> I'm thinking about how chip and PIN has been cited as a way to move fraud liability to the consumer. Banks can't do this. Since security researchers managed

> I'm thinking about how chip and PIN has been cited as a way to move fraud liability to the consumer. Banks can't do this. Since security researchers managed to fool they bank into believing a transaction was PIN verified while not actually being the case, banks have to prove that a transaction was PIN verified, and I believe physical access to the card is required to do this. > To dumb it down: I'm envisioning a crappy future where you'll end up with fraudulent charges on your credit card (via your Apple account) that you can't contest because the credit card company will say "Hey-- your fingerprint was used to authenticate this charge. Therefore you did it." I don't think that line of thinking is too cynical. This is not going to happen unless there is an unimpeachable way to prove that the transaction was signed with a fingerprint. Since Apple have said that fingerprint data will not leave the device and is stored separately in a HSM-esque manner, I'm interested to know how this could be done.