I get why the banks are not happy, but I can tell them that I am not going to use Chase Wallet, Bank of America Wallet, Citi Wallet...just pay the fee and be thankful for the reduced payment friction, which they invariably make money from. PS: Nobody is going to use Paze (yet another half baked wallet), other than to collect the free $10 to sign up for it.
Somewhat related, even Walmart relented and now supports Apple Pay/Contactless. Every big merchant has now relented (Kroger, Home Depot, Walmart).
This is the government's problem. I tend to be on the side of less government, but it is so obvious that payment facilitation should be a service provided by the government. The government is just allowing corporations to collect rents, because they are lazy and incompetent.
They’re more like taxes than rents. It’s a constant cost applied to all goods because of the ubiquity of use means we pay with or without playing the credit card/payments game.
This is fundamentally looking at it the wrong way.
Why do we need my bank to send money to your bank via Visa or the Federal Reserve or any such thing, instead of having my bank send money directly to your bank? All they need to do is both support the same openly specified protocol for transferring money.
It's not a government problem, it's a competition problem. Fundamentally 1-3% is actually a very competitive rate for organizing the easy transfer of money and handling fraud. Merchants would rather the cost be free, and banks may want a larger slice of the pie, but until someone comes up with a better way of paying money for both sides this is the best we have. If government got involved all that could happen is fees would increase and then we'd miss out on future efficiency improvements and savings.
> It points to Google's Android, which supports multiple wallets and does not collect a fee from card issuers for contactless payments. It suggests Apple would not be able to continue to charge "substantial fees" if it were forced to support other mobile wallets on Apple devices.
This described supporting multiple wallets, which I don’t care about. I don’t want multiple wallets, I want one wallet.
The phone holds on to a credit card number and some extra information. What service is happening here? Is Apple doing something meaningful every payment?
So it doesn't generate a second card number like other things I've used?
But anyway it sounds like the answer to my question is no, Apple is not doing anything meaningful per payment. They play a role in setting up a card and that's it. Is that accurate?
When you add a card, your bank creates a device-specific Device Account Number, encrypts it, and sends it to Apple w/ a key used to generate a unique sec code for each transaction.
Of course they are, passed on as increased prices for everyone, which is exactly the problem. Sure the banks here would like these fees gone, but it also hurts society in general.
Another alternative (in the US, at least) is tapping a piece of plastic instead of your phone and not inviting any of the tech giants into your transactions at all. What an unforced error, to shovel more of your data at them needlessly.
> is tapping a piece of plastic instead of your phone and not inviting any of the tech giants into your transactions at all.
Apple doesn't see individual transactions when Apple Pay is used at retail stores' tap-to-pay terminals. The secret card payment token is sent from the phone to the credit-card's issuing bank and bypasses Apple servers. In this way, using Apple Pay is more secure and private than plastic cards because the real card number details remains hidden from the merchant.
The iPhone does contact Apple servers to add a new card to the digital wallet. Apple servers then contacts the issuing bank to get the secret token the bank generates and then puts it in the digital wallet. Conceivably, the "add a new card to digital wallet" could also have been done without Apple in the middle but it would require a much more convoluted, less secure, and more user-hostile workflow to do it. (e.g. the end user would have to know what bank endpoint to contact, manually enter the long and cryptic digits of the secret token, or maybe scan a QR code on a computer screen that's vulnerable to interception and phishing.)
Importantly, this provides a degree of protection from compromised PoS terminals. Ever since I switched to nearly exclusively using Apple Pay for physical shopping I’ve had no unauthorized charges, whereas back when I was still tapping, inserting, or swiping my card I’d need to call and get a card or two replaced almost every year.
I’m not super familiar with the implementation details but wouldn’t inserting not be as safe since there’s a physical connection?
With tapping I could see how that is more secure but if they’re still providing the card details versus the secure token or something well… maybe it’s not?
Inserting and tapping is mostly the same process, apart from the physical layer of the protocol (NFC vs interfacing the chip directly).
Unless there’s a hidden magnetic reader in the chip-reading portion of the terminal, in which case the scammers could read like 1/3 of the magstripe data? Which doesn’t seem that useful tbh.
> Unless there’s a hidden magnetic reader in the chip-reading portion of the terminal, in which case the scammers could read like 1/3 of the magstripe data? Which doesn’t seem that useful tbh.
At least around where I am (Ohio, USA), at gas pumps and ATMs: Inserting the card for contact EMV typically means inserting the whole card.
In doing so, entire card is pushed all the way into the same slot that is also used for reading the magstripe, and to the same depth that is used for magstripe transactions.
This quality leaves the door open for magstripe skimming.
(It may be a stupid way of building things, but things exist in the real world that are built this way anyhow. Whether the information on the mag stripe still has any utility for a would-be thief in 2026 is a different matter.)
The credit cards, I believe, have pledged to eliminate magnetic stripes. Although given how long it takes us to do anything for all I know that will be by 2060. They are also planning to extend credit cards past 16 digits, which may also require the magstripe to go away.
Physical connection doesn't matter. This isn't a Hollywood movie, there isn't some mega-virus which magically seizes controls of trivial objects by passing through a connector.
All three modern technologies ("original" Chip & PIN, wireless or a phone) are basically the EMV protocol, which is a fairly crap protocol which wasn't reviewed by experts before deployment - but is at least designed by people who have heard about cryptographic security and wanted to do that.
The original credit cards are just numbers written on a card. Clerk sees your number, memorizes it, now they can make arbitrary transactions indistinguishable from yours. Basically no security.
Magnetic stripe cards look more sophisticated but the stripe is basically the same numbers again but in a way humans cannot read. "Cloning" is just a matter of a machine copying those numbers onto another card's magnetic stripe. There's no real security improvement, though it is more convenient for the bank...
EMV ("Chip and PIN") is rather more complicated and could in principle be entirely secure - they could make it implausibly expensive to "clone" an EMV card, and require that you actually know your PIN for every transaction, so then crooks would need to learn your PIN and have the actual card, and that's a high bar.
