How does Apple Pay work on the Apple Watch
The question is, how
Although Apple Pay has been available for iPhone 6 and 6 Plus users since October, it works differently with Apple Watch, which arrives in retail on April 24. (Pre-orders for the Watch, which start at $349 and rise into the thousands of dollars from there, begin April 10.)
Here's a rundown on Apple Pay, its use on the latest iPhones and how it will work with the Apple Watch. Given the tight integration between the Watch and the iPhone, it's important to understand how the two work in tandem to enable what seems like a simple and seamless process.
Refresher: What is Apple Pay
Apple Pay is a digital payment system designed around security, privacy and speedy mobile transactions. Essentially, it replaces traditional magnetic-swipe credit- and debit cards with digital equivalents that can be used for secure in-store or in-app purchases. All purchase information is kept private; Apple doesn't receive or store any purchase details on its servers.
When a card is added via the Passbook and Apple Pay Settings panel in iOS 8 on your iPhone -- either by manual entry or by snapping photos of the card using the iSight camera -- the account is verified with the issuing bank, which creates a unique device-only account number. (That number is different than the one on the card.) The bank then returns card info as encrypted data that can only be decrypted by the issuing device -- in this case, your phone. The information is kept in what Apple calls the Secure Element, a dedicated hardware chip designed to store sensitive data. This happens for each card added.
The Passbook app acts as the front-end for this data, displaying the credit and debit cards that are active, as well as your recent transaction history.
About those security concerns
Every time Apple Pay is used, a one-time payment number and a dynamic security code is generated; your credit or debt card information is never actually transmitted. The data is sent through traditional payment networks, the encrypted device-only number gets matched with the issuing bank's database and the transaction is either approved or turned down. The merchant never sees your account numbers or even your name, and Apple doesn't collect any transaction data (though it does get a percentage of the transaction fees).
If someone managed to hijack the transaction and break the encryption, the data accessed would be meaningless. And if you ever lose your phone, there's no need to cancel any cards because the credit card data isn't on it anyway. (If you do misplace your phone, you can log into iCloud.com and use the Find My iPhone feature to stop Apple Pay.)
There were some initial security concerns with Apple Pay due to lax standards in bank authorizations. Fraudsters used previously stolen credit card data, and banks were authorizing cards without question. Now, any card that's added to Apple Pay requires a multi-step verification process, including authorization using the apps of issuing banks, and, in many cases, speaking to a live rep and answering security questions.
In stores, Apple Pay relies on the contact-less payment Near Field Communication (NFC) capabilities built into new iPhones. As long as the phone is not turned off, it will recognize a nearby NFC-compatible terminal and instantly display your default card. To authenticate the transaction, Apple Pay uses the iPhone's Touch ID fingerprint scanner. Here is Apple Pay in action.
Requiring Touch ID means no one who isn't already authorized to use your iPhone can buy anything; any attempts to do so will be thwarted.
Apple Pay gains ground
Apple launched the service with six major card-issuing banks and the three major networks as partners: American Express, Mastercard and Visa. They account for 83% of all U.S. credit card purchases. At launch, 220,000 locations already had the necessary hardware in place. (I first used it with my iPhone 6 at a McDonald's.) During Apple's Spring Forward event on Monday, Apple CEO Tim Cook noted that 2,500 banks now support Apple Pay, as well as nearly 700,000 locations, including some vending machines.
With that level of reach, it makes sense for Apple Watch to arrive with Apple Pay support. But the watch lacks the iPhone's Touch ID sensor, which until now was necessary for the system to work.
This brings us to the original question: How does Apple Pay work on the Watch The secret involves a four-digit passcode, NFC and the Watch's Secure Enclave technology working in concert with built-in sensors.
How it works on the Watch
To enable Apple Pay on the watch, you first create a four-digit passcode using the companion Apple Watch app (which is part of iOS 8.2). The passcode is used to authorize Apple Pay when you put the watch on your wrist, and it's smart enough to know when the Watch