Hacker News Reader

Comment by oarsinsync | Hacker News Reader

> Contactless payments up to £1000 mean I can pay for basically everything without touching anything.

This feels like a good opportunity to reflect on the Apple Watch, and security around contactless payments.

Try taking off your apple watch, but keeping your fingers pressed against the back of the watch as you do. If you time it right (it's really not difficult to time it right), you can take off someone's watch and place it on your own wrist, without triggering the lock.

If you have a debit or credit card associated with your watch, you're now at risk of a supposedly authenticated card payment occurring.

(I removed all my cards from my Apple Watch S3 when I realised this vulnerability)

View on HN

That sounds like it would be incredibly hard to do without the user noticing. Either way, if you're concerned about this could you not just use a strap that is harder to remove?

For a talented pick-pocket it’s not as hard as you think. Apollo Robins and David Blaine both remove watches from oblivious marks during their sleight of hand routines. Anecdotally, someone lifted my friend’s gold Rolex while he stood in line at a street market. And it was on a bracelet which is basically a handcuff!

Apple Watches are much lighter too, so it’s harder to notice when it goes away.

But the risk is no higher for an Apple Watch than a Rolex or a wallet full of credit cards no? Especially if you use a credit card where you have charge back protections.

> But the risk is no higher for an Apple Watch than ... a wallet full of credit cards no? Especially if you use a credit card where you have charge back protections.

That's yet to be determined. If someone takes my credit card, the most that they can do is 3x £45 transactions (unauthenticated contactless limit).

If they are able to perform PIN authenticated transactions with my credit card, I'm going to be facing an uphill battle, as the onus is on the consumer to protect their PIN.

Equally, contactless transactions via Apple Watch or iPhone are supposed to be authenticated transactions via PIN / biometrics, which is likely to result in the same uphill battle.

EDIT: I've ignored the comparison to Rolexes, as the topic is about the risk of credit card fraud, not about the risk of theft of physical belongings. If we're talking about the risk of theft of physical belongings, then yes, the risk is lower for an Apple Watch than a Rolex, because a Rolex is (by market value) generally worth more, and in some cases can command more on the secondary market than new, unlike an Apple Watch (so far)

I would imagine that Apple Pay transactions would be harder to dispute than say, a contactless transaction with a physical card, because the banks know that one has to authenticate before using it.

I don't have an Apple Watch but I wouldn't be worried about this.

I only have credit cards linked to my Apple Wallet - if there's a transaction I don't recognise then I'll just call them and cancel it.

An Apple Watch transaction is similar to a completed chip+pin transaction - authentication by the card holder is required, and the card has to be present.

You can get your money back, but it's not particularly straight forward.

Reply on news.ycombinator.com