Apple Pay and other mobile payments: Why we still don’t use them

When Apple Pay was first announced back in September 2014, I was very enthusiastic about it. Finally, a dream come true! Someone, and not just someone but the biggest company in the world, had come up with a new generation of payment technology that would combine mobile and biometric forces. The long chain of disappointments, however, started almost immediately.

Disappointment 1

First, it turned out that the “new technology” was nothing more than just a dexterous combination of our old, limping friends — plastic magnetic bank cards and EMV (EuroPay, MasterCard, Visa) chip cards — seasoned with shiny TouchId (which isn’t a new technology either, to be honest). Well, I thought, remembering the classics, maybe there is nothing new under the sun and Apple Pay isn’t an exception. At least it provided a more convenient way of payment than the older predecessors it imitated behind the scenes. So I patiently waited for the upgrade (not timed with either an iPhone or major iOS release) that would bring me Apple Pay.

Disappointment 2

While waiting for Apple Pay to arrive, I decided to learn more about the details of new technology. But it turned out that Apple hadn’t bothered to provide an exact technical description of Apple Pay components, which led to multiple speculations and concerns about its level of security. For example, it was unclear whether the actual card PAN (Primary Account Number) or its “scrambled” version was stored on the device.

Disappointment 3

Finally, Apple Pay arrived on October 20, 2014, and I managed to enter in one of my cards. It did not accept all of my plastics, however. In fact, it did not accept (and still doesn’t) the one I use for day-to-day grocery shopping. No matter, I rushed to the closest grocery store to impress myself and the cashier.

Disappointment 4

Unfortunately, the store’s payment terminal ignored all my attempts to wave the phone using various trajectories. The cashier asked me what I was trying to do. When I explained, she did not seem to understand. Finally, I pulled out my card, finished the transaction, and headed to another store, where I experienced the same situation. It turned out that most merchants didn’t — and still don’t — support Apple Pay. Eventually, I found one that did and managed to make my first Apple Payment. It worked surprisingly quickly and smoothly.

Disappointment 5

However, problems began with my second or third payment. My transaction was declined. A second attempt did not help. The cashier told me I didn’t have enough money in my account. Since it was actually a debit card behind the Apple Pay mask, I started worrying about my bank account: had it been hacked? Fortunately, since I could not use Apple Pay in most stores, I still carried my plastic cards with me. So I swiped a card through Apple Pay (the same card that had been declined just a minute earlier), and, lo and behold, it passed. I thought the mistake was an occasional glitch that Apple would soon fix. But when I tried to use Apple Pay several days later, the result was exactly the same. That was my last try. I didn’t want to explain to skeptical cashiers anymore that I did actually have money in my account.

Now I am even more convinced that systems like Apple Pay, Android Pay, and Samsung Pay, which just pretend to be new technology but in fact are complicated (and therefore unreliable) superstructures based on multiple old mechanisms, must eventually be superseded by completely new things. For example, Bitcoin or future cryptocurrency technology based on the Bitcoin concept but supported and enhanced by the banking and payment industries would be good candidates for universal payment systems for several reasons.

First, cryptocurrencies are open source protocols not linked to particular brands like Apple Pay or Android Pay, which makes them more attractive and accessible for everyone. Second, they are totally new, revolutionary technology compared to magnetic stripes and even EMV, which are already 30 – 50 years old (remember that most existing mobile payment solutions are still using plastic cards underneath their shiny modern facades).

Finally, Bitcoin, unlike plastic cards (and mobile payments!), is much more secure as it is based on strong cryptography and does not have a single point of failure in its implementation. At least in theory. But that is topic for separate discussion.

Slava Gomzin is author of the book Hacking Point of Sale (Wiley, 2014) and is working on a new book about Bitcoin payments that will be published soon. He is Director of Information Security at PCCI (Parkland Center for Clinical Innovation). Prior to joining PCCI, he was a security and payments technologist at Hewlett-Packard, where he helped create products that are integrated into modern payment processing ecosystems using the latest security and payments technologies. Before HP, he worked as a security architect, corporate product security officer, R&D and application security manager, and development team leader at Retalix, a division of NCR Retail. He holds CISSP, PCIP, ECSP, and Security+ certifications. He blogs about payment security and technology at www.gomzin.com.