Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!us.feeder.erje.net!feeder.erje.net!eu.feeder.erje.net!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: "Rod Speed" Newsgroups: misc.phone.mobile.iphone,comp.mobile.ipad,comp.sys.mac.system Subject: Re: Apple Pay Exposes Insecure Bank Policies Date: Sun, 22 Mar 2015 05:44:44 +1100 Lines: 49 Message-ID: References: <200320151703579843%michelle@michelle.org> <550da46e$0$34564$c3e8da3$dbd57e7@news.astraweb.com> Mime-Version: 1.0 Content-Type: text/plain; format=flowed; charset="UTF-8"; reply-type=original Content-Transfer-Encoding: 7bit X-Trace: individual.net t8qwV6IhIEXPyiqdIdj3bQq57uRXrPMUjwVOqNInrfvqz9UvE= Cancel-Lock: sha1:AipotP1Z1Q+8DevypoMl2hSimxI= In-Reply-To: <550da46e$0$34564$c3e8da3$dbd57e7@news.astraweb.com> X-Priority: 3 X-MSMail-Priority: Normal Importance: Normal X-Newsreader: Microsoft Windows Live Mail 14.0.8117.416 X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8117.416 Xref: csiph.com comp.mobile.ipad:46729 comp.sys.mac.system:71752 JF Mezei wrote > Huge wrote >> Given that fraud via Apple Pay is approx 100 times as >> prevalent as fraud via other channels from the same banks, >> it seems not unreasonable to assign the fault to Apple. > Not necessarily. Yes, necessarily. As you correctly pointed out previously, the apple pay system makes it MUCH easier to do fraud, essentially because there is no longer any necessity to produce a physical copy of the card that is good enough to fool a machine or a human anymore. ALL you need is the card details and an iDevice to put them into. Its hardly surprising that even the stupidest thief has been told about that by other thieves now. > Based on ONLY the above information, it is possible the banks were > naive and didn't request any additional information and accepted > card activation with just card number, name and expiration. They obviously got more than that, at least the time and date of the attempt to add the card to apple pay etc. > It is also possible banks wanted more info and Apple refused. > We can't know for sure. We can actually, someone must know. > But based on Apple's "DNA", it seems to ME that > Apple wanted to keep the process super simple Yes. > and may have balked at adding extra > steps in activating a card on ApplePay. They clearly did, and were right to do that given that the banks are free to notify the card holder that the card has been added to apple pay so that the card holder can report that fraud when it has happened. Clearly it is worth providing more information to the banks too, particularly information that can be used in an automated process to add more security to the registration process cheaply.