Apple's ambitious new mobile payment initiative, Apple Pay, was announced on Tuesday during the company's iPhone event. Many questions still linger about the service, but information is beginning to trickle out from various sources as retailers, banks, and credit card companies prepare for the service's October launch.
According to a new report from The Financial Times, Apple stands to make quite a bit of money from its payments service. Banks and payment networks will be forking over 0.15 percent of each purchase to Apple, which equates to 15 cents out of a $100 purchase.
They are also paying hard cash for the privilege of being involved: 15 cents of a $100 purchase will go to the iPhone maker, according to two people familiar with the terms of the agreement, which are not public. That is an unprecedented deal, giving Apple a share of the payments' economics that rivals such as Google do not get for their services
According to bank executives, Apple was able to negotiate with so many partners and receive choice deals because the industry didn't see anything threatening in Apple Pay. One executive suggested that Apple's payment model continued to put banks "at the centre of payments." Apple may also have been able to negotiate better deals due to the tight security it has in place for Apple Pay. Payments will be made via NFC with a one-time token, and also secured with a Touch ID fingerprint.
Additional details about Apple Pay's security have been unveiled by MasterCard executive Jorn Lambert, who spoke to Bank Innovation, explaining how each transaction will be secured.
Along with the cryptogram generated between a standard debit or credit card and a point of sale terminal, Apple Pay takes advantage of a token system that encrypts every step of the payment process. Tokenization is already built into the standard NFC specification, so what Apple is really doing is utilizing existing technology and further securing it with its own Touch ID fingerprint authorization system.
Every card added to Apple Pay (and located in Passbook) is assigned a token, which Apple calls a Dynamic Account Number. Each Dynamic Account Number is stored in the secure element of the iPhone and accompanied by a unique cryptogram for each transaction.
[Touch ID] authentication prompts the "secure element" to send the token and cryptogram to the merchant. The network decrypts the cryptogram and determines whether it is authentic or not. If it is deemed authentic, the network will pass it along to the issuer (i.e. the bank), which then decrypts the token. In other words, every party to the transaction decrypts something.
Once the issuer decrypts the token and determines that it is authentic, the issuer/bank authorizes the transaction. Money is then credited to the merchant and marked as an amount owed by the cardholder.
The token system essentially provides an extra layer of security to payments made through NFC, which, as mentioned earlier, allows merchants to pay a lower "card present" rate for NFC purchases. Merchants still pay the higher "card-not-present" rate when payments are made over Bluetooth LE rather than NFC, however, or when a purchase is made in-app using Apple Pay.
According to Lambert, Apple is not handling tokenization, instead leaving it up to credit card companies like Visa, MasterCard, and American Express. He describes Apple's role as a "channel and not a party," and Apple itself has confirmed that it won't store any information about transactions conducted by customers.
Apple has plans to roll out Apple Pay beginning in October, and promises the program will work with more than 220,000 U.S. retailers including Walgreens, Macy's, Nike, Bloomingdales, and more. Some stores like Walmart and Best Buy claim to have "opted out" of Apple Pay, but users should be able to make payments via the service at any location that has an NFC-capable point of sale system.
Many retailers are currently in the process of updating their point-of-sale hardware, as an upcoming change will see merchants that do not support EMV credit cards being liable for fraudulent, lost, and stolen cards. EMV credit cards, also known as "chip cards," include integrated circuits to authenticate debit and credit card purchases. The updated point of sale systems with EMV card support being adopted by retailers also generally include NFC, which means Apple Pay may work even at stores that have not specifically chosen to support the service.