Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: "Rod Speed" Newsgroups: misc.phone.mobile.iphone,comp.mobile.ipad,comp.sys.mac.system Subject: Re: Apple Pay Exposes Insecure Bank Policies Date: Mon, 23 Mar 2015 12:37:08 +1100 Lines: 59 Message-ID: References: <200320151703579843%michelle@michelle.org> <550da46e$0$34564$c3e8da3$dbd57e7@news.astraweb.com> <550f01cf$0$58829$c3e8da3$88b277c5@news.astraweb.com> <550f0c0b$0$56387$c3e8da3$38634283@news.astraweb.com> <550f5e1a$0$25083$c3e8da3$92d0a893@news.astraweb.com> Mime-Version: 1.0 Content-Type: text/plain; format=flowed; charset="UTF-8"; reply-type=original Content-Transfer-Encoding: 8bit X-Trace: individual.net cohTgONlKxC7isodhA0UeAG4rsZjE6SHj/Z+DAQqF8vy1TdTM= Cancel-Lock: sha1:zpZntfkm8vkYxl7w8rEvZYY65kI= In-Reply-To: <550f5e1a$0$25083$c3e8da3$92d0a893@news.astraweb.com> X-Priority: 3 X-MSMail-Priority: Normal Importance: Normal X-Newsreader: Microsoft Windows Live Mail 14.0.8117.416 X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8117.416 Xref: csiph.com comp.mobile.ipad:46837 comp.sys.mac.system:71880 "JF Mezei" wrote in message news:550f5e1a$0$25083$c3e8da3$92d0a893@news.astraweb.com... > On 15-03-22 19:26, Jolly Roger wrote: > >> The banks and Apple defined which information would be collected >> initially before launch. > > Sorry, but you cannot state that. You have stated you are not working > for Apple, so in that case, you have no way of knowing what really > happened. > > What we know is that the Apple web site on Apple Pay paints an overly > simplistic and inadequate process of just taking picture of a credit > card without providing any additional info. > > It seems to me like Apple told banks "this is all we're gonna provide, > if you need more, get customer to phone you to provide more". Not quite > "working togerther de decide what would be provided". > > >> The banks and Apple knew ahead of time what >> rough percentages of cards would fall into green, yellow, and red paths. > > Sorry, but with only credit card number, expiration and name on card, They get a LOT more than just that. > there is no way for a bank to gauge authenticity of request. But there is with what they actually do get. > So if they base a decision on some sort of customer profile, They don’t. > this basically means "we'll blindly authorize activation > becase this customer is a good customer" They don’t do that either. > without having any information whatsoever on whether the > person who requested the activation is actually that customer. That is a lie. > A smart bank would put all customers on "yellow" by default > to force customer to provide more info before acticating a card That would be a very STUPID bank indeed given the cost of doing it that way. > since the initial activation request coming through Apple's servers > contains insufficient inforamation to make such a decision. That is a bare faced lie.