Apple and banks dismiss Apple Pay fraud worries

CNN Money ^ | March 18, 2015 | By Jose Pagliery

[Swordmaker]

Apple Pay -- the new tap-to-pay system that uses your fingerprint to approve transactions -- is the safest way to buy stuff right now. But recent reports have noted that some criminals are using it for stolen credit cards.

. . .

But CNNMoney spoke to the nation's largest banks, an association of community banks and Apple (AAPL, Tech30). The takeaway? This high level of fraud isn't really widespread.

Banks also make this point: Banks get stuck with fraud costs. Yet dozens of small banks are in a long line to join Apple Pay by the end of 2015, according to L. Cary Whaley III, a technology policy expert at Independent Community Bankers of America. Why would they want to join if fraud is truly rampant?

. . .

"During setup Apple Pay requires banks to verify each and every card," an Apple spokesperson said in a statement. "The bank then determines and approves whether a card can be added to Apple Pay."

CNNMoney tested this out by setting up Apple Pay with debit and credit cards issued by several banks. The authentication process was indeed robust.

Bank of America (BAC) requires a phone conversation in which you must state your name, card number, driver's license number and the details of the latest check you wrote.

JPMorgan Chase (JPM) and Wells Fargo (WFC) send you a one-time verification code to the email or phone number it has on file.

. . .

In all these cases, you also get an alert from the bank that says you set up Apple Pay. Combined, these are big barriers for the typical fraudster.

So, if there's a high rate of fraud, why is it happening? Industry sources say there's only one possible hole: Not all banks are doing Apple Pay setup right.

[Swordmaker]

CNN Money investigates ApplePay sign-ups and finds they are "indeed robust" and finds that the only reason for the fraud working is that some banks are not using the robust means of checking those signing up. . . and then they quote a clueless ex-Google Wallet executive saying "It is both a bank and an Apple problem... but since Apple controls the platform, they can dictate the best practices," ignoring that Apple HAS dictated the best practices of how the signing up of cards must be done! — PING!

CNN Money: ApplePay Fraud Overblown Ping!

If you want on or off the Mac Ping List, Freepmail me.

[House Atreides]

Props to these banks who use robust security authentication methods (as should be standard practice). Any bank which is stupid enough to NOT employ sound authentication is asking to be defrauded and, after being burned by fraud, will quickly correct their inadequate practices.

[House Atreides]

Extract from the linked article:

Then again, Apple could fix this by demanding stricter verification from banks. That’s the point made by Mike Dudas, a former Google Wallet executive.
“It is both a bank and an Apple problem... but since Apple controls the platform, they can dictate the best practices,” said Dudas, who’s now at the startup Button.
*****************************************************************************************************

I think it interesting that, as a source, the writer goes to an Apple competitor’s former executive (the poorly received and failing ‘Google Wallet’).

[buckalfa]

"Any bank which is stupid enough to NOT employ sound authentication is asking to be defrauded and, after being burned by fraud, will quickly correct their inadequate practices."

One would hope that to be so in a sane world, but in the current bizzaro world, it is often more expensive for the firm to fix the security problem than it is to suffer the consequences of fraud.