As others said, chances are the phone will still show you a payment takes place, allowing you to reject it, presumably while showing the amount to be paid and the payee.

I would also guess that:

- the first payment to a new payee to have a bit more UI.

- the phone’s setting to contain settings such as max amount to be paid per week or month, and max amount to be paid in one transaction.

- those tags to have some cryptographic signature with Apple vetting those wanting to get a key. A service like this can be highly successful if only a limited number of companies (¿a few hundred?) can produce such tags.

- Apple acting as an intermediary between iOS user and payee to protect their user’s privacy.

It also is possible that Apple will withhold payment for a few days or even weeks, to give time to detect and correct fraudulent transactions, and give its customers time to challenge payments.

If such challenges are handled by always repaying the iOS user, this won’t be more dangerous than allowing selected companies to withdraw money from your bank account whenever they see fit, something that millions of people in the world do because it is so convenient.

For example, if Londoners enable auto top up for their Oyster card (https://oyster.tfl.gov.uk/oyster/link/sso/0002.do), transport for London could transfer £1000 from their bank account the next day, even if they destroy that card seconds after signing up.

I would even expect that they can do that from any bank account even if it’s owner hasn’t applied for auto top up, or even has an Oyster card. This system is built on trust.