In practice we didn't do much of that because it would be inconvenient, and so there are technical deficiencies, but realistically that XKCD "wrench" thing applies. Difficult technological attacks rarely happen, crooks threaten to stab you if you don't co-operate or they break into your home and steal your stuff, they do not come up with breakthrough cryptanalytic attacks on protocols. Mostly.
There are two forms of wireless. The first was “magstripe emulation” and it’s exactly what you think it is. The card would hand over the exact data on the magstripe.
It’s also exactly as secure as you think: it’s not.
That hasn’t been used for a long time, and I don’t even think people accept it anymore. May not have for years. At least for credit cards. It’s quite possible that’s still how door access cards or maybe gym membership cards work. I don’t really know.
Everything now and for many, many many years, has been EMV over NFC. And you’re right on that one it is essentially identical to sticking your card in the EMV reader.
This information comes from the card issuer directly, after the transaction has completed. It usually requires the mobile banking app to be installed.
The wallet app has a way to get the information, but it’s not from the tap itself. The tap interaction is not able to provide this information back to the phone (because the transaction auth happens long after the tap interaction completes).
Taps are designed to work with fully offline devices (which is why you can tap a plastic card, it is powered by the card terminal for the duration of the tap only, and requires no online interaction)
> This information comes from the card issuer directly, after the transaction has completed. It usually requires the mobile banking app to be installed.
except of course it fucking doesn’t, I don’t have Chase or Amex apps on my phone… and yet my transactions are on my phone and watch and in a list inside my “wallet” and probably in the phone settings somewhere as well :)
> and yet my transactions are on my phone and watch and in a list inside my “wallet”
The list of transaction details you see in Wallet app didn't come from history collected on Apple servers. Instead, the Wallet app is just showing cached recent transaction data that came from the cards' issuing banks.
iPhones can be offline with no internet, no cellular, and in airplane mode and Apple Pay can still be used for tap-to-pay. Same as a plastic credit card with NFC chip on a that's not connected to the internet. That wouldn't be possible if credit-card transactions required routing through Apple servers (requires internet) so they could record all their users credit transactions for data collection.
Seeing transactions on your iPhone Wallet app isn't proof that Apple is inserting itself in between all your credit card usage and collecting data. Likewise, seeing a list of "Recents" in the Files app of previously opened files isn't proof that Apple servers have a list of every filename you've opened on the iPhone.
Man, its amazing how confident you are about this, considering I know individual people who independently work at Visa, Mastercard, AND Apple, who have worked on mobile payments who independently confirm that none of them know any personal info and that its all pass-through.
So, are you sure you know what you are talking about?
This kind of appeal to authority [believe me because I say so!] doesn't really add much information, does it?
The report, above, is that previous transactions are visible within Apple's payment app. Apple agrees[1]. I'm willing to accept that this observation is based on reality and that it is reported in good faith.
Meanwhile, the suggestion is that Apple has no knowledge of transaction history.
Is there a way in which these two seemingly-conflicting concepts can be constructively combined into an understandable whole?
This is baffling, there's all sorts of information on my phone that Apple has zero knowledge of, why would the transactions be different?
Do you think Apple has complete copies of everything? I don't understand where this supposed contradiction is supposed to exist, unless you think that Apple has complete knowledge of all phone contents, which would require complete ignorance of the entire platform.
> This is baffling, there's all sorts of information on my phone that Apple has zero knowledge of, why would the transactions be different?
It's kind of unique. It involves finances, and reporting transactions, and it involves their app with their branding that runs on hardware that they unilaterally control. They apparently even take cut from the middle of each of these transaction.
If Apple does all of this with zero knowledge, then I am willing to accept accept that...
> Do you think Apple has complete copies of everything? I don't understand where this supposed contradiction is supposed to exist, unless you think that Apple has complete knowledge of all phone contents, which would require complete ignorance of the entire platform.
...but I'll only accept it if the functional operation can be explained.
This kind of non-explanatory browbeating doesn't further my understanding of anything at all. I have never endeavored to undertake a faith-based approach to understanding technology, and I'm certainly not going to begin doing so today.
Yeah. But this is the US. This is all we’ve got. Having the central bank do it would be communism, and that’s bad. I learned about it from Saturday morning cartoons.
Ironically it's the central bank (and associated regulations) that cause these intermediaries to exist to begin with.
A protocol to support decentralized payments is a hobby project for an individual. You give each institution an identifier (e.g. their domain name) and each institution gives each customer an account number. If you're account 123 at Chase then you sign in as #123@chase.com, tell Chase you want to send $5 to #456@bankofamerica.com, they send the money and Bank of America tells their customer they have a new deposit. If you want to collect money from someone, you tell your bank to send their bank a payment request and they can either approve it manually (e.g. so you can deliver the goods for a one-time purchase) or configure some rules for which accounts get approved automatically up to some threshold amount (e.g. for recurring payments). Also no reason for banks in different countries not to all support the same protocol.
That doesn't require a central bank or any centralized third party payments intermediary. All it requires is for banks to know how to send money to other banks, which they obviously already do and the specific implementation of that isn't even relevant to the customer-facing payments protocol. So how does this not exist? It can't be that no one wants it, so it's got to be that someone (e.g. Visa/MasterCard) doesn't want it.
Zelle, from my understanding, is a “protocol” – many banks support it in their own apps. (Scare quotes because I’m not entirely sure it’s a proper well-defined protocol.)
And there’s nothing preventing PoS from supporting individual wallet apps – see e.g. WeChat Pay / Alipay in China. (Alipay+ is also a “protocol”, i.e. other banks and wallets support it.)
yea, feels like tech giants do not have access to this already? they know where you are and what you do every second of every day, keeping away from ( while they know I was a target ) what was the amount on my receipt is really giving it to them :)
How about Chase continues to eat shit on that 0.15% extra profit they really want to capture, but aren’t owed… and everyone else goes on with their day?
