What I read:
> Imagine putting your phone down on the bar and being charged $1000 by some anonymous dude that hid a NFC tag there while noone was looking.
Basically, the entire planet is now 'fair game' as a skimmer.
I would also guess that:
- the first payment to a new payee to have a bit more UI.
- the phone’s setting to contain settings such as max amount to be paid per week or month, and max amount to be paid in one transaction.
- those tags to have some cryptographic signature with Apple vetting those wanting to get a key. A service like this can be highly successful if only a limited number of companies (¿a few hundred?) can produce such tags.
- Apple acting as an intermediary between iOS user and payee to protect their user’s privacy.
It also is possible that Apple will withhold payment for a few days or even weeks, to give time to detect and correct fraudulent transactions, and give its customers time to challenge payments.
If such challenges are handled by always repaying the iOS user, this won’t be more dangerous than allowing selected companies to withdraw money from your bank account whenever they see fit, something that millions of people in the world do because it is so convenient.
For example, if Londoners enable auto top up for their Oyster card (https://oyster.tfl.gov.uk/oyster/link/sso/0002.do), transport for London could transfer £1000 from their bank account the next day, even if they destroy that card seconds after signing up.
I would even expect that they can do that from any bank account even if it’s owner hasn’t applied for auto top up, or even has an Oyster card. This system is built on trust.
This statement is sensationalist and not true, as the maximum load on a Oyster Card is £90.
London transport must send thousands of payment requests to banks each day. Banks will honor them without checking anything, as there’s no way (apart from contacting the customer) for them to verify that London transport has the right to request those transfers of money to them (“here’s the form this customer signed last year” doesn’t say anything about whether the customer withdrew permission later)
The contract between the bank and London Transport likely says something about the amount of money they can request to be transferred to them each week, month or year, _may_ limit the amount per item, and says the contract will end if London Transport misuses the trust the banks give them, but that will be about it.