Wall Street Journal:
LoopPay’s technology, however, purports to sidestep one obstacle that has so far hindered the wide adoption of mobile-payment services: the need for merchants to have to upgrade their checkout devices. Instead, LoopPay says its magnetic induction technology allows a smartphone to be tapped against the magnetic-stripe-reader machine that is already found in Samsung’s service, which is expected to be launched when Samsung unveils its Galaxy S6 smartphone in Barcelona in about a week’s time, would allow a consumer to register credit, debit, gift and loyalty cards onto a Samsung smartphone, and use the handset to make purchases, instead of carrying the cards in a physical wallet.
First things first, this time Samsung has gone too far. Jim put so much effort into his Heineken based mobile payment service which (I have this under the highest authority) he was going to call LoopPay.
Kidding aside, LoopPay uses a magnetic field to interface with existing magnetic strip readers. In effect, it allows a phone to mimic an actual credit card and is said to work with most existing card readers, meaning merchants won’t have to make any changes to accept LoopPay.
From a WSJ blog post that lays out the mechanics:
To use LoopPay, first you register your existing credit cards in its app (as many cards as you like). Once you’ve done that, you can pay by opening the app, tapping in your LoopPay-specific PIN, selecting your card and then holding your phone close to the merchant’s card swipe slot. When you do, most machines will recognize LoopPay’s magnetic signal as a swipe, and the transaction will proceed.
You can also remove your LoopPay fob from the phone if it’s easier to just hand it to the merchant—the cashier just needs to press a physical button on the dongle. The signal emits from the dongle, so it can even work when your phone’s battery has died. Of course, Samsung hasn’t said much yet about how it might implement LoopPay in its phones, but I could imagine there will be differences with the software and hardware.
Though I do like the fact that the technology can work with existing card readers, this seems like a short sighted system to me. It does not solve the security problem and it is far less convenient to use. You have to open an app and type in a pin.
With Apple Pay, you hold your finger on the Touch ID sensor, tap the merchant terminal, wait for the confirmation beep (which happens almost instantaneously) and boom, you’re done. And, unless I’ve missing something here, Apple Pay offers security that is head and shoulders beyond that of LoopPay.
Short term, LoopPay is an interesting alternative to pulling your credit card out of your wallet, if you have the right piece of hardware. Samsung is betting that LoopPay is enough of a draw to get you to invest in the next generation Samsung phone. Obviously, Apple is doing the same. It’s a horse race, of a sorts. But in this race, time favors Apple. Once Apple Pay acceptance hits a critical mass, compatibility with legacy merchant terminals will be less of an issue and ease of use and security will become the driving factors. And Apple Pay wins that one, hands down.
It is short-sighted in another way. Many US merchants will be replacing (or already have done so) their point of sale terminals with those that will support chip-and-PIN as well as wireless payment systems like Apple Pay.
The mag stripe is past its prime and will likely decline very quickly once more secure payment methods are in place. I believe that the merchant’s card fees are higher for mag stripe transactions than for chip transactions. If US banks adopt such a tiered fee system, expect merchants to push hard to move away from mag stripe.
Per LoopPay’s white paper on their upcoming tokenization system (http://www.pymnts.com/exclusive-series/playmakers0/2014/mobile-tokenization-solves-payments-security-woes/#.VOXxOS7p-jo ), cc number, exp date and SVC are not tokenized and a data connection is required to generate the tokenized part. It matches the dynamic cvv portion of Apple Pay but not the full card number tokenization. It also means the card data stays on the phone, unlike Apple Pay’s one-time registration process. This also means it lacks Apple Pay’s online payment protection component.
Does being able to mimic a mag stripe bother anyone but me?
This will get zero traction in Europe; we abandoned the magstripe ten years ago.
Not just you. I found the idea interesting, but ultimately it’s a hack with no receiver-end guarantee of compatibility.
LoopPay is DOA. My guess is that is why they sold now and why you are not seeing a any price disclosed. This was a sexy acqihire exit. Good for LoopPay and its employees but lets not kid ourselves about the ridiculous tech that LoopPay was using. It is the stuff of a skimmers best dream. You can read card data without even having to get a physical swipe. Their approach to tokenization is leaps behind ApplePay and where the networks want it to go. The mag stripe is already a decade replaced in huge parts of the world (Europe). I am all for Samsung catching up, as I think more secure payments is a win for all parties as Apple has consistently made very clear — they are not in this to find out what you are buying or your spending habits they just had the technology that enabled more secure transactions, why not pass that on to all.
It does not solve the security problem and it is far less convenient to use. You have to open an app and type in a pin.
True, though it does solve the security problem of a physical card with important numbers printed on it.
(Also, note that more and more swipe readers are themselves cryptographic, leaving very little or no window of attack to people who aren’t the NSA, specifically targeting you with sensitive EM antennae.
And if the NSA wants your CC number, they’ll just ask your bank.
EMV is the future, but this is actually a pretty clever interim mode.)
I’m not sure about transaction fees, though it wouldn’t surprise me.
I do recall that come October the onus of fraudulent transaction repayment will fall on the merchant, not the bank, for any non-EMV transactions that get reported as fraudulent.
That’s … a pretty big incentive to switch, and one correctly targeted at the merchants, who are the ones who have to actually do the changing.
Not me.
But then, I know that anyone can blow $120 on Amazon and buy a three-track card writer and a stack of blank cards, if they’re interested in being naughty.
(Or, in the case of my workplace, if they’re doing payment software and need to test cards and pathological broken data.)
That a phone can blast some EM that mimics swipe data is interesting, but not bothersome; I would not hold my breath worrying about Hackers With Sneaky Antennae Stealing Your Data – between range issues and the way it’s not the softest target in the typical payment stack, it’s a non-winner.
Clever versus smart actually. More a gimmick than a solution. Very Samsungy
Ditto for Australia. We don’t allow swipe and sign any more. All Chip & Pin or EMV.