Remember CurrenC? The thing a bunch of them tried to make that failed horribly during test with no consumers liking it? If I remember a description it involved using an app where you had to scan a QR code, and then the point of sale terminal had to scan a QR code on your phone or something like that.
It was all so hilariously badly designed compared to tap and pay.
I took great joy in watching its downfall. It also only worked with debit cards, meaning you didn’t get the buyer protections you use from buying things on a credit card.
CurrentC was designed to collect all your transaction info so that its owners could analyze your buying habits. I’m delighted that not-CurrentC won that war.
(I personally use Apple Pay, but my understanding is that Google Pay has the same privacy advantages for end users. Both of them are light years ahead of the other boondoggle.)
Yeah, but it meant they didn’t have to pay credit card fees. And isn’t that what’s really the most important thing here? Lol.
As far as I know, the current Google Pay is identical to Apple Pay: it’s just EMV tap-to-pay. So it would be the same protections. Samsung pay too.
It was kind of neat that Samsung had that thing for a short while that would somehow trick the magstripe reader in a POS terminal by blasting magnetic fields at it to think that you had swiped your card.
I think there was a different one before that that was not, but I’m also pretty sure that’s long gone. And I think it was more like Apple Pay on the web, where it was really for paying in a non-card environment. But I’m not an android person, so I’m not sure.
I don't really care about any of Apple's business partners being upset about their business terms with Apple. Developers want a bigger cut, banks want a bigger cut, Foxconn wants a bigger cut.
My interests as an Apple user are aligned with Apple. But even if I wasn't an Apple user, market forces determine what the "fair" cut is for everyone.
Probably, but there is an upper limit on what people will be able to tolerate, everyone is aware of it and capitalism is trying to make products that meet it.
So, it’s not unlimited cost here.
The fact right now is that handling cash is more expensive than handling card- even with the fees, which is why Sweden, Estonia etc; are essentially cash-free countries.
At some point the fee’s will make you break-even I guess?
Another argument for turning finance into a public utility. Instead we have different factions of rentier capital competing for who gets to parasitize us.
"My short term convenience trumps all" is why everything sucks and we have far worse short and long term convenience and efficiency in everything. Thanks for that.
I won't use $bank-wallet either but that's a seperate issue which is that the bank is not really any better than Apple or PayPal or anyone else. The only reason they "fight" Apple tax is because they want to do $bank tax.
Walmart only relented because they finally broke through the final missing link of the contactless issue. They got customers conned into giving their phone numbers at checkout, just like it's the grocery store.
Cards get linked to accounts automatically behind the scenes based on first6/last4 card number tracking, then everyone else self-selects to punch their phone number on the screen.
Same reason Walmart Radio is such gruesome auditory cancer, it's part of the data collection and advertising vehicle.
That could be part of the reason, but also I think insisting on chip all this time just really slows down a store that doesn't really spend on cashiering all that much. Tap to pay can shave off a few seconds on every transaction (ever been behind someone in the store who finally pulls out their wallet, finds the business end of their card, inserts it, waits 20 seconds...).
Millions of transactions a day, over thousands of stores, it can make a huge difference in time saved.
This is even worse now that tap to pay has proliferated. Customers who are not Walmart regulars (and some that are) will wave their credit card, phone, or watch over the terminal and wonder why it’s not working.
Cashier must explain: No tap. Best case is the customer shrugs and inserts card. Bad case is the customer is confused or argues about it. Horrible case is that the customer must fish through his belongings for a credit card or cash and takes minutes to realize he has neither.
I guess Walmart figured that these scenes repeating daily was not worth whatever its strategy was.
> Tap to pay can shave off a few seconds on every transaction
I don't really get how this can be possible. A person can definitely get their card out of their wallet in less time than it takes the cashier to finish scanning their items.
Obviously if the customer is confused then it can take arbitrarily long, but how is a phone less confusing than a card? People don't get to the register only to realize that their card's battery is run down or it's the first time they've used a phone for payments and then they want to stand there for 15 minutes in front of you trying to set it up.
It is estimated Apple Pay does anywhere between $5T to $10T transaction per year. That is everything from Credit Card to Debit Card. If we average out at 0.1% per transaction over $5T, that is $5B per year.
The transaction itself doesn't touch any Apple severs. In case anyone is wondering if there is an operational cost. There is a set up cost though with the initial verification and sometimes Apple do charge a one time fee per card set up.
There is a privacy angle with using Apple Pay. But I am unsure how much info banks and network is not getting because of it.
Retailers may get less than using their own app, but I agree I don’t really see how it affects the processors or the banks.
However Apple is providing something in all this. Apple Pay requires biometrics which (in theory) should help lower fraud costs for everyone. So it’s not like they’re just rent seeking for nothing.
I don’t know how it went for everyone else, but I don’t remember tapped pay getting popular until after Apple Pay and Apple pushing it. I know that coincided with when EMV terminals really started to get popular because the credit card companies were forcing it. But I honestly wonder if they helped push it to the mainstream, even for people just using tap cards.
> but I don’t remember tapped pay getting popular until after Apple Pay and Apple pushing it
It's regional—tap with cards was fairly popular in Canada before Apple Pay came along, but every time I visited the US I remember being surprised at how many retailers supported only the magnetic stripe.
I know it was in Europe FAR before the US too. I’m speaking from a very US centric perspective as that’s all I personally experienced.
No one wanted to put on EMV terminals because they didn’t want to pay the upgrade cost. Even if they bought them because they were the only thing, they wouldn’t turn any of the EMV stuff on. You still did everything like 1995. It was the liability shift that finally forced people to start. And that coincided well with Apple Pay. Which obviously was planned by Apple.
I also remember people hating it and trying to avoid it because it was so slow early on.
