Hacker News Reader

Comment by abalone | Hacker News Reader

It's a huge improvement in security. You mentioned how the majority of contactless payments don't require a PIN. Apple Pay secures 100% of transactions with a PIN, made convenient with touch ID.

There are also behind-the-scenes protections against identity theft. E.g. if a merchant has a data breach, your Apple Pay card number can't be used to buy things online.

View on HN

Consumers are already protected, the security is more for the banks. Contactless was made to not require a pin for transactions under a certain amount. It's made for convenience, no one is using it to steals 1000s. And if someone is using it to steal they aren't stealing from joe blow but from the banks.

It's not identity theft they are protecting, but bank fraud. If a merchant has a data breach and my credit card details are used to buy things online without my authorization, that isn't identity theft, but bank fraud to the bank. Since all I have to do is say that transaction isn't mine and poof it's gone.

It's not just "poof it's gone" here.

In Australia, if you dispute a credit card transaction, it still counts against your limit and your required repayments until the dispute is resolved. This can take months and be more than inconvenient.

Not so in Switzerland. At least not with my bank.

If I complain about a charge (which I will only do if it's truly fraudulent, or not possible to have been initiated by me) the amount is credited immediately while the bank is taking it up with the merchant.

That's exactly the way it should be and if this is not the case you should probably be pushing for stronger consumer protection laws.

Not so in the US either, at least not universally. My credit card companies have followed this same pattern when there has been a dispute.

The motivation for moving to chip and pin is that the banks take this kind of risk away from the merchant.

Average Joe will pick convenience over security every time, unless it's such an absolute shambles that they actually fear (or have been convinced they should fear) using it. Not to mention the already-formed habit/association of "hey, I'm paying for this, better whip out my card".

True, but Apple Pay is also at least as or more convenient than tapping a card. You (theoretically) don't ever have to enter PINs, you get a transaction confirmation on your own device, and if you have an Apple Watch you don't even have to pull anything out of your pocket.

>>> You (theoretically) don't ever have to enter PINs,

But practically, for day to day expenses, it's not required.

>>> you get a transaction confirmation on your own device

As opposed to getting a confirmation on the terminal...

>>> and if you have an Apple Watch you don't even have to pull anything out of your pocket

I don't know if you're talking from experience, but those terminals are usually facing up and/or towards you. It's uncomfortable to bend your wrist like that.

> if you have an Apple Watch you don't even have to pull anything out of your pocket

How is this PIN/touch ID protected, then?

You unlock the watch with a pin on the watch itself or touch id on your iPhone. It locks itself automatically when you remove it from your wrist.

This doesn't seem very convenient. You scribble a PIN on your wrist or you pull your phone out of your pocket to use touchID?

You only enter the PIN when you wear the watch to unlock it, not at the register.

>>> There are also behind-the-scenes protections against identity theft. E.g. if a merchant has a data breach, your Apple Pay card number can't be used to buy things online.

Contactless cards work the same way. They don't send your card number, they send a token.

Not necessarily. My German MasterCard and Visa cards don't use send the the full number. In fact, I think tokenization is a fairly recent addition to the standard.

Reply on news.ycombinator.com