Hacker News Reader

Comment by oneJob | Hacker News Reader

When I buy a burrito and then look at a receipt (as I always do after buying a burrito) I do not see the visa surcharge, or any others. I see tax but that's it. At the end of the day, the consumer pays, because there is no free lunch, there are no free burritos.

I may have made an incorrect assumption regarding claims handling, though I'm not sure how that translates me to being "very misinformed".

I wasn't speaking only from the vendor perspective (idk what it looks like to them) or the Apple Pay customer's perspective (I'm not one of their customers) but I highly doubt it's worth my time to research to confirm that adding Apple Pay into the mix does not somehow increase the attack surface or how it does not somehow increase the amount of my personal information that is with Apple.

View on HN

Nearly everything in your original comment is wrong. You say there's a "minor surcharge" but the cost to the vendor is the same as any other credit card. You mention the cost of supporting yet another platform, but the platform is just NFC, there's nothing special needed to support Apple Pay specifically. You say the consumer has their fingerprint tied to payments, but the fingerprint data never leaves the device. You say the attack surface is increased substantially, but Apple Pay is much more secure than using a credit card directly. (Not that consumers need to care, since fraud protection is 100%.) You imply that credit card companies aren't involved in resolving fraudulent Apple Pay transactions, but they are. You close by saying that Apple Pay isn't just a nice frontend for the card companies with better security, but that's precisely what it is.

I personally think this can rightly be described as "very misinformed."

>> there's nothing special needed to support Apple Pay specifically.

Yes, there is. NFC enabled terminals may be the norm at major chain stores but they do not have widespread adoption in smaller retail outlets.

The merchant pays for those terminals and they are not inexpensive. Sometimes $1000 or more. That tradeoff (making it slightly easier for you to pay) just isn't worth it to most merchants right now. As EMV adoption grows and merchants have to update their terminals to support that as well, NFC will grow.

Also, it may seem as if ApplePay is more secure for the banks as it prevents issues with data breaches but to date, it has not prevented any, will continue to only lessen the impact and is absolutely wrought with card fraud as there isn't any validation that you own the card you are loading into ApplePay. Once it's loaded it isn't checked by the merchant (if the merchant even pays attention these days) and is implicitly trusted by the network.

It took the UK a few years since contactless cards were launched around 2010. Everyone already had chip+pin terminals, and at first it was mostly coffee shops in London, but now many merchants have upgraded to contactless ones. It's not just national chains, but local shops too. It's much faster paying by contactless in a busy pub than paying cash.

It's possible there's pressure/support from Visa and MasterCard for small, local retailers to accept contactless payments. It's part of their advertising that you can buy a newspaper using the system, and most newsagents are local, independent shops.

A basic chip+pin (not contactless) terminal is available for £100 (or £3/month), I can't find a price for a contactless one.

The key word there is "specifically." Apple Pay may require technology that isn't 100% deployed, but it is a generic and standardized technology that long predates Apple Pay, not some new Apple-only technology that the boys in Cupertino came up with and foisted on the world.

I don't understand your security point at all. It hasn't prevented any breaches? How do you know? It doesn't validate cards you enter into Apple Pay? If you possess the card (or can make one from having possession of the card data) then you can already use it fraudulently, loading it into an iPhone is just an extra unnecessary step for the thief. The security advantage is that malicious terminals can't steal card data, and stealing your method of payment doesn't confer the ability to pay. It's not perfect by any means (and again, not something us consumers need to even care about), merely better than a regular plastic card.

Reply on news.ycombinator.com