On the other hand, a lot of places that supported tap to pay didn’t even know. Lots of times when I started using Apple Pay I got confusion from the person checking me out. “What did you do, how did you pay” or “I didn’t know you could do that”. Multiple times retailers I used it at stopped taking it later. I assume they found out people were using it and freaked out because they didn’t know it was on.
There are still lots of retailers where the signs don’t say you can use it, or even the screens on the terminals, but it works fine. It’s still kind of mess but it generally works almost everywhere.
Pix and the other variants are the way to go for money transfer, it's just that these monopolies won't be happy to forfeit their easy money, both credit, banks as well as Apple. They are all fighting for monopolies, they must cease to exist for the good of the common folk.
Well, fortunately Pix is statedriven/stateenforced/strateregulated, so it contains some of the most important ingredients to become some type of standard - the only reason why Mastercard et.al. are so powerful is because this area/field of tech was long no recognised as critical/relevant enough.
Pix is doing exactly the right thing, as ECB/SEPA is as well.
Totally, and hopefully if standardisation isn't possible that we will at least see some form of integration between these systems, even if under an international transaction fee.
The national co-integration is actually not a problem,asmost modern stacks are build on ISO20022 mainly, to the basis for co-integraion exists. Its just that attention on these topics is not that big. You could easily connect Brazil to the ECB with a correct setup.
I find this technology fascinating, I'm looking for different fields to apply myself to, if there's job openings for developing Pix here in Brazil I think I'll look into the tech more carefully.
> Apple has changed its policies since the lawsuit was filed. As of iOS 18.1, developers are able to offer NFC contactless payments in their apps.
The lawsuit was files in 2022, and apple opened access to the NFC chip in 2024 (iOS 18.1). Searching I could find alternative wallet apps that offer contactless payments, but only in EEA, eg [0, 1, 2]. It is supposed to be accessible in the US, but I am not sure why there are no apps there, unless I have missed them.
IANAL but if access to NFC is open since 2024 and (assumingly) the amount banks etc pay for apple pay has not really decreased, wouldn't that mean that their main argument is not really substantive?
Initially I was casually (didn’t dig into the issue) fine with Apple allowing only a single access to payment via NFC due to the opportunity for fraud, which was Apple’s justification.
But I haven’t heard of it happening with the wild-west Android NFC payments, much less widespread problems with the essentially unconstrained use of QR code payments on SE Asia (e.g. Alipay).
So as an iPhone user I’m happy for Apple’s lockdown going away. I just hope it doesn’t mean that in future I’ll need to install a dozen payment apps and have to figure out which when I buy things.
What the banks want, and all the other financial institutions want is a free ride on someone else’s technology, without paying for it and it’s ironic because the Apple Pay system was only created by Apple because all of the other existing financial institutions believed at that time that the Apple ecosystems was too small to support, but once it became successful, all of a sudden they wanted in and cried foul to government to help them out.
If the banks win and other stuff is allowed on the iPhone, that’s fine.
I have no intention of using it. I have a feeling it’ll be crap. That’s how this stuff usually is. And I’m absolutely not going to use a different app for each card.
So I wonder if this will end up being a Pyrrhic victory.
The only time the People have anything in our sick phony republic protected is when their interests happen to coincidentally align with those of an adversarial oligarch. Not interested in digging through the 15 layers of competing interests, corporate spin, lies, and economics to determine if that’s the case here but it’s sad in any case that stories like this are the only hope we the People have of getting any crumbs out of this system.
I get why the banks are not happy, but I can tell them that I am not going to use Chase Wallet, Bank of America Wallet, Citi Wallet...just pay the fee and be thankful for the reduced payment friction, which they invariably make money from. PS: Nobody is going to use Paze (yet another half baked wallet), other than to collect the free $10 to sign up for it.
Somewhat related, even Walmart relented and now supports Apple Pay/Contactless. Every big merchant has now relented (Kroger, Home Depot, Walmart).
This is the government's problem. I tend to be on the side of less government, but it is so obvious that payment facilitation should be a service provided by the government. The government is just allowing corporations to collect rents, because they are lazy and incompetent.
They’re more like taxes than rents. It’s a constant cost applied to all goods because of the ubiquity of use means we pay with or without playing the credit card/payments game.
This is fundamentally looking at it the wrong way.
Why do we need my bank to send money to your bank via Visa or the Federal Reserve or any such thing, instead of having my bank send money directly to your bank? All they need to do is both support the same openly specified protocol for transferring money.
That's what Brazilian pix does and the reason visa/Mastercard and the US government want to kill it
Listen to the Visa episode of The Acquired Podcast, and you'll change your mind.
We used to call those checks!
It's not a government problem, it's a competition problem. Fundamentally 1-3% is actually a very competitive rate for organizing the easy transfer of money and handling fraud. Merchants would rather the cost be free, and banks may want a larger slice of the pie, but until someone comes up with a better way of paying money for both sides this is the best we have. If government got involved all that could happen is fees would increase and then we'd miss out on future efficiency improvements and savings.
> Fundamentally 1-3% is actually a very competitive rate for organizing the easy transfer of money and handling fraud
This is a very US-centric take. In the UK, EU and Australia, interchange rates are capped at more like 0.2/0.3%.
That actually proves the point, because a market left to itself arrives at 2-3%, and it only goes lower if the government is dictating a rate.
A duopoly is not "a market"
What you are missing is that a market left to itself is not necessarily competitive when monopolies/duopolies form.
Proves what point? GP was saying the government would only increase fees.
0% because it’s a service that’s so obviously should be provided by the government is better.
Having been a customer of a government run postal bank, I'm going to hard disagree.
Or Apple Pay can just be like Google Wallet is on Android? The alternative is not multiple apps.
There is already apple wallet where i can put any of my banking cards…
Not "any". The bank themselves need to partner with Apple Pay and presumably pay Apple the percentage cut from the article.
if apple wallet works on android and I have a choice, that's competititon
if apple wallet requires apple phone, and google wallet require android phone, that not competition.
competition is good. no competition should be regulated out of existence.
