Cincinnati Enquirer:
Macy’s is expanding Cincinnati-tested technology that enables in-store shoppers to browse items not on shelves and even skip the checkout this holiday. It’s part of a broader push to woo Millennial customers and boost overall convenience and efficiency.
Customers looking for the hottest new Michael Kors purse that’s not stocked in their favorite color have been able hunt for their hue at point-of-purchase terminals at the Kenwood Towne Centre store as part of the Cincinnati-region testing.
The touchscreen point of purchase or “POP” machines confirm if an item is in the store – or at any store nearby or across the country. Also being expanded are local “look book” terminals – touchscreen catalogs that replace some mannequins and show the shopper how some clothes look paired with other garments or accessories.
So far, so good. Macy’s is exposing their inventory system to customers. Makes for more efficiency all the way around. But then the article digs in to the various tech in play. When it comes to explaining Apple Pay:
How it works: Customers with the new iPhone 6 and the Apple Watch will be able to pay at registers with a wave of their devices. Customers buy virtual encrypted “tokens” from Apple to be stored on their phones – so in the event they’re lost or stolen, no credit card info is on the device. More details will be released this month by Apple.
I still struggle to get my head around exactly how Apple Pay works, but I do know that customers won’t be buying “virtual encrypted tokens” from Apple. Hard to blame the Enquirer, though. This is a complex process. But taking a complex process and wrapping it in a dead simple service is Apple’s specialty.
And that’s the key. If Apple Pay works seamlessly and adds a layer of security/indirection to the credit card universe, it’s not so critical that the end user truly understands the inner mechanics.
This is a bit different for those of us in the UK and Europe. For instance, we’ve had mass spread use of Chip & Pin payments in stores for over a decade and contactless payment via NFC built in to our cards for the last 2 years at least.
To the best of my knowledge, this is some what different to the US, where car payments are still processed with a signature. So I can see that there can easily be some confusion around how an in-store digital payment platform operates.
The simplest explanation I have so for for Apple Pay is the following:
Start with the credit or debit card registered to your Apple ID.
This card’s details are stored on your device.
You go to make a purchase and the terminal broadcasts a signal and goes in to receive mode.
This receive mode is awaiting a ‘key’.
Your NFC enabled card has this ‘key’.
Where Apple Pay steps in is with a ‘key’ but this is not the key from your card. It’s a ‘key’ generated instantly in the same way 2-stage verification codes are generated.
This new ‘generated key’ is released to the terminal up on the Touch ID approving the action (In the same way it does for sign ins).
This ‘generated key’ is then received by the terminal and checked against the algorithm associated with payments (Again like 2-stage auth) and approves the purchase.
All of that happens in the time it takes to read £19.99 on your screen and to tap your thumb on the home button.
Mark, I’m afraid your understanding is slightly out based on some of the developer documentation I’ve read. The card details are never stored on the device. When you first activate Pay for a new iPhone, the card details stored on your iTunes account (or a new card you add at this point) are stored securely on Apple’s servers the same way they are currently. A new, random, unique credit card number is generated by the server and sent to your device, and it is this new card number that is stored in the secure enclave of the A8 chip. The only common thing between the randomly generated card and your real card is the last four digits. This new card is valid for a single purchase only. Once it has been used, the details are useless, a new card is generated by the server and sent to your device. There is no point in this process where the phone stores, or as far as I can tell even knows, the real card details. This ensures that even if your phone is stolen, the best they can do is get a card number valid for a single use which you can actually cancel remotely from your account. That assumes they can even get the details out of the secure element which as I understand it is near impossible.
I don’t get what everyone’s problem is with understanding the system. Must be the term “tokens” (which is probably why Apple avoids using it).
1. You register your credit card with your credit card company through your iPhone. Your actual credit card number is never stored on the iPhone and never sent to Apple when registering Apple Pay.
2. The credit card company sends a device-specific, randomly-generated number to the iPhone to use with Apple Pay. This number, not your card number, is used to pay.
