get back a "Cardholder Device Not Verified" on the receipt.
Obviously ultimately, even with CDCVM support, it's up to how things are configured, but in the UK at least, every single POS I've seen that returns "Cardholder Device Verified" will let transactions through the same way as if you did Chip+PIN.
I've not found this to be the case anymore, sometimes the terminal will display a limit or the merchant will believe the limit applies to phones, but no limit is technically enforced.
Specifically, I believe this was due to Strong Customer Authentication laws in the EU: https://www.visa.co.uk/partner-with-us/payment-technology/st...
Not true, although shop keepers will often say it won't work, right up until I tap and it works
Americans don't want to punch in a PIN. We have more cards per capita and are habituated to the convenience of a swipe. (Unlike much to the world, our fraud risk sits almost entirely on the merchant side.)
Contactless had no hope with a PIN. Merchants catered to that despite higher cost and risk.
I’m not sure if it’s true for all EU countries and banks, but in general you don’t put in your PIN every time with contactless. The card usually works for a number of transactions without a PIN, often up to a certain limit, after which it asks you to insert it again.
As an American, I never get prompted in Europe for a PIN. Even for large transactions. That matches a swipe's convenience.
When Chip + PIN was introduced in the UK in 2003, people were widely concerned about the potential for inconvenience (entering a PIN takes longer than a swipe, the transaction might take longer to be processed, you might forget the PIN altogether).
In reality, fear outweighed the reality, the world carried on as usual and people adapted very quickly. It's now just totally normal here to enter a PIN and the average British person would feel far more inconvenienced if asked to sign for a transaction instead (which has become such a rare event here that the average person would be completely taken by surprise if asked to do so).
That was the whole point of moving to EMV, it removes the fraud risk from the merchant.
That's different to the charge-back risk, which is where the customer disputes the transaction itself.
In parts of the world where the consumer's bank bears the risk, and there is in imbalance between commercial and consumer banking, there is a powerful group--consumer banks--to apply pressure.
Sometimes that results in fewer consumer protections. In most: indirect pressure on merchants. (I can think of no country with an imbalance in favor of commercial banking with a strong consumer sector.) This state describes most of the world: optimized for cost reduction.
> That was the whole point of moving to EMV, it removes the fraud risk from the merchant
Who bears fraud risk varies.
In America, it was always the merchants. They have limited leverage over Visa and Mastercard. With the banks neutral and a valid competitor in American Express, there was nobody who wanted to anger consumers by taking away their swipes. (If you're that merchant, you're cash only.) So they optimized for purchasing convenience.
Australia is a cost optimizer. America a convenience optimizer.
Which, thinking about it, is exactly how it should be.
The closed circuit of chip reader and pin was always touted as super secure. Then suddenly, you could pay contactless with most cards regardless of the amount and enter the PIN. Too me this always seemed to subvert the "super secure" chip & PIN authentication.
It's a small "hardship", really. On small amounts contactless works just dandy and having to present the physical card to the chip reader for larger amounts makes me actually feel better.
Chip and Pin usually implies offline PIN. The terminal supplies the PIN, after a one-way transform of some sort IIRC* to the chip on the card, which then verifies it locally against a stored version of that same hash or whatever.
With contactless you're doing online PIN. The terminal applies a transform and some sort of asymmetric key encryption to the PIN, and this gets sent to your bank. There's nothing any less secure here.
(* I wrote an EMV 'kernel' a long, long time ago, in about 2002, and some more PIN block processing code about 8 years back. So it's been a while!)
There is very little difference in the process when using NFC, except that the power to the chip in the card is via the NFC field.
There are some changes to the business rules around processing contactless payments. Although the same floor limits for asking for the PIN for contact and contactless are pretty much the same these days.
It's this what makes HN still an outstanding resource and community.
Thanks!
What is secure is not about the communications, it's about what information is exchanged, how the dynamic CVV is generated and used, how the PIN is validated in a Chip+PIN environment.