I have used both but I dont know the difference
How does it work on Google Wallet?
Article says Google wallet works just like Apple Pay, except they don’t charge a 0.15% fee.
Do you mean this part?
> It points to Google's Android, which supports multiple wallets and does not collect a fee from card issuers for contactless payments. It suggests Apple would not be able to continue to charge "substantial fees" if it were forced to support other mobile wallets on Apple devices.
This described supporting multiple wallets, which I don’t care about. I don’t want multiple wallets, I want one wallet.
Why shouldn’t Apple be able to make money for the service they created?
The phone holds on to a credit card number and some extra information. What service is happening here? Is Apple doing something meaningful every payment?
The phone doesn't store your card number. Apple brokers a token at setup, secures it on-device, and manages it afterward (suspend, re-issue).
So it doesn't generate a second card number like other things I've used?
But anyway it sounds like the answer to my question is no, Apple is not doing anything meaningful per payment. They play a role in setting up a card and that's it. Is that accurate?
When you add a card, your bank creates a device-specific Device Account Number, encrypts it, and sends it to Apple w/ a key used to generate a unique sec code for each transaction.
And is that information stored on the phone? Do Apple's servers need to be running for me to make a purchase?
A service for whom? It has already been paid for by the users when they bought the iPhone.
Users aren’t paying the fee though
Of course they are, passed on as increased prices for everyone, which is exactly the problem. Sure the banks here would like these fees gone, but it also hurts society in general.
That’s true of any cost that any company pays for any service.
Another alternative (in the US, at least) is tapping a piece of plastic instead of your phone and not inviting any of the tech giants into your transactions at all. What an unforced error, to shovel more of your data at them needlessly.
> is tapping a piece of plastic instead of your phone and not inviting any of the tech giants into your transactions at all.
Apple doesn't see individual transactions when Apple Pay is used at retail stores' tap-to-pay terminals. The secret card payment token is sent from the phone to the credit-card's issuing bank and bypasses Apple servers. In this way, using Apple Pay is more secure and private than plastic cards because the real card number details remains hidden from the merchant.
The iPhone does contact Apple servers to add a new card to the digital wallet. Apple servers then contacts the issuing bank to get the secret token the bank generates and then puts it in the digital wallet. Conceivably, the "add a new card to digital wallet" could also have been done without Apple in the middle but it would require a much more convoluted, less secure, and more user-hostile workflow to do it. (e.g. the end user would have to know what bank endpoint to contact, manually enter the long and cryptic digits of the secret token, or maybe scan a QR code on a computer screen that's vulnerable to interception and phishing.)
Importantly, this provides a degree of protection from compromised PoS terminals. Ever since I switched to nearly exclusively using Apple Pay for physical shopping I’ve had no unauthorized charges, whereas back when I was still tapping, inserting, or swiping my card I’d need to call and get a card or two replaced almost every year.
> Ever since I switched to nearly exclusively using Apple Pay for physical shopping I’ve had no unauthorized charges
BIN attacks [1] are still a thing. Your banks are probably just better at blocking them.
[1] https://stripe.com/en-sg/resources/more/what-are-bin-attacks...
Inserting and tapping is just as safe.
Swiping is where the risk is.
I’m not super familiar with the implementation details but wouldn’t inserting not be as safe since there’s a physical connection?
With tapping I could see how that is more secure but if they’re still providing the card details versus the secure token or something well… maybe it’s not?
Inserting and tapping is mostly the same process, apart from the physical layer of the protocol (NFC vs interfacing the chip directly).
Unless there’s a hidden magnetic reader in the chip-reading portion of the terminal, in which case the scammers could read like 1/3 of the magstripe data? Which doesn’t seem that useful tbh.
> Unless there’s a hidden magnetic reader in the chip-reading portion of the terminal, in which case the scammers could read like 1/3 of the magstripe data? Which doesn’t seem that useful tbh.
At least around where I am (Ohio, USA), at gas pumps and ATMs: Inserting the card for contact EMV typically means inserting the whole card.
In doing so, entire card is pushed all the way into the same slot that is also used for reading the magstripe, and to the same depth that is used for magstripe transactions.
This quality leaves the door open for magstripe skimming.
(It may be a stupid way of building things, but things exist in the real world that are built this way anyhow. Whether the information on the mag stripe still has any utility for a would-be thief in 2026 is a different matter.)
The credit cards, I believe, have pledged to eliminate magnetic stripes. Although given how long it takes us to do anything for all I know that will be by 2060. They are also planning to extend credit cards past 16 digits, which may also require the magstripe to go away.
Physical connection doesn't matter. This isn't a Hollywood movie, there isn't some mega-virus which magically seizes controls of trivial objects by passing through a connector.
All three modern technologies ("original" Chip & PIN, wireless or a phone) are basically the EMV protocol, which is a fairly crap protocol which wasn't reviewed by experts before deployment - but is at least designed by people who have heard about cryptographic security and wanted to do that.
The original credit cards are just numbers written on a card. Clerk sees your number, memorizes it, now they can make arbitrary transactions indistinguishable from yours. Basically no security.
Magnetic stripe cards look more sophisticated but the stripe is basically the same numbers again but in a way humans cannot read. "Cloning" is just a matter of a machine copying those numbers onto another card's magnetic stripe. There's no real security improvement, though it is more convenient for the bank...
EMV ("Chip and PIN") is rather more complicated and could in principle be entirely secure - they could make it implausibly expensive to "clone" an EMV card, and require that you actually know your PIN for every transaction, so then crooks would need to learn your PIN and have the actual card, and that's a high bar.
In practice we didn't do much of that because it would be inconvenient, and so there are technical deficiencies, but realistically that XKCD "wrench" thing applies. Difficult technological attacks rarely happen, crooks threaten to stab you if you don't co-operate or they break into your home and steal your stuff, they do not come up with breakthrough cryptanalytic attacks on protocols. Mostly.
