Just in case there hadn’t already been enough evidence of Apple Pay support coming to the iPhone 6 and 6 Plus in the iOS 8.1 update, the second beta of the operating system, which was released earlier today, contains the setup screen for the system. The change isn’t visible to most users right now, but Hamad Sood been able to make it appear:
[tweet https://twitter.com/hamzasood/status/519675092867899392 align=’center’]
Sood has also found the Apple Pay setup screens that will show during the initial setup of a new device running iOS 8.1:
[tweet https://twitter.com/hamzasood/status/519694507885879296 align=’center’]
Whether a future beta will enable Apple Pay for all developers or Apple will wait until the public release to activate the feature is still unknown, but progress is being made toward its inclusion. Apple Pay will be included in Passbook and support NFC-powered payments through the iPhone 6, iPhoen 6 Plus, and (eventually) the Apple Watch.
FTC: We use income earning auto affiliate links. More.
Can’t wait to test Apple Pay :)
It’s October, Aplle Pay comes out in October this is not news.
Nobody here or on any site has mentioned what I see as a major security flaw of Apple Pay and the Autofill settings of a Safari for credit cards. You hand your card to a waitress they pull out their iPhone and use Apple Pay or the Autofill setting to scan your card with the iPhone camera. It takes just a few seconds. Now they can go use their phone and pay with Apple Pay or online with the credit card Autofill or soon Apple Pay via supported apps.
There needs to be a verification of your card instead of simply using the iPhone camera to load your card. Needs to verify zip and last 4 of social.
Even if Apple or Visa knows the phone through the token process it still makes it easy for someone to rack up charges on your card.
Don’t quote me on this but I’m almost positive that there’s a verification process for each card you enter. I believe once you scan the card in, two small charges (temporary) hit your card and you need to verify those charges by logging in to your credit card’s website.
Not sure about the charges, but Apple has 100% confirmed there is a verification process. They described it as “verifying with your bank”, whatever that mean. As far as auto fill goes, that risk has existed way before the iPhone or auto fill ever existed. I work in retail, and I know how easy it can be to present a fraud credit card, especially online.
There is no authorization for scanning the card through the Safari Autofill setting. You can all test it by going to Safari in Settings and go to Passwords and AutoFill saved credit cards and then after you enter pin click add card and click use camera.
The verifying with your bank probably means veryfying if its a valid card not a security question.
taoprophet420 – Autofill is a simple, client-side feature. It would be the same as the “waitress” writing the card number and expiration dates down on a notepad (or her Notes app!) This is nothing new since the beginning of password managers, the only difference is that it saves you from having to copy and paste the card number into the fields for you. Apple Pay on the other hand is a feature which is being supported by the payment card networks themselves. They would not lend their support to the feature without there being actual verification (via putting trial authorizations on your card, most likely).
Also, think about this. If most people are using Apple Pay or other non-antiquated means of paying, that means less need to hand over your card to a waitress. I can’t wait to see magnetic cards go the way of Betamax! Visit Canada sometime and see how they pay for a check at a restaurant. The waitress brings you a little wireless terminal, you stick your card in and type your PIN and choose a tip, it prints a receipt. Much faster than the US custom, too, I might add.
Panic after you see Apple Pay having that flaw, not before.
AutoFill already has the flaw. I’m not panicking I’m just trying to bring awareness and discussion.
You are an absolute idiot if you think that’s how the process works.
Apple already has a verification process in place, and there’s several hoops card holders have to go through in order to verify the card it’s theirs.
Learn how the process works before trying to bait people into believing your nonsense.
It’s how it works. Manually entering a card had no verification to see if the card is yours and neither does using the camera.
Thanks for calling me an idiot fuck wad. I have tried cars that belong to family members with using the camera in the safari Autofill setting and it ads the card no problem.
He’s talking about two different things. One is Apple Pay and the second is Autofill. Autofill does not verify that the card actually belongs to you. It’s no different than stealing someone’s card and using it at different merchants. Safari isn’t the only one that does it, Google Chrome works the same way. His comment tries to include Apple Pay with the “no verification” flaw, when no one really knows right now how Apple is going to verify the card actually belongs to YOU yet.
Yes Robert I’m making an assumption that Apple Pay will not use verification like AutoFill. I’m doing so to bring awareness to it and for discussion.
It isn’t a question I heard asked anywhere of Apple. I seen one person ask about verification in 13 page discussion in a Macrumors forum about Aplple Pay.
People loose their wallets and misplace their cards. If you can simply launch Passbook or a security preference on an iPhone and use the camera to scan the card details without verification, then go use Apple Pay at an NFC terminal it leads to security questions.
Will Apple or Visa store the token information of the phone used for the transaction.
How will fraudelnt charges be handled by the banks?
omg taoprophet420 you are being intentionally dense. If you lose your wallet the finder doesn’t need an iPhone to charge on your cards, he has your cards themselves!! Autofill doesn’t store anything more than the information printed on the card. That can be copied just as effectively with a pen and paper as well. This is why using a card online (Card Not Present) typically requires a matching billing address or at least ZIP, which generally wouldn’t be known by a fraudster who has stolen a credit card or copied its number or (for some silly reason) added it into his own AutoFill.