The PIN pad, where you enter the PIN is just as secure using the contacts or contactless. The PIN doesn't leave the PIN pad in the clear.
there's a write up on this that i cannot find. the reason was actually that some criminal organization with ties to lots of political pacs had their money cow being fraud (or money laundering) on gas stations. so they forced gas stations to never update the pins for this very specific reason.
This is country-dependent; while this is the case in Spain, it's not the case in France, where the terminal will insist the card be inserted and the PIN entered.
Specifically: there’s a transit org (I’ve tried to reach them about this issue, to no avail) that lets you enter your (real, CPAN) credit card number on their public web site and get back your “own” (if it happens to be your card…) transit history i.e. the times when you tapped your iPhone/Android on their NFC/tap enabled turnstiles.
So, they /do/ seem to have a way to either get the CPAN when the card is tapped, or maybe they can tokenize the CPAN in the same way as the phone and then compare the tokens…?
I thought that could not be possible but it 100% works. To me it’s a huge security problem. But again, I have not heard back from them at all.
Do you understand how they do it? Thanks
1. How does "Express Mode" work?
"Express Mode" is using the NFC "card" without any smarts from the phone, which is why it works when the phone itself doesn't have power. This is also why "transit cards" work in Express Mode because they are just NFC cards, but with a different "app" on the card that supports different processes than an EMV "credit/debit" card. EMV cards are probably the "dumbest" smart cards out there.
So effectively, it is exactly like using a physical NFC card. The NFC field powers the card. The "card" in the wallet only has the DPAN, the CPAN is not stored or used at all after the card is "enrolled".
2. Online enquiries with my "real" CPAN?
In terms of that online enquiry where you are typing the CPAN into the website, under PCI rules, they are not allowed to see the CPAN outside of PCI scope, which has strict rules on how that information is stored and used.
They usually use a "transit acquirer" to process their EMV transactions. What this acquirer does is that it processes the EMV taps under PCI rules, but also provides the transit provider with: a) a "one way hash" of the card. This is unique to the CPAN, but unable to be reversed back to be the CPAN. b) the transit information related to the tap (eg station of entry/exit etc) c) the transit provider can store trip information against the one way hash.
So when you type in the full CPAN on the transit provider's website, that is securely (ie iframes and the like) sent to the acquirer, which sends back the one way hash. The same hash is used to identify the trips that the transit provider keeps info about.
So they aren't "seeing" the CPAN (at least if their PCI auditor is doing their job properly). What they "see" is the one way hash that they can use in their system.
It makes sense that hashing allows the transit provider to link the CPAN to the taps.
Having checked, the CPAN is not inputted via an iframe on the transit provider’s site - it’s sent via https, but directly to the site’s web host. Is that necessarily non PCI compliant (or only non compliant if they store it - which they might not)? Are there PCI bounties..?
My bigger problem with all of this is that someone who comes in temporary contact with a credit card can get that person’s transit history. Is that not a security risk?
You shouldn't be able to see anything about the DPANs except the 6+4 information though and perhaps some detail of which device it is on.
Transit providers are not allowed to use the EMV card purely as "identification".
I answered elsewhere on the thread about how the transit provider is able to use the EMV as an identifier after it has been used for payment, with a one way hash sent to the transit provider.
i’ve lived in several countries and used apple wallet in all of them + the us since 2012.
and my german bank only got a card available in wallet in 2021…
chip and sign is dumb, but nfc and apple wallet work just as well in the states as they do anywhere else.
I believe the point is that this change feels much more of a small increment elsewhere, because we've had modern payment systems for a while. NFC appeared in our cards without any significant change, because we had chip cards for decades before that.
> and my german bank only got a card available in wallet in 2021…
They probably didn't hurry because they had contactless payment long before that.
And Americans will typically try to cut it any number of ways that aren’t “the US is uniquely behind the times, given their wealth”.