There are two forms of wireless. The first was “magstripe emulation” and it’s exactly what you think it is. The card would hand over the exact data on the magstripe.
It’s also exactly as secure as you think: it’s not.
That hasn’t been used for a long time, and I don’t even think people accept it anymore. May not have for years. At least for credit cards. It’s quite possible that’s still how door access cards or maybe gym membership cards work. I don’t really know.
Everything now and for many, many many years, has been EMV over NFC. And you’re right on that one it is essentially identical to sticking your card in the EMV reader.
Or (common in the US) handing your card to a restaurant waiter who walks off with it to do the charge
All EMV transactions (including Apple Pay in a tap to pay scenario) don’t give the retailer the full card number.
don’t be silly, apple displays me exact amount on the screen, in plain fucking text, after each transaction - that’s crazy you wrote this
This information comes from the card issuer directly, after the transaction has completed. It usually requires the mobile banking app to be installed.
The wallet app has a way to get the information, but it’s not from the tap itself. The tap interaction is not able to provide this information back to the phone (because the transaction auth happens long after the tap interaction completes).
Taps are designed to work with fully offline devices (which is why you can tap a plastic card, it is powered by the card terminal for the duration of the tap only, and requires no online interaction)
> This information comes from the card issuer directly, after the transaction has completed. It usually requires the mobile banking app to be installed.
except of course it fucking doesn’t, I don’t have Chase or Amex apps on my phone… and yet my transactions are on my phone and watch and in a list inside my “wallet” and probably in the phone settings somewhere as well :)
> and yet my transactions are on my phone and watch and in a list inside my “wallet”
The list of transaction details you see in Wallet app didn't come from history collected on Apple servers. Instead, the Wallet app is just showing cached recent transaction data that came from the cards' issuing banks.
iPhones can be offline with no internet, no cellular, and in airplane mode and Apple Pay can still be used for tap-to-pay. Same as a plastic credit card with NFC chip on a that's not connected to the internet. That wouldn't be possible if credit-card transactions required routing through Apple servers (requires internet) so they could record all their users credit transactions for data collection.
Seeing transactions on your iPhone Wallet app isn't proof that Apple is inserting itself in between all your credit card usage and collecting data. Likewise, seeing a list of "Recents" in the Files app of previously opened files isn't proof that Apple servers have a list of every filename you've opened on the iPhone.
Man, its amazing how confident you are about this, considering I know individual people who independently work at Visa, Mastercard, AND Apple, who have worked on mobile payments who independently confirm that none of them know any personal info and that its all pass-through.
So, are you sure you know what you are talking about?
This kind of appeal to authority [believe me because I say so!] doesn't really add much information, does it?
The report, above, is that previous transactions are visible within Apple's payment app. Apple agrees[1]. I'm willing to accept that this observation is based on reality and that it is reported in good faith.
Meanwhile, the suggestion is that Apple has no knowledge of transaction history.
Is there a way in which these two seemingly-conflicting concepts can be constructively combined into an understandable whole?
[1]: https://support.apple.com/en-us/104954
(For my part, I've never used Apple Pay and it's possible that I never will. I do not have a dog in this race.)
This is baffling, there's all sorts of information on my phone that Apple has zero knowledge of, why would the transactions be different?
Do you think Apple has complete copies of everything? I don't understand where this supposed contradiction is supposed to exist, unless you think that Apple has complete knowledge of all phone contents, which would require complete ignorance of the entire platform.
> This is baffling, there's all sorts of information on my phone that Apple has zero knowledge of, why would the transactions be different?
It's kind of unique. It involves finances, and reporting transactions, and it involves their app with their branding that runs on hardware that they unilaterally control. They apparently even take cut from the middle of each of these transaction.
If Apple does all of this with zero knowledge, then I am willing to accept accept that...
> Do you think Apple has complete copies of everything? I don't understand where this supposed contradiction is supposed to exist, unless you think that Apple has complete knowledge of all phone contents, which would require complete ignorance of the entire platform.
...but I'll only accept it if the functional operation can be explained.
This kind of non-explanatory browbeating doesn't further my understanding of anything at all. I have never endeavored to undertake a faith-based approach to understanding technology, and I'm certainly not going to begin doing so today.
people will people :-)
That is much better, but you're still paying visa/mastercard some percentage fee for a service which should be provided by e.g. the central bank.
Banks in the Netherlands used to have their own system for 30 years. It was free. It worked.
But it was too much work and didn't make the banks money so now we are also left to the American Visa parasite.
Yeah. But this is the US. This is all we’ve got. Having the central bank do it would be communism, and that’s bad. I learned about it from Saturday morning cartoons.
Ironically it's the central bank (and associated regulations) that cause these intermediaries to exist to begin with.
A protocol to support decentralized payments is a hobby project for an individual. You give each institution an identifier (e.g. their domain name) and each institution gives each customer an account number. If you're account 123 at Chase then you sign in as #123@chase.com, tell Chase you want to send $5 to #456@bankofamerica.com, they send the money and Bank of America tells their customer they have a new deposit. If you want to collect money from someone, you tell your bank to send their bank a payment request and they can either approve it manually (e.g. so you can deliver the goods for a one-time purchase) or configure some rules for which accounts get approved automatically up to some threshold amount (e.g. for recurring payments). Also no reason for banks in different countries not to all support the same protocol.
That doesn't require a central bank or any centralized third party payments intermediary. All it requires is for banks to know how to send money to other banks, which they obviously already do and the specific implementation of that isn't even relevant to the customer-facing payments protocol. So how does this not exist? It can't be that no one wants it, so it's got to be that someone (e.g. Visa/MasterCard) doesn't want it.
The banks all got together and created Zelle, so it exists. No Visa/Mastercard conspiracy needed.
Zelle is an app rather than a protocol, which is why e.g. PoS terminals and web checkouts don't support it.
