4 ms·

> In fact, it's now easier to perform in-store credit > card fraud, thanks to such technologies. How is it easier for someone to perform fraud using Apple

> In fact, it's now easier to perform in-store credit > card fraud, thanks to such technologies. How is it easier for someone to perform fraud using Apple Pay? You'd need to both have and then unlock either my phone or watch to make a payment using them, which is still two-factor authentication...

mike_hearn 11y ago
Apple Pay is an effective way of 'laundering' stolen card details due to weak enrollment procedures.
- nommm-nommm 11y ago
  More info: http://www.nytimes.com/2015/03/17/business/banks-find-fraud-abounds-in-apple-pay.html http://www.nytimes.com/2015/03/17/business/banks-find-fraud-... An industry consultant, Cherian Abraham, put the fraud rate at 6 percent, compared with a traditional credit card fraud rate that is relatively minuscule, 10 cents for every $100 spent. Mr. Abraham wrote in a blog post, one of the first to spotlight the issue, that the Apple Pay fraud “is growing like a weed, and the bank is unable to tell friend from foe. No one is bold enough to call the emperor naked.” The vulnerability in Apple Pay is in the way that it — and card issuers — “onboard” new credit cards into the system. Because Apple wanted its system to have the simplicity for which it has become famous and wanted to make the sign-up process “frictionless,” the company required little beyond basic credit card information about a user. Nor did it provide much information to the banks, like full phone numbers and addresses, that might help them detect fraud early.
  - ubernostrum 11y ago
    This has largely been debunked elsewhere -- the fraud is entirely on the poor verification by the banks. When I got an iPhone supporting Apple Pay, I added two cards to it. One just set up with nothing more than entering the information. The other one triggered a phone call to the issuing bank where I had to jump through multiple verification hoops to convince them I was the cardholder. Apple can't fix the first bank's security problem, and I don't really expect them to.
    - serge2k 11y ago
      I had to call the bank for one and install the companies app (and login) for another. Both took a few minutes, not really an issue.
  - rwmurrayVT 11y ago
    It isn't that the process is so simple. It's that it allows fraudsters to convert their "fullz", previously used best online, to in-store Apple Pay cards. You could theoretically call into the victim's bank, and with their SSN + address + etc. add the card to Apple Pay. This would allow you to use the card in-store. Contrast this with previous use, where you the potential damage might range from taking over the account and performing online transactions. Being able to go from online transactions to in-store transactions is huge. But it's not so simple as just "type in the cc #, zip, and cvv". You need their entire details and to be very methodical. The issue is... people are easily convinced to part with all their identity information.

mike_hearn 11y ago

Apple Pay is an effective way of 'laundering' stolen card details due to weak enrollment procedures.

nommm-nommm 11y ago
More info: http://www.nytimes.com/2015/03/17/business/banks-find-fraud-abounds-in-apple-pay.html http://www.nytimes.com/2015/03/17/business/banks-find-fraud-... An industry consultant, Cherian Abraham, put the fraud rate at 6 percent, compared with a traditional credit card fraud rate that is relatively minuscule, 10 cents for every $100 spent. Mr. Abraham wrote in a blog post, one of the first to spotlight the issue, that the Apple Pay fraud “is growing like a weed, and the bank is unable to tell friend from foe. No one is bold enough to call the emperor naked.” The vulnerability in Apple Pay is in the way that it — and card issuers — “onboard” new credit cards into the system. Because Apple wanted its system to have the simplicity for which it has become famous and wanted to make the sign-up process “frictionless,” the company required little beyond basic credit card information about a user. Nor did it provide much information to the banks, like full phone numbers and addresses, that might help them detect fraud early.
- ubernostrum 11y ago
  This has largely been debunked elsewhere -- the fraud is entirely on the poor verification by the banks. When I got an iPhone supporting Apple Pay, I added two cards to it. One just set up with nothing more than entering the information. The other one triggered a phone call to the issuing bank where I had to jump through multiple verification hoops to convince them I was the cardholder. Apple can't fix the first bank's security problem, and I don't really expect them to.
  - serge2k 11y ago
    I had to call the bank for one and install the companies app (and login) for another. Both took a few minutes, not really an issue.
- rwmurrayVT 11y ago
  It isn't that the process is so simple. It's that it allows fraudsters to convert their "fullz", previously used best online, to in-store Apple Pay cards. You could theoretically call into the victim's bank, and with their SSN + address + etc. add the card to Apple Pay. This would allow you to use the card in-store. Contrast this with previous use, where you the potential damage might range from taking over the account and performing online transactions. Being able to go from online transactions to in-store transactions is huge. But it's not so simple as just "type in the cc #, zip, and cvv". You need their entire details and to be very methodical. The issue is... people are easily convinced to part with all their identity information.