Apple Pay may set mobile payment security standard

Apple Inc. is known for setting trends, if not defining whole new market categories, as represented by the iPhone and iPad. But now, with the Sept. 9, 2014, launch of the iPhone 6, and Apple's first foray into the wearable device market with the Apple Watch, the tech giant has come out with a mobile contactless payment system called Apple Pay that could potentially set the standard for mobile security for the entire marketplace. By defining the security standard that wary consumers buy in to, the market for mobile contactless payments at the POS may finally take off.

Here's an excerpt from Apple's statement: "Apple Pay will change the way you pay. When you add a credit or debit card with Apple Pay, the actual card numbers are not stored on the device nor on Apple servers. Instead, a unique Device Account Number is assigned, encrypted and securely stored in the Secure Element on your iPhone or Apple Watch. Each transaction is authorized with a one-time unique number using your Device Account Number and instead of using the security code from the back of your card, Apple Pay creates a dynamic security code to securely validate each transaction."

Apple Pay leverages near field communication (NFC) technology embedded in smartphones to conduct contactless, in-store payments. Customers' sensitive payment data is tokenized and stored within the secure element of the NFC chip. When users pay with their phones at the POS, one-time tokens are generated in the place of the payment data. When Apple's biometric fingerprint scanning technology, Touch ID, is added to the mix, a potent security environment is erected around mobile payments.

Redefining card present

Randy Vanderhoof, Executive Director of the Smart Card Alliance, said, "[Apple Pay] really raises the bar on secure implementation of payments, because adding the biometric authentication to the transaction provides a much more secure validation to the merchant and to the issuing bank that the proper individual is making the payment transaction – and that they can trust that transaction."

Vanderhoof added that the card brands recognized the higher degree of security associated with Apple Pay and "rewarded" Apple with the lower card-present interchange fee, even though mobile contactless transactions are by literal definition card-not-present (CNP) and subject to higher fees. "So they are redefining the definition of card-present here," Vanderhoof said. "They're doing this because Apple is able to provide the same, in fact more, security, to the payments network that would normally exist when the physical card is involved." Because CNP transactions are considered more prone to fraud, they are placed in a higher interchange category, which translates into merchants paying more to accept CNP transactions.

In analysis of Apple Pay, Alcaraz Research said, via the Seeking Alpha website, that the 15 to 25 basis point discount the card brands have provided to Apple Pay transactions means that "Apple Pay processing fees can just be around 1.25 to 1.35 percent, much lower than PayPal's card-not-present transaction fee of 2.7 percent."

Vanderhoof noted that Google Wallet transactions also fall into the CNP interchange fee category because no comparable security protocols are in place, as Android-based phones are not equipped with biometric security technology.

Boon to the market

But the benefits of the Apple Pay security ecosystem to Apple, and the 220,000 U.S. retail locations that already accept contactless payments, will potentially extend to the entire mobile payments marketplace. Vanderhoof said the lower interchange category will act as an incentive for Apple to more aggressively market Apple Pay, which will result in more consumers wanting to use it and more merchants wanting the ability to accept it, creating a momentum of adoption and usage.

"It certainly does provide a very strong incentive for Apple to invest more marketing clout behind the wallet solution, which will then create more mobile payment transactions, which will replace the less secure magnetic stripe transactions more quickly," Vanderhoof said, "So the benefits are then going to be shared across the entire market; merchants and issuers are going to benefit from the higher security and the less likelihood of fraud by the way Apple has implemented Apple Pay."

It won't take many consumers coming into stores and asking if merchants accept Apple Pay for reluctant retailers to reconsider upgrading terminals to accept contactless payments. "I think merchants are probably going to be rethinking the future of NFC and contactless payments with this announcement," Vanderhoof said. "The previous implementations of NFC and mobile wallets hasn't had a real big impact on consumers, and therefore it hasn't caught the attention of too many of the merchants.

"But now with Apple jumping into the fray, it may give [merchants] further reason to upgrade their point of sale to be NFC capable and perhaps turn that NFC acceptance on sooner than they may have."

Additionally, Apple has created a security and mobile payment model that competitors can emulate. "It certainly is a model to consider for other solution providers to step up their creative ways to demonstrate a stronger link between a cardholder and the payment transaction, like Apple is doing with their biometric Touch ID," Vanderhoof stated.

However, Vanderhoof cautioned against rushing to crown Apple Pay the dominant mobile payments scheme. "With any new payments player in the market, and changes that happen in the direction by which consumers can transact at the point of sale, it takes some time for those new features to catch on and be fully vetted and operational."

But the stars seem to be aligning nonetheless. "I would say the signals are very good for what Apple has done, but it's a little bit too early to put a flag in it and call it a huge success or a huge game changer," Vanderhoof said.

Editor's Note:

The Green Sheet Inc. is now a proud affiliate of Bankcard Life, a premier community that provides industry-leading training and resources for payment professionals. Click here for more information.

Notice to readers: These are archived articles. Contact names or information may be out of date. We regret any inconvenience.