Apple Pay on the other hand will be like a “Card Present” transaction, which normally requires the CVV1 code (http://en.wikipedia.org/wiki/Card_security_code ) which is only stored on the magstripe, not printed on the card. Because adding the card to AP will require verification (which has been already announced so quit your trolling) and using it also requires that the phone has been unlocked with phone passcode or Touch ID), this provides even more assurance of authenticity than a transaction made with the physical card.
Watch this keynote of Apple Pay amongst many other things…jump forward to 48 minutes and 40 seconds and you’ll get your answer: http://www.apple.com/live/2014-sept-event/
Is there a possibility that passbook knows your Name and compares it with your credit card? I mean it scans the data and Name is also on the card. My iPhone knows who I am (contacts). Can it be as simple as that?
Do you think the big banks and credit card companies want to have huge number of fraught lawsuits?
It works with cards that are not yours in the current Safari AutoFill settings with the camera. Will it change with Apple Pay i don’t know. But, currently as implemented it has huge potentials for fraud. Like I said a waitress or anyone that has access to your card can pull out their phone have settings open and scan your card in matter of seconds.
Add in tokens and it might be hard to track fraud with Apple Pay via In store payments and apps that will support paying with Apple Pay.
Thats the thing. No one knows right now with Apple Pay. For all we know it will verify against your Apple ID and several other items (SSN, DOB, etc). It may even take a page out of PayPal’s book and have you login to verify your account. We will all find out in due time.
There’s nothing different here to what can already happen. The waitress could easily take a shot of the front and back of your card anyway, Apple Pay or not.
@taoprophet420 Why do you keep comparing Apple Pay and Autofill? It’s two different things. One is a secure payment system, the other is an autofill sollution to ease the payment over websites etc. which is what is used today and has been since the dawn of online payments…you fill in your/cardholders name (not always), credit card number, date and security number (three digits)…Autofill does this for you (actually only credit card number and dates I think), leaving you to only manually press the three last security digits.
Apple Pay is something completely different, as you don’t make any transactions/payments based on the aforementioned credit card numbers and security digits etc., as you use your TouchID and verified credit card via the iPhones Secure Element system and the bank.
How is this any different than what a waiter is already capable of doing today? They can still take a photo of your credit card, then manually enter the card info online.
Because if it works like AutoFill, Apple Pay will allow you to add the card with the camera and then be able to make purchases at NFC terminals or apps that support Apple Pay. No sitting at home guessing the zip code or security code if you snapped a photo of the card.
If Apple Pay has zero verification like AutoFill it could be dangerous. Leave your wallet sitting and someone can quickly load it to their iPhone and be using it and you wouldn’t know u till you look at your bank account.
Again, how could you possibly think Apple and the banks would have NOT thought about implementing a secure method? Do some research on the topic (try Google) before debating as serious as you do… Apple Pay is not Autofill. Autofill is not Apple Pay. Autofill simplyfies the initial setup, but your credit card needs to be veryfied by your bank before you can start using Apple Pay.
Even with or without Safari auto fill for credit card, any phone can take a quick snapshot of your card and go use it online afterwards. It doesn’t create a new security issue at all.
And for Apple Pay, I think Apple mentioned that you would need to go to your branch to verify the card’s yours. Nothing’s more secure if they go that way.
How can you go to a branch if you have capital one card or discover?(when discover adds Apple pay)
I don’t see Apple requiring anyone to go to the bank to add a card to Apple Pay.
The waitress doesn’t scan your card. They bring out a hand held Chip & PIN/Contactless Payment terminal and you place your phone by the radio transmitter and it’s authorised with your TouchID which is already set up to act as the PIN verification. They don’t see your card details, they don’t even see your name. All they see is that the transaction went through or not. That’s it. It’s just the same as Chip & PIN only quicker and more convenient. Your card never leaves your sight, only in this case you never even see your card or have to enter a PIN that someone else could see.
I was using waitresses as a generic example. Chip & Pin terminals are still not widely available in the US and they plan to adopt chip & signature instead. Walmart is one of the few retailers that have chip refers in pos terminals and one reason they are not moving to Apple Pay because their pos lack NFC, but support chip cards, I would guess this is the same for Best Buy skipping Apple Pay.
My point was if you loose your wallet or hand your card to someone it’s extremely easy for them to launch the settings app and scan your card from there. I’m making an assumption Apple Pay works the same as AutoFill.
The important piece of information you’re missing with this regarding Autofill (and likely Apple Pay) is the requirement of the billing address. That information isn’t written on the card and, at least in the UK, almost every online retailer requires some form of billing address info to verify your identity and approve the payment.
Apple mentioned in the keynote that they verify your card information with the bank before you can use that card with Apple Pay, I’m almost certain that will be in the form of providing a little more info than the basic information physically written on the card, such as full name, billing address and perhaps even D.O.B.