The reality: When I was working retail, in 2010 mind you, customers would very routinely be surprised and annoyed by the fact that our store didn’t have terminals that accept NFC payments.
When Apple Pay came out in…2014? 2015?, all the American tech pundits were talking about it like it was futuristic alien technology.
I’ve spent exactly one week in the US, ever. I was in Seattle. If I used my card to pay for food at a restaurant, it was entirely common and accepted for someone to take my card, scurry away, and come back at some point with something for me to sign. Back home, they’ll bring me the terminal so I can just tap my card (or phone, or whatever), or they’ll do it for me in the case of a card, and that’s that.
It’s such an odd thing to get defensive about.
That makes no sense. Ive been doing contactless payment in the US long before apple Pay.
Pretty sure my Amex did it back in 2010?
A politically heated examples: if you go to the farthest village of Russia, where only poor people live(for example 12h drive from Irkutsk), you will be able to pay with contactless payments in their local store(before the war, you would be able to pay with Visa/Mastercard/Apple/Google/etc).
And in China you will be able to pay with qr codes based payments even to a homeless entrepreneur on the street, that tries to sell you selfmade slippers, or something like that.
What i know is that almost 50 (times flies, i originaly wrote 40...) years ago, my uncle worked a bit with secure terminals at a French company (forgot the name, but i know he lived in Spain for a while), then was yanked by a company that worked with American Express, took the Paris-NY Concord at least a hundred time to try to implement the same stuff he did in Europe in the US (chip + PIN), was distraught because the issue weren't technical and somehow transformed from engineer to executive, and ended up being an auditor for money laundering and fraud detection in major banks (received death threats and had bodyguards for a while).
Don't know if it is related, but the first time i went in the US i remembered some stories he told me about this American Express job and said to myself "Yeah, that checks out".
Yes, there is no reason to believe that the chip+pin is a technical issue, it's mostly business / political with lot of (financial) interests under.
Often policies like that are decided because of lobbying:
some people found large niches on how to make money, and they try to convince others to not change their habits even if the new system would benefit the masses (like the situation with the imperial system).
Just on the limits part; here in Ireland (and probably a good chunk of Europe) the limit on a physical card is around EUR50. But on Apple Pay (and probably other phone-based card payments that I have tried) that limit is removed... I have bought TVs (EUR500+) and put a deposit on a car (EUR1000) with Apple Pay and no issues. Some terminals do have issues (older ones that the store just couldn't be arsed updating have a max 50 limit, even on Apple Pay) but most do not have this issue.
Long story boring; there must be something somewhere that tells it the limit is increased. Also, the reason is the security Apple Pay and others give. You will have a very hard time explaining how someone got passed your face id for a payment...
And for most transactions it's just 'tap your card' (no pin), no need to have it in the phone.
Plus you have to carry around your cards.
When I'm not travelling for work, I only have my phone. No need for wallet, has drivers license, Medicare (AU), and my credit/debit cards in the Apple wallet.
I haven't used physical cash in AU except very rarely for about a year now.
Though I'd never travel without my wallet, I like having a backup plan if something happens to my phone
I still need to carry it when I'm driving, because our drivers licenses haven't been able to download to the Wallet yet, but once that happens, I won't need my physical wallet.
Also large retailers that "self-acquired" didn't want to invest in upgraded readers, or lose access to the card details.
Breaches like Target's where a bunch of actual CPANs and customer details were stolen started to force the US to upgrade. Enforcing PCI compliance of separation and encryption of CHI has also forced US companies and banks to upgrade.
Sorry, to clarify:
PII: Personally Identifiable Information (relates to GDPR etc)
CHD: Card Holder Data (relates to EMV etc)
CHD is a form of PII, but PII has greater scope.
You're incorrect about the 2nd. The 2nd "thing" is called Apple Card - most people know the difference.
I haven't been refused Apple Pay (ie, EMV) almost anywhere in the US unless that place simply only accepts cash.
