The Economist explains

The security of smartphone payments

By G.F. | SEATTLE

THE Apple Watch has been available to order for less than a week, but by some estimates one million have already been sold. Technophiles are watching closely to see how the glitzy new product will change any number of emerging businesses, from wearables to mobile-health. Yet in the short run the Watch's greatest effect may be in the boost it provides to smartphone-based payment systems. Apple Pay is already available to many iPhone users, but the Watch, which allows consumers to buy things with little more than a wave of the wrist, could significantly accelerate adoption among Apple customers and retailers. Assuming, that is, that users warm to the new payments technology enough to get over fears about stolen accounts. They should. Though "Apple Pay fraud" headlines have not been uncommon in recent months, smartphone-based payments are typically more secure than credit cards. Why is that?

Smartphone-payment systems are not iron clad. The weak spot in any mobile-payment system, whether Apple Pay or another, is the point of enrolment, when a customer's existing credit card is linked to the system. Apple explains that as part of its enrolment process, it gathers a variety of markers about the user's online Apple account and phone characteristics, such as a rough approximation of its current geographical coordinates. Apple hands off these data to a bank, which compares them with known information. Most of the time, the details match and a card is added to a legitimate owner's handset. If the phone is in Nigeria, say, and the customer's home address is North Carolina, a red flag is raised. In such cases, the bank will request more information from an enrollee, which may mean phoning her up. This is where identity fraud most commonly occurs in mobile systems: clever criminals can provide enough information about the card's owner to pass a bank's tests.

Yet for that sort of fraud to occur, the thieves must have already obtained access to credit-card information. And after a card is enrolled on a given phone, the risk of misuse is vastly reduced. Mobile-payment systems do not store the number printed on a card, but rather generate a unique proxy for each handset enrolled. This number is stored securely either on a handset or in the cloud, and never leaves the phone except as part of an encrypted transaction.* The proxy cannot be used independently of the mobile-payment system and therefore is useless for a criminal. In spite of all this, comparatively few retailers accept payment by smartphone. In America, 9m retail outlets accept credit cards, but so far only 700,000 take Apple Pay. The Watch may help close that gap. Repeated breaches of corporate customer databases containing credit-card data for millions of accounts should not hurt either.

Smartphone-based payment systems are not the only way to improve security. America has lagged behind other rich economies in adopting chip-and-PIN cards, for which a passcode must be entered to authorise each transaction. By October 2015, all retailers and banks must at least accept chip-and-signature cards, or absorb all losses from fraudulent swipes (that is only a start however, PINs being more secure than signatures). Chip-and-PIN should reduce fraud, experts reckon, but will not eliminate it. Chipped cards deter fraud by requiring a legitimate chip, but the chips can be forged, and criminal organisations regularly manage the feat. Mobile payments, by contrast, deter fraud by creating an unforgeable transaction for each purchase. If the Apple Watch nudges consumers toward mobile-payment options, that may just call time on widespread credit-card fraud.

Dig deeper:
Apple hopes its Watch will jumpstart the "wearables" business (March 2015)
Smartphones are the defining technology of the age (February 2015)

*Correction: An earlier version of this piece said the number never leaves the phone, which is inaccurate.

Discover more

How can democracies respond to rigged elections?

A host of Western countries reject the results of Russia’s sham election

What is photo retouching and when is it permissible?

The edited photo of Kate Middleton shows what a minefield it can be


Who is Jimmy “Barbecue” Chérizier, Haiti’s most prominent gang leader?

The warlord is one of the country’s most powerful men—for now