A Look At OS X Yosemite And iOS 8.1

Apple's Foray Into Payments

Apple has made two announcements this year that show an expansion into areas outside of the technology industry. The first was Apple Watch, which is most definitely a technology product but looks positioned against the current premium watch industry just as much as against current smartwatches on the market. The second was Apple's foray into the payment industry, Apple Pay. While Apple Watch won't be around until next year, Apple Pay is here right now with one caveat. Apple Pay currently only works in the United States, or more specifically, only with a credit card issued by a United States bank. However, the service will eventually be expanded to support cards issued by banks in other countries.

How Apple pay works is fairly straightforward, that's the entire point of it. If the region on your device is set to the United States, the passbook app will contain a card that allows you to add a credit or debit card. You can then either type your info in, or use your camera to get the information from the card. Once the card is verified by your bank, you will have a card that appears in passbook and you're ready to start using Apple Pay. From the user's perspective, Apple Pay is simple and easy to use. But what goes on behind the scenes to keep everything secure can be quite complicated.

Security

The first thing to know is that your credit card information is never stored on the phone. Upon adding a credit card, the information is encrypted and sent to the appropriate issuing bank which confirms that the card is valid. A token is then sent back to the iPhone and stored in the secure element, which is essentially just an internal smart card chip. This token, not your credit card number, is what is used during payments. Apple's marketing and technical material refers to it as a Device Account Number. The token itself resembles a credit card number, but the only similarity between it and your card is the 4 digits on the end. 

The use of tokens is where much of the security of Apple Pay comes from. By removing the actual credit card number from the equation, the merchant you're paying never gets to see your credit card number, security code, or your name. The token presumably is also only linked to the actual credit card via some database held by the bank, rather than some sort of equation that could be reverse engineered. This means that even in the event where a merchant is hacked and your token number shows up, it is entirely useless because it does not function as a credit card and is tied to the iPhone it was used on.

Beyond the overarching security, there's additional security at the time of payment. It begins with the use of Touch ID for authorizing payments. Although Touch ID launched with the iPhone 5s which does not have the necessary NFC hardware to use Apple Pay, I believe that this sort of service was the original goal when Touch ID was first being created. Paying with Apple Pay requires using Touch ID to verify your fingerprint. This prevents anyone from making purchases using your iPhone if it is lost or stolen.

One thing to note is that Apple Pay is not just a service for making purchases in stores. It also works for making purchases at online retailers than integrate it into their applications. All the security features that I've described apply to both in-store and online purchases, so there's no compromises on either side.

Going Forward

Making Apple Pay successful is going to take a lot of work on both Apple's part and on the part of retailers. Currently the service only works with cards from US banks, leaving out the rest of the world. Apple needs to expand the service much quicker than competitors have done so with theirs. For example, Google Wallet remains a US only service over 3 years after its initial launch. Apple Pay is not going to achieve success if it ends up in the same situation. Apple has given no timeframe for expansion to other countries, but if the iPhone 6 and 6 Plus get replaced by newer models before Apple Pay expands outside the US it will be a worrisome situation.

Apple also needs to convince retailers to support the service. The list of supported merchants on the Apple Pay section of their website has grown since its initial launch, and if Apple Pay is ever going to be a viable way to make everyday purchases that list needs to continue to grow. Work by banks to increase adoption of NFC capable terminals will also speed up this process, as Apple Pay works with existing NFC enabled checkouts. Apple also faces resistance from retailers that are partnered with other payment systems. Recently there have been reports that merchants who support the CurrentC mobile payment standard are disabling NFC on the payment terminals in their stores to block Apple Pay. I don't believe this will be an issue in the long term because consumers will realize when companies are prioritizing their own agenda over the customer's experience and they'll go to other retailers. If Walmart won't support Apple Pay and a customer wants to use it, they'll just go to Target instead.

As someone who doesn't live in the United States, I'm hopeful that the service will expand to Canada before this iPhone becomes obsolete. There are many obstacles in the way, but Apple appears to have put more effort into working with banks and merchants to get the service off the ground than any of the other mobile payment services we have today. How things play out will only be revealed with time.