Chip+PIN is the basis of contactless+PIN, same EMV standard, same stuff happens under the covers. Different business rules for merchant risk, chargeback etc
That doesn't happen with Apple Pay though, since it's an authenticated NFC payment. My (physical) Visa card has a 50€ contactless limit but with Apple Pay, I can just use it to the card's limits. I've paid for a 880€ MacBook with just tapping my Apple Watch against a reader.
As far as the reader is concerned, for contactless, there is no, as in none as in nada difference between a contactless payment with a physical Visa card, or a contactless payment using Apple Pay (or Google or Samsung Pay).
They are all "authenticated NFC payments".
It doesn't change the fact that the reader doesn't know if it's a phone or not, it's just a contactless payment standard
So there aren't "different limits" for Apple/Google/Samsung Pay compared to using your physical Visa/MC/Amex/Discover/etc card.
The iPhone 6S with Apple Pay came out in 2015.
> The lack of being able to get the "real" CPAN is why some US merchants still refuse Apple/Google/Samsung Pay, specifically because they lose the ability to track customers.
I don’t think I’ve been to many merchants that don’t take Apple Pay. One of the annoying ones is AMC movie theaters.
Contactless payment doesnt require a phone, the first contactless payment cards have existed since 2007 [1]
[1] - https://www.finextra.com/newsarticle/17411/barclaycard-rolls...
It's only the US as a major environment that has delayed (and delayed) applying the same rules, or that adopted Chip+Signature in the first place.
Apple Pay is quite the nice experience especial with the Apple Watch. It even getting out your phone is heavenly. Only thing I wish now is having to double-tap the button on my watch to initiate the process. Would to just hold it up.
> The lack of being able to get the "real" CPAN is why some US merchants still refuse Apple/Google/Samsung Pay, specifically because they lose the ability to track customers.
Looking at you, HEB
Privacy.com serves the purposes of a per-merchant PAN (read: credit card number) online without having to use apple pay.
So from Apple Pay wallet -> reader -> acquirer -> network -> issuer, the DPAN is used. When it reaches the issuer, the issuer detokenizes DPAN -> CPAN to process the request. When it responds, it retokenizes etc for the response.
It's hilarious (in a way) seeing EUians comment on Americans.
A cursory google search suggests that most HD stores do not accept it. There are some reddit threads about individual stores gaining support. Perhaps I lived in a test market?
Hopefully they rollout support soon!
American is the term Americans prefer, let’s try to be respectful.
Some people are trying to normalize "American" to mean anyone from North or South America, but the reality is, of course, that 99.9% of the time, American means people from the US.
Here we're talking about the difference between the card networks and merchant acquiring in the US vs elsewhere in the world.
Honestly United Statesian is more confusing because that ambiguously could refer to Mexicans.
It really sounds like you’re trying to troll and yeah people generally don’t like it if you intentionally get their nationality wrong.
This has been a common scenario for many countries and cities around the world, for a long time, before the MTA introduced it, with similar flawless execution. Just off the top of my head, London, Singapore, Sydney, Japan and South Korea.
I remember when Americans were initially hostile to NFC payments almost a decade ago, but I guess times change?
The new wave seems mostly driven by Stripe and Square being adopted by small businesses everywhere and supporting it out of the box, forcing the major retailers to finally catch up.
> Just off the top of my head, London
Transport of London used (and still does) Oyster Cards (contactless smart cards). when they switched the system to also support contactless credit cards all they had to do was flip a switch, the support was already baked in.
contactless credit card support on TfL started in 2012 and the full rollout was in 2014.
By using a watch or a card? A watch is 10x better than a card because it's always available, even when your hands are full.
On the London Underground since 2014 you can use any regular EMV NFC debit/credit card to tap in and out of turnstiles. Since Apple Pay just implements the EMV standard, it works just fine as well with any credit card you have added in there.