Zelle, from my understanding, is a “protocol” – many banks support it in their own apps. (Scare quotes because I’m not entirely sure it’s a proper well-defined protocol.)
And there’s nothing preventing PoS from supporting individual wallet apps – see e.g. WeChat Pay / Alipay in China. (Alipay+ is also a “protocol”, i.e. other banks and wallets support it.)
yea, feels like tech giants do not have access to this already? they know where you are and what you do every second of every day, keeping away from ( while they know I was a target ) what was the amount on my receipt is really giving it to them :)
A possible compromise is to allow Apple Pay to be a monopoly as long as it doesn't charge any fees.
How about I do you one better compromise: create a payment network that don't rely on private institutions rent seeking behavior, like Pix in Brazil.
How about Chase continues to eat shit on that 0.15% extra profit they really want to capture, but aren’t owed… and everyone else goes on with their day?
Remember CurrenC? The thing a bunch of them tried to make that failed horribly during test with no consumers liking it? If I remember a description it involved using an app where you had to scan a QR code, and then the point of sale terminal had to scan a QR code on your phone or something like that.
It was all so hilariously badly designed compared to tap and pay.
I took great joy in watching its downfall. It also only worked with debit cards, meaning you didn’t get the buyer protections you use from buying things on a credit card.
CurrentC was designed to collect all your transaction info so that its owners could analyze your buying habits. I’m delighted that not-CurrentC won that war.
(I personally use Apple Pay, but my understanding is that Google Pay has the same privacy advantages for end users. Both of them are light years ahead of the other boondoggle.)
Yeah, but it meant they didn’t have to pay credit card fees. And isn’t that what’s really the most important thing here? Lol.
As far as I know, the current Google Pay is identical to Apple Pay: it’s just EMV tap-to-pay. So it would be the same protections. Samsung pay too.
It was kind of neat that Samsung had that thing for a short while that would somehow trick the magstripe reader in a POS terminal by blasting magnetic fields at it to think that you had swiped your card.
I think there was a different one before that that was not, but I’m also pretty sure that’s long gone. And I think it was more like Apple Pay on the web, where it was really for paying in a non-card environment. But I’m not an android person, so I’m not sure.
Now do developers.
I don't really care about any of Apple's business partners being upset about their business terms with Apple. Developers want a bigger cut, banks want a bigger cut, Foxconn wants a bigger cut.
My interests as an Apple user are aligned with Apple. But even if I wasn't an Apple user, market forces determine what the "fair" cut is for everyone.
granted i am a bit of schadenfreude at the thought of poor poor megabanks having to pay....fees...
Ultimately it comes out of their customers’ wallets.
Probably, but there is an upper limit on what people will be able to tolerate, everyone is aware of it and capitalism is trying to make products that meet it.
So, it’s not unlimited cost here.
The fact right now is that handling cash is more expensive than handling card- even with the fees, which is why Sweden, Estonia etc; are essentially cash-free countries.
At some point the fee’s will make you break-even I guess?
n
Another argument for turning finance into a public utility. Instead we have different factions of rentier capital competing for who gets to parasitize us.
>Another argument for turning finance into a public utility
There already is a public option in the US, FedNow. In EU there's SEPA instant.
Not quite. FedNow is public payment infrastructure for institutions. Apple Pay is consumer-facing.
I would use my non-profit credit union Wallet if it meant less fees on their end.
"My short term convenience trumps all" is why everything sucks and we have far worse short and long term convenience and efficiency in everything. Thanks for that.
I won't use $bank-wallet either but that's a seperate issue which is that the bank is not really any better than Apple or PayPal or anyone else. The only reason they "fight" Apple tax is because they want to do $bank tax.
Walmart only relented because they finally broke through the final missing link of the contactless issue. They got customers conned into giving their phone numbers at checkout, just like it's the grocery store.
Cards get linked to accounts automatically behind the scenes based on first6/last4 card number tracking, then everyone else self-selects to punch their phone number on the screen.
Same reason Walmart Radio is such gruesome auditory cancer, it's part of the data collection and advertising vehicle.
That could be part of the reason, but also I think insisting on chip all this time just really slows down a store that doesn't really spend on cashiering all that much. Tap to pay can shave off a few seconds on every transaction (ever been behind someone in the store who finally pulls out their wallet, finds the business end of their card, inserts it, waits 20 seconds...).
Millions of transactions a day, over thousands of stores, it can make a huge difference in time saved.
This is even worse now that tap to pay has proliferated. Customers who are not Walmart regulars (and some that are) will wave their credit card, phone, or watch over the terminal and wonder why it’s not working.
Cashier must explain: No tap. Best case is the customer shrugs and inserts card. Bad case is the customer is confused or argues about it. Horrible case is that the customer must fish through his belongings for a credit card or cash and takes minutes to realize he has neither.
I guess Walmart figured that these scenes repeating daily was not worth whatever its strategy was.
> Tap to pay can shave off a few seconds on every transaction
I don't really get how this can be possible. A person can definitely get their card out of their wallet in less time than it takes the cashier to finish scanning their items.
Obviously if the customer is confused then it can take arbitrarily long, but how is a phone less confusing than a card? People don't get to the register only to realize that their card's battery is run down or it's the first time they've used a phone for payments and then they want to stand there for 15 minutes in front of you trying to set it up.
It is estimated Apple Pay does anywhere between $5T to $10T transaction per year. That is everything from Credit Card to Debit Card. If we average out at 0.1% per transaction over $5T, that is $5B per year.
The transaction itself doesn't touch any Apple severs. In case anyone is wondering if there is an operational cost. There is a set up cost though with the initial verification and sometimes Apple do charge a one time fee per card set up.
There is a privacy angle with using Apple Pay. But I am unsure how much info banks and network is not getting because of it.
Retailers may get less than using their own app, but I agree I don’t really see how it affects the processors or the banks.
