<p>Apple Pay is an actual step forward because it uses “tokenization”, a long, ugly word for a process that eliminates the transferring of your actual credit card number to the merchant and then to the payment processor and then to the bank for approval. What happens is this - copied so you can see I’m not making it up: “rather than receiving a card number, CVV, expiration date, and billing address from the customer, the merchant receives only a device-specific token and a dynamic, one-time-use security code. The token is translated into a credit card number only when it reaches the payment network, meaning that only the consumer’s bank and the payment network have information about both the person and the transaction.” In other words, no stealing your credit card number at Home Depot, etc. because there never is a credit card number to be stolen. </p>
<p>The underlying process for doing this is more complicated but it’s important. To quote Apple: “When you add a credit or debit card to Apple Pay, the information that you enter on your device by typing or using the iSight camera is encrypted and sent to Apple servers. If you use the camera to enter the card information, the information is never saved to the device or stored to the photo library. Apple decrypts the data, determines your card’s payment network, and re-encrypts the data with a key that only your payment network can unlock. Then it sends the encrypted data, along with other information about your iTunes account activity and device (such as the name of your device, its current location, or if you have a long history of transactions within iTunes) to your bank. Using this information, your bank will determine whether to approve adding your card to Apple Pay. Once your card is approved, the payment network or your bank creates a device-specific Device Account Number, encrypts it, and sends it along with other data (such as the key used to generate dynamic security codes unique to each transaction) to Apple. Apple can’t decrypt it, but will add it to the Secure Element within your device. The Secure Element is an industry-standard, certified chip designed to store your payment information safely. The Device Account Number in the Secure Element is unique to your device and to each card added. It’s isolated from iOS, never stored on Apple Pay servers, and never backed up to iCloud. Because this number is unique and different from usual credit or debit card numbers, your bank can prevent its use on a magnetic stripe card, over the phone, or on websites. Apple doesn’t store or have access to the card numbers you added to Apple Pay. Apple Pay only stores a portion of your actual card numbers and a portion your Device Account Numbers, along with a card description, to help you manage your cards.”</p>
<p>If you made it through that paragraph, it means your phone has a specific number set aside in a secure, isolated place which associates with a specific payment method like a credit card. When you buy something, that number is sent along with the details and a security code generated by the key referred to in the long paragraph above. No credit card info is sent at all. Hard to hack. More secure than the more advanced credit cards currently in use in Europe. </p>
<p>Apple Pay differs from Google Wallet in a key way: Google collects the card info and then charges your card on file with them. That allows Google to gather information about shopping habits that it can then use in its ad business. Apple. Note that a big reason breaches are a problem is retailers keep your card information on file. The idea behind Google Wallet is at least Google is less likely to be hacked and you trade information - how you spend your money - for that. Apple Pay eliminates the problem of stored information as well as of transmitted information.</p>