Note that I have no problem with others liking the watch. I just don't see what makes it so much more convenient than a phone. Curious what will pull me over.
iOS devices also have Power Reserve, which lets you use wallet and express transit for up to 5 hours even after your battery is out of juice.
https://www.idownloadblog.com/2022/01/13/apple-power-reserve...
What happens if your phone runs out of battery? Take out your tablet.
You can buy NFC rings these days
The awfulness of chip payments makes Apple Pay possible.
in the US, credit card companies continued to accept liability for magstripe transactions up until a couple years ago. i think it was an attempt to hold onto their absurdly high market share in the US - most other countries have higher debit card usage.
I’m curious what you mean by “worked better”? I haven’t used magstripe for a decade at least but can’t say I’m nostalgic for the experience.
[1] https://www.sej.co.jp/services/cash.html
[2] https://www.family.co.jp/services/payment.html
[3] https://www.lawson.co.jp/service/payment/settlement/index.ht...
[4] https://www.caa.go.jp/policies/policy/consumer_policy/meetin...
I get my wallet out, put it close to the ticket reader in any metro station, bus, tramway or trolley in the city, and it works just as flawlessly.
The only difference is between a wallet and a watch, which is a very tiny difference, IMO.
Hopefully, in Switzerland you don't need to tap/read a ticket before boarding any public transport, so it makes it a bit easier
If your savings are on Apple Wallet, you will be not switch away from an iPhone for many years. The average deposit duration is 7 years, used by banks to manage risk. This “lock” is better than any carrier 24-36mo agreement.
Healthcare obviously would be groundbreaking, if you depend on your phone for healthcare (it would be potentially life long…).
So regardless if they make money on these services, they’ll continue to make more money on devices.
A lot of people have multiple credit cards. Mobile payment means you can leave those at home. Credit card taps also don’t work 100% of the time. I’m sure everyone has had times when there’s something wrong with the terminal and you give it a second shot by inserting the card.
I've been trying to do this only to discover the location you need to tap is inconsistent and never clearly marked.
I usually try once then insert it in the slot.
I think my Android phone's NFC coil is smack in the middle, which requires moving my hand from a cupping to clawing hold while keeping the screen on and not touching it. Then slowly rubbing it around the POS terminal starting first with the Tap-to-Pay logo until the screen on my phone indicates it's talking.
Android manufacturers really need to work on the placement of NFC coils. Since cameras are on the top right corner of the phone, they should place the coils in the top left. I know Apple's coil is near the top but I've never used an iPhone for T2P so I'm not sure how much that improves the experience. Knowing Apple it's better, I can't imagine they could find a way to make it worse.
- Does not work with budgeting apps yet (Mint.com in particular)
- No web interface yet, no easy way to do transfers without your phone. Having my life savings tied to a phone... a bit odd. It's a regular ACH account, but it needs more conveniences around it that other banks already have.
I love my Apple Card. I'm a huge fan of their app-first approach for everything, but a bank account is different. It should be easily accessible from any device.
Other banks are doing this excellently and have been for years, just without the fantastic app factor. Discover Bank's savings is at 3.75%. Ally is at 4%. Both with good apps, decent web interfaces, work with budgeting apps, excellent support and high interest rates.
Personally I see it being tied to my phone as a positive, I don't really need to think all that hard about it, signing into an antiquated banking website, doing 2FA, etc etc etc.
Hopefully over time Apple adds these things, but they're certainly not a blocker for me.
That fantastic app factor goes a long way for me.
- I have far more faith in Apple's security model than a traditional bank's model.
- I assume Goldman Sachs has a decent policy for fraud/hacks (though someone can fact-check this).
- I'm not a millionaire, if I was I'd be using many different bank accounts, is someone going to exploit a likely-already-patched zero-day in one of the most locked-down operating systems to get my five-figure account?
Because if so, then any other online banking apps on the device aren’t safe. So just about equal security to any other mobile banking service.