However Apple is providing something in all this. Apple Pay requires biometrics which (in theory) should help lower fraud costs for everyone. So it’s not like they’re just rent seeking for nothing.
I don’t know how it went for everyone else, but I don’t remember tapped pay getting popular until after Apple Pay and Apple pushing it. I know that coincided with when EMV terminals really started to get popular because the credit card companies were forcing it. But I honestly wonder if they helped push it to the mainstream, even for people just using tap cards.
> but I don’t remember tapped pay getting popular until after Apple Pay and Apple pushing it
It's regional—tap with cards was fairly popular in Canada before Apple Pay came along, but every time I visited the US I remember being surprised at how many retailers supported only the magnetic stripe.
I know it was in Europe FAR before the US too. I’m speaking from a very US centric perspective as that’s all I personally experienced.
No one wanted to put on EMV terminals because they didn’t want to pay the upgrade cost. Even if they bought them because they were the only thing, they wouldn’t turn any of the EMV stuff on. You still did everything like 1995. It was the liability shift that finally forced people to start. And that coincided well with Apple Pay. Which obviously was planned by Apple.
I also remember people hating it and trying to avoid it because it was so slow early on.
On the other hand, a lot of places that supported tap to pay didn’t even know. Lots of times when I started using Apple Pay I got confusion from the person checking me out. “What did you do, how did you pay” or “I didn’t know you could do that”. Multiple times retailers I used it at stopped taking it later. I assume they found out people were using it and freaked out because they didn’t know it was on.
There are still lots of retailers where the signs don’t say you can use it, or even the screens on the terminals, but it works fine. It’s still kind of mess but it generally works almost everywhere.
I hope we get tap to pay on GrapheneOS in the US soon. You can already use it in the EU with Curve and PayPal. It's a blocker for a lot of people.
Hacker News seems generally not interested in private payments or how terrible the banking system is, which is disappointing.
https://eylenburg.github.io/payments.htm
There's walt, which will be launching soon.
https://walt.is/
Dunno if my comment updated, but it's actually walt.
https://walt.is/
Pix and the other variants are the way to go for money transfer, it's just that these monopolies won't be happy to forfeit their easy money, both credit, banks as well as Apple. They are all fighting for monopolies, they must cease to exist for the good of the common folk.
Well, fortunately Pix is statedriven/stateenforced/strateregulated, so it contains some of the most important ingredients to become some type of standard - the only reason why Mastercard et.al. are so powerful is because this area/field of tech was long no recognised as critical/relevant enough.
Pix is doing exactly the right thing, as ECB/SEPA is as well.
Totally, and hopefully if standardisation isn't possible that we will at least see some form of integration between these systems, even if under an international transaction fee.
Working in this field:
The national co-integration is actually not a problem,asmost modern stacks are build on ISO20022 mainly, to the basis for co-integraion exists. Its just that attention on these topics is not that big. You could easily connect Brazil to the ECB with a correct setup.
I find this technology fascinating, I'm looking for different fields to apply myself to, if there's job openings for developing Pix here in Brazil I think I'll look into the tech more carefully.
> Apple has changed its policies since the lawsuit was filed. As of iOS 18.1, developers are able to offer NFC contactless payments in their apps.
The lawsuit was files in 2022, and apple opened access to the NFC chip in 2024 (iOS 18.1). Searching I could find alternative wallet apps that offer contactless payments, but only in EEA, eg [0, 1, 2]. It is supposed to be accessible in the US, but I am not sure why there are no apps there, unless I have missed them.
IANAL but if access to NFC is open since 2024 and (assumingly) the amount banks etc pay for apple pay has not really decreased, wouldn't that mean that their main argument is not really substantive?
[0] paypal @germany https://www.macrumors.com/2025/05/13/paypal-contactless-paym...
[1] curve pay @eu(?) https://www.macrumors.com/2025/05/23/curve-pay-launches-ipho...
[2] Vipps mobilepay @norway https://vippsmobilepay.com/en-NO/news/2024/12/09/vippsmobile...
How come my MasterCard is only a MasterCard. We need to sue them! It should be an Visa and an IKEA card too!
The irony of them bitching about fees. They make billions off of charging fees to the low income. F*ck them.
Initially I was casually (didn’t dig into the issue) fine with Apple allowing only a single access to payment via NFC due to the opportunity for fraud, which was Apple’s justification.
But I haven’t heard of it happening with the wild-west Android NFC payments, much less widespread problems with the essentially unconstrained use of QR code payments on SE Asia (e.g. Alipay).
So as an iPhone user I’m happy for Apple’s lockdown going away. I just hope it doesn’t mean that in future I’ll need to install a dozen payment apps and have to figure out which when I buy things.
What the banks want, and all the other financial institutions want is a free ride on someone else’s technology, without paying for it and it’s ironic because the Apple Pay system was only created by Apple because all of the other existing financial institutions believed at that time that the Apple ecosystems was too small to support, but once it became successful, all of a sudden they wanted in and cried foul to government to help them out.
If the banks win and other stuff is allowed on the iPhone, that’s fine.
I have no intention of using it. I have a feeling it’ll be crap. That’s how this stuff usually is. And I’m absolutely not going to use a different app for each card.
So I wonder if this will end up being a Pyrrhic victory.
The problem is if merchants stop accepting Apple Pay or any other privacy-supporting payment system.
I can stop shopping at places that decide to make it hard for me. It’s easier than ever to find someone else willing to sell me the same thing.
Especially since no one sells unique stuff anymore, it’s mostly the same discount crap from China. So it’s not like I can’t get it elsewhere.
https://whatispix.com/
The only time the People have anything in our sick phony republic protected is when their interests happen to coincidentally align with those of an adversarial oligarch. Not interested in digging through the 15 layers of competing interests, corporate spin, lies, and economics to determine if that’s the case here but it’s sad in any case that stories like this are the only hope we the People have of getting any crumbs out of this system.
Absolutely true…