EMV is indeed secure. The problem is as you said, a physical card enables the opportunity for non-EMV fraud to take place. That’s why the cards aren’t secure because the very fact you have to use them for refular card payments not just contactless payments, provides multiple ways to exploit the card just by the fact that it is a visible object with exposed digits printed on the card.
Apple Pay doesn’t have this problem. I’m not on about security of the contactless tech in the card, just that an old fashioned debit or credit card is significantly less secure because your cards details are visible to the whole world. If I lose my phone, I don’t have to worry about my card details being used for fraud in the time it takes me to cancel the card and can remotely disable Apple Pay for added peace of mind.
So in the UK as it stands, none of the major banks are offering this service. As others have mentioned Barclays and Santander offer this with contactless cards and android devices.
In the UK I’ve only found it available with a few privately owned ATMs in and around London. In the US it’s much more common as banks actively support Apple Pay ATM withdrawals. The roll out was in 2016 for the USA but it hasn’t seen mainstream adoption over here just yet. I suspect it might be because by the end of 2015 US merchants and banks needed to update payment systems to support chip and pin else they risked being fined for fraudulent transactions made using a signature. Makes sense that they’d add support at the time.
God knows why Barclays etc haven’t added Apple Pay support. I can only assume it’s either they need an agreement with Apple to do this or their is a technical reason for not implementing it yet.
A couple things, though I disagree far less than with your initial posts There’s no rotating security code unique to Apple Pay, etc. But still, here is some food for thought:
It’s very rare that anyone will ever see your card when you pay. This is more an issue in countries like the US that haven’t finished their EMV migration (and due to the fact tip adjustment is allowed in the US, and PIN is commonly disabled, will remain an issue even post-EMV migration finishing). It’s true that Apple Pay - or just tapping a contactless card - is safer; these shops don’t take these payment methods, so it’s not an option.
You can remotely disable a physical card if it gets stolen, too. That said, Apple Pay doesn’t allow no CVM transactions in a meaningful sense (even if the terminal uses no CVM, the Apple Pay won’t actually send a card until you complete its CDCVM process - fingerprint/face/PIN). This de-facto forced CVM (again, the transaction can not use it, but you still need to complete the process to start a transaction) does help prevent lost/stolen fraud, no doubt.
a. I still prefer Android Pay’s approach which only requires CDCVM on-device steps to be completed when CDCVM is needed, under £30 you can just tap without unlocking. This makes it far more feasible for the Tube…
Barclays has Apple Pay, I used it when I had an iPhone. It’s Android Pay they don’t have (in the UK, I believe they got it in the US…).
100% sure, if they didn’t then one would be able to clone them easily (like is shown in so many RFID-blocking wallet adverts and scare news stories, but isn’t really possible).
It is worth noting that the rotating CVV from magstripe contactless is vulnerable to pre-play attacks, though not true cloning. This is easier to avoid with mobile wallets simply because it’s harder to get a read without consent.
Ideally, magstripe contactless will go away, but we can see the opposite happening - look at Monzo, they used to not support magstripe contactless, then they added support to prevent declines in the US. It would be nice to have a switch for it…
I was responding to somebodies question about cash withdrawals with Apple Pay in Barclays and other UK banks generally not general Apple Pay support. You can withdraw cash with android pay at an ATM in some banks now but Apple Pay doesn’t offer this in UK banks at the moment, just state side.
I actually needed Monzo Apple Pay the other day… forgot my wallet but had my phone. Needed to make an emergency purchase… had to use Tesco CC as didn’t have Monzo on Apple Pay but unfortunately, Monzo aren’t allowed to talk about it… it’s coming they’ve made it clear its coming… we just have to wait…
Monzo’s hands are tied by Apple… blame Apple not Monzo
Note though that they are dealing with a third-party here - so even if their app integration and everything else in the backend was ready to go live, they can’t do so unless Apple gives them the go-ahead. So obviously it would be nonsensical to even hint at when it would be released, although from what some Monzo employees have posted here (including @anon91821566 on Twitter last month with something along the lines of “keep your eyes peeled for an announcement”) suggests that they aren’t far off.
It could be that it is planned within that time frame but setbacks DO occur. Doesn’t mean you move it out and it’s far better to aim higher than you think you can reach.
There’s no rotating security code unique to Apple Pay, etc. But still, here is some food for thought:
not general Apple Pay support. You can withdraw cash with android pay at an ATM in some banks now but Apple Pay doesn’t offer this in UK banks at the moment, just state side.
to view the full post.