Hacker News Reader

Comment by detaro | Hacker News Reader

TL;DR:

Apple wanted getting on Apple Pay to be as easy as possible. Banks decided supporting Apple Pay was more important than being able to implement good fraud protection. Banks now have to deal with a magnitude higher fraud rates.

View on HN

Are these particularly high fraud rates for NFC transactions, though? Or online transactions? Or even telephone (as in reading one's card number out loud) transactions?

I would imagine that anything abstracting the physical card away ends up with a significantly higher fraud rate, but the only numbers we're given are for Apple Pay specifically and for all credit card transactions in total.

Online and phone transactions require shipping a product. Being able to walk out with the stolen products is much more practical.

Flashing an iPhone provides social engineering cachet in the sorts of small businesses that will implement Apple Pay. "You take Apple Pay, I have an iPhone, we are brothers of another mother."

Regular NFC(Visa PayWave/Mastercard PayPass) are limited to a certain amount per transaction(25 pounds in UK, not sure how much in US), and you can only do 5 until it asks for your PIN. So there is simply very little incentive to be stealing NFC data for those systems,because you can't use it to steal high-value items. With Apple Pay, you can pay for anything, and there is pretty much no verification. You can use any card number to purchase items in stores,so there is nothing stopping you from using a stolen card to walk out of Wallmart with a $1000 TV.

no verification?

Apple Pay requires Touch ID on use.

Yes, but the verification is tied to the phone, not the card. The way this fraud works is that fraudster has their "own" iPhone, then "loads" single or multiple stolen card details (perhaps obtained by mail intercept / redirect of new or reissued cards). The beauty of this from a fraudsters perspective is that you could have a whole deck of cards (all associated with different providers and individual victims) in your Appple Pay wallet and if one gets declined, well, cycle to the next. It's not like the teller sees the card name, just a secondary wave of the (apparently) legitimate customers phone. It's a beautifully anonymous customer journey for a fraudster in any busy physical retail environment.

Edited for grammer

Interesting. In Australia, I think the limit is $50 (which is about the same in pounds) but there's no entering your PIN number every 5 transactions.

This is in the country that has the highest adoption of contactless payments.

Last I checked the limit was now $100, or could be different per provider. I have been asked for my pin on some occasions, mainly when doing a large transaction (IIRC).

I know PNC requires a phone call to activate your PNC Debit / Credit cards on Apple devices.

Sure it takes more time (a phone call to a rep during business hours) but I'm willing to bet that their fraud is much, much lower.

Reply on news.ycombinator.com