Seems to be just transfers to an Apple Cash account, which is primarily used for free Venmo-like peer to peer payments. Venmo has a similar $20k limit. I think if you're trying to transfer this much money, there are plenty of other transfer methods available.
https://www.goldmansachs.com/terms-and-conditions/Deposits-A...
It is on the higher end compared to other HYSAs. The highest I've seen is 4.81% compared to Apple's 4.15, but that's still better than 3.x% offered by a lot of HYSAs. And of course it's better than the .35% average for regular savings accounts. [1]
> Why Apple is doing it at all?
It's another mechanism to lock people into their ecosystem. You won't switch to Android if you've got funds in an Apple savings account.
1: https://www.cnbc.com/select/best-high-yield-savings-accounts...
Goldman Sachs, the institution behind Apple's financial products, offers 3.90% APY to their Marcus clients, which is lower than Apples APY %.
Apple is providing APY bump to pump the market response to their product and the media coverage ("marketing expense"), which will then pump the stock at earnings, making everyone (execs) happy.
here in the real world, interest rates were increased, so all the high yield savings interest went up. mine is 3.5% w/ sally mae - like capital1's rate.
citibank is at 3.85 while discover is 3.75. less known ones like citbank are 4.75 and bask is 4.65.
apple is providing APY in response to the current interest rate, just like everyone else, and less than many others. it has nothing to with market response and media coverage, it has to do with Sachs being able to lend your savings back out as mortgages and loans an an increased rate. when the fed rate goes back down, so will all the rates offered by all the banks. this is literally how it does and always has worked.
the only thing apple is doing is inserting themselves between you and your savings account at sachs, for some god unknown reason.
Is there a way I can get rid of all my physical cards and have them securely on my iPhone without saving the details in cleartext in a note?
macOS: https://support.apple.com/en-gb/guide/safari/ibrw1103/mac iOS: https://support.apple.com/en-gb/guide/iphone/iphccfb450b7/io...
Both my banks have the card details behind the login screen (faceID or user/pass) to just open the app, and then a PIN to see the details, so it feels fairly secure.
My issue with Apple Pay is that it’s more tedious than just using a credit card. Especially with tap to pay, I can pull a credit card out of my wallet and tap it on the reader in a second or two. Apple Pay requires me to tap my phone to the terminal, hold it aligned to my face for a few seconds, maybe it will succeed or maybe I’ll have to redo it or type in my alphanumeric password, and I need to select the card I want which is a swipe and then another tap or two (it always assumes I want the default card, which is not always the case), and then I need to re-tap it on the terminal again. I also sometimes need to double tap the power button, but not always. And sometimes I accidentally turn it off when I am pressing the power button, and then I have to start over. I’ve tried it many times (at one point I had a business debit card that was shared among multiple people so we all just used digital copies of it), and it always feels awkward and time-consuming and like I’m holding up the line behind me. I really don’t understand the appeal.
Digital transit cards like the new digital wallet clipper card in the bay area are cool though. I definitely see the appeal of that. I happily used one for a few months, and then I upgraded to a new iPhone and it didn’t transfer over during the transfer process. Still haven’t figured out if it’s possible to transfer it over or not. So I tried signing up for a new digital clipper card, but I lost cell signal during the process, and now it’s stuck in some weird half signed up state where I paid $20 but the Apple wallet app won’t actually activate the card or let me start over. It’s been like this for a couple months now. So back to physical clipper cards for me.
Sometimes new technology is really just overcomplicating things.
I’m imagining you, from the description, holding the phone to the terminal then trying to frame your face so that Face ID can see it - which works, but is as annoying as you seem to be describing.
Great when you’re in self-checkout in a busy supermarket…
1. grab wallet from pocket, find card, align card to tap to pay target
2. grab phone from pocket, double tap phone side button while looking at it, align phone to tap to pay target
It also depends what you already have out. If you already have your wallet or phone out (wherever your store loyalty card is), that mode (wallet or phone) is that much easier
Since I got tap on my latest credit card I'm actually using it more than Apple Pay. Not because of convenience, but because there's zero reason for me to hand over my purchase information to Apple for free.
All that said, when I do use Apple Pay, I double-click the phone first to unlock the card and then tap the phone to the terminal. That sequence makes the whole thing much less awkward, because you don't have to click and make sure the phone can faceid-unlock while you're holding it in a weird angle on the terminal.
I would trust my data to Apple more than any other financial institution.
I've had cards with tap functionality since 2006 or so. And not any fancy card, my Amex Blue Cash has this in the late 2000s.
Ya, that’s why Apple Watches are so much easier for Apple Pay than using iPhones.
I don't mean to dismiss the attention to microseconds (I'm an advocate for continuous improvement, after all)... I'd just like to share this fresh/broad perspective.
Given the option between tapping a card, which Just Works, and fussing with Apple Pay that (in their experience) doesn't, the obvious choice is to not bother with using apple pay.
That's not to say that your perspective isn't informative, but rather that the original complaint likely comes from a place of social stress rather than fractional seconds being the issue.
If you're on Apple's ecosystem, and not using the watch, you're missing out. All of the criticism of walled gardens are certainly relevant, but even with the iPhone only (or, hey, when I forget to charge the watch for two days) I can do the same thing with the same double click and the extra step of FaceId-ing the phone.
Meanwhile card skimmers are no longer a fear, I don't have to put a zip code in to get gas in my car, and as a side benefit, most UI's on payment devices haven't figured out how to beg for tips with apple pay yet (yet). As I understand it the android experience is almost identical. I now only carry a single card, my debit card, which is a back up in case I really need cash for something and an ATM is my only option. I don't see anything inconvenient about that.
I have an amazfit bip with an e-ink screen that I last charged 27 days ago, still have 16% battery life, and it serves its main purpose of showing me notifications for my apps (mind you not all of them) and tracking my sleep and steps.
Face ID on the other hand works almost all the time, even with a face mask on (iPhone 13 and later only)
Until they say "oh yeah, today it doesn't work on Android".. or "it doesn't work on certain Androids"... what the actual fuck? San Francisco/Bay Area, tech capital of the world, can't get their shit transit's pass to be cross-platform?
A month ago, two Android phones that both work for everything possible in multiple EU countries, one just doesn't work for Clipper, trying to use the card says "invalid card". And of course there is no check before you add money to it, so you're stuck with money on the card you can't get out of without going to one specific office that might be able to help you (different people said different things)
Meanwhile over here in Europe we have to wait a couple of years for tech to come over, but when it finally does, it seems to work almost universally.
You'd expect that stuff managed in software would get its patches way before European implementations receive them in their improved form, but it's as if this stuff just gets rolled out once in the USA and then never gets looked after again. I'd be incredibly frustrated seeing other countries get some frustrating details right when the tech was invented in my own country!
Android lets you tap and pay without re-authenticating, I wish apple would allow the same.
Apple pay on the web is also very convenient, whenever I visit some cafe that has a QR code menu, it saves me entering in my card details.
I tap the side button twice, then enter a passcode whilst the cashier is scanning the items. I then scan my phone when it’s time. Maybe taking a card out is 3 seconds faster but I haven’t benchmarked.
Source on this very questionable statement?
I've seen people fiddling with their phones trying to pay for stuff, reminds me of the days when you'd get behind someone trying to write out a check.
> Sometimes new technology is really just overcomplicating things.
Wholeheartedly agree. There's nothing about paying for something at a point of sale that needs fixing with additional technology.
I’ve seen people fiddling with their purse/wallet searching for the right credit card, backing up the checkout line, while others breeze through with phones/watches that they already have in hand.
first thing I'd start is a public camera collecting face metrics and images, and then associating them with the iphone radio (plent to chose from) then criminals who steal a phone could buy the face unlock info after uploading a radio sample.