Cmon, you don’t think they’ve thought about the fact someone could just pinch someone else’s card to take a photo of it into Apple Pay… Really?
You can do it with AutoFill why not Apple Pay? Both are Apple products.
On the address being required it is a hit and miss thing in the US. A few require a zip code, but many don’t require anything to verify.
Well, safari autofill is just quicker, it’s still the same as if the waitress wrote down the details, or just took a picture of the card. You need to remember the security code, but yeah that’s the only security you got…
I am sure you are a really nice person. Just remember that although Safari stores your credit card number, the one thing that it doesn’t store, which is required by most online transactions is your CVV or that three digit code in the signature line.
As far as Apple pay is concerned, the transactions are not made using the actual credit card number but the device ID. Although I am not sure, it seems that the verification deposit may be used prior to assigning a device ID to any card. Without the verification info, your waitress has a dead card in her passbook should she be so inclined.
The previous poster had it right that it would be more beneficial pen to paper where the CVV could be manually copied as well.
Since the card itself is only used for initial verification and the device ID is unique only to that device, I believe you may be worrying too much. Even with NFC enabled, if the card is not stored. There’s no way to steal it.
Since the iPhone already requires a passcode be enabled on the phone even to set up iCloud keychain, you can bank on at least that for Apple Pay.
just my 9to5 sense.
From additional photos on Appleinsider and Hamza’s Twitter account it looks like Apple Pay does not require verification just like AutoFill. On the page to fill out card details it asks name,card number,expiration date and security code. On the bottom of that page it says when using Apple Pay information about your card,device and location may be shared with Apple and your card provider. There is also a link to Apple Pay and privacy on that setup page.
So it looks like setup is done in Passbook just like setup in the AutoFill setting for Safari. Manually enter or use camera to load card details and start using it with no additional details needed.
You are completely wrong in your assessment of the pictures posted on Hamza’s twitter account. It is a known fact that when you enter a card in Passbook for ApplePay, Apple verifies with your bank that you are indeed the person authorized to be using that card. There is no work on your end, it is done by Apple before the card is allowed to be added to ApplePay. It is all explained in the ApplePay section of the keynote address (after the iPhone 6 and 6 Plus are introduced) from September and explained by Eddy Cue, who was presenting. I suggest you watch before putting out incorrect information based on your assumptions of pictures on twitter.
It’s hard to watch when the keynote was unviewable live.
It is not explained at all in the keynote how the card is verified. Eddy simply says it verifies the card is yours.
The modified beta of iOS 8.1 is still vague on if Apple will verify a card when you add it.
When you choose to add a payment card to Apple Pay, information you provide about your card may be collected in order to determine your eligibility and enable use of the feature. Information about your payment card, including your credit or debit card number, the name and billing address associated with your account, general information about your iTunes and App Store account activity (e.g., whether you have a long history of transactions within iTunes), information about your device (e.g., the name of your device), as well as your location at the time you add your card (if you have Location Services enabled), may be sent to Apple and provided by Apple to your card issuer and payment network in order to determine the eligibility of your ca
rd, for fraud detection purposes and to facilitate your use of the Apple Pay feature.
This guy is a complete troll. Trying to act there’s a problem before it is launched. Verification is done many ways, and he is obviously trying to troll this thread. Don’t feed the trolls.
It is probably done via two small random transactions on your bank account, like $.19 and $.07 and then you enter the two charges in passbook to confirm you have access to that account. Done similarly with other major banks services.
And also, the keynote is available via Apple.com. This guy is soooo trolling.
Google says:
http://www.zdnet.com/apple-pay-and-security-could-tokenization-be-the-tool-that-curbs-data-breaches-7000033585/
Touch ID, random tokenization for every single transaction, no storage of credit card info, etc.
What does tokenization have to do with anything? It does not answer when you add a card to your phone if and how Apple verifys the card is yours.
Its in response to your original comment of security issues etc, also in basically every article it states the card will be verified, how it will be done obviously will be on the release of the service itself (or the upcoming days), not really sure if you’re bored or what but its obvious your concrete answer will come within the next coming weeks.
I get it, you want someone to tell you right now, my kid acts the same way when she doesn’t get what she wants immediately.
Tokenisation has everything to do with it. Apple have stated that Apple Pay is EMVco compliant, meaning that they are acting as a token requestor under that process – i.e. card details are sent to the issuer, the issuer requests confirmation in whatever their standard way is, and apple are issued a token which they store, instead of the card details.
As the transcript from the Apple event states:
“Using your iPhone iSight camera, we take a picture of the card, grab all the information, go to your bank and verify that that’s your card and we add it right to Passbook.”
So, given the card does not feature the required elements – CVV, zip code etc- Apple Pay must ask for additional information -most likely not directly but by just linking to an approval processor (3DSecure for example) just like websites do. The main thing is, it is required to be PCI and Contactless compliant, and the approval will vary by issuing institution, hence the need to onboard banks individually.
Yet again….Tokenization
http://www.macrumors.com/2014/10/09/apple-pay-bank-liability/