3. To pay, tap the iPhone to a credit card terminal while holding Touch ID.
4. That’s it. Enjoy your purchase.
There’s other “magic” with dynamic CCV codes, which may be causing the confusion, but that’s the gist of what you as the user do.
Maybe people go out of their way to complicate it up because it seems too simple. Hard to fill an article with 3 steps.
it’s not that complicated.
http://www.macworld.com/article/2607181/why-apple-pay-could-be-the-mobile-payment-system-youll-actually-use.html
http://bankinnovation.net/2014/09/heres-how-the-security-behind-apple-pay-will-really-work/
correct — the card details are not stored on the device. instead, a “Device account number” is. this is stored in the “secure element” (an existing term from NFC-empowered cards). not sure if this will be in the same chip as apple’s new secure enclave or not.
Hi Robert, thanks for the clarification on the card storage (i.e. non storage).
It’s starting to sound like this system could be the most thoroughly thought out payments system ever devised!
Yup, and it’s all industry standard. It’s based on the EMV Payment Token Specification, so there’s no reason we can’t see this on all devices in the near future.
Apple have a few advantages here in that they can
a) use Touch ID for user verification
b) place added security into the A8 chips because they design the chips themselves
c) have the clout to market this as “Pay” which will be plastered all over most terminals, even if other devices can do it too.
The reason for the “fake” card generation is so that it will seamlessly work with all the existing infrastructure in places like Europe and Asia for handling NFC payments. As far as the payment terminal is concerned you just provided a valid credit card, and as far as the bank are concerned you verified yourself through Touch ID.
Warning – Technical specification: https://www.emvco.com/specifications.aspx?id=263
In that case, it would be interesting to see if Microsoft and Google adopt it in the future for what every they may wish to do with regards keeping up with Apple.
Here’s how it works to a laymen’s eyes:
I hold my phone over the terminal and press the home button. I’m done, and hackers can’t get shit unless they hack the bank.
I don’t need to know about tokens, or how it works, I just need to know that it works and it is much more secure than the alternatives.
I thought your card number isn’t even stored on the Apple servers (with the exception being if it happens to also be your iTunes account card)? And if no one is to know your card number, why send out a new token every time…isn’t that interceptable and usable then?
I was under the impression that it was required for Apple to convert the “token” card number back into your real card number. Apple have said they will not be recording your transactions however, so they aren’t monitoring or keeping track of what you’re doing, just enabling you to do it securely. The new token each time is in case someone has hacked the terminals, if they record the token and it can be used multiple times, then they might as well have your real card number.
Indeed, there are many who misconstrue, misunderstand and mis-represent ApplePay. But let’s be honest, there are many, including Apple fanboys (the authors of this blog even), who misconstrue, misunderstand and misrepresent how iPhones, iOS, etc. work. Let’s not even delve into how Apple pundits misconstrue, misunderstand and misrepresent how non-Apple technology works.
Bottom line: Tech journalism is not different from sportswriting. Most writers are not engineers (or athletes) and therefore are going to make mistakes – many and often. Those who acknowledge their mistakes (when pointed out to them) and correct them are those who earn credibility.
nope — apple does not store your credit card number as any part of Apple Pay. when you scan your card into your phone, it’s sent to the issuing bank, they confirm it then send you back the “device access number” which is stored on your phone. for each transaction made two pieces of data are sent (via the phone to the POS to the bank) — the DAN, and the one-time-use token. the bank confirms that the token and DAN belong together and that its your account, then that you have the funds. they send back a successful auth code to the POS (retailer).
http://www.macworld.com/article/2607181/why-apple-pay-could-be-the-mobile-payment-system-youll-actually-use.html
http://bankinnovation.net/2014/09/heres-how-the-security-behind-apple-pay-will-really-work/
nope. apple does not do any conversions of the token back to your credit card number. none. the card issuing bank manages the tokens, and they’re the sole authority on what card numbers the tokens are linked to. it’s an existing system that has been around for a decade — some people use these tokens when making purchases online if they don’t want to disclose their card number. they get the disposable tokens from their card issuing bank.
The simple addition of a “with” between “buy” and “virtual” fixes it, so I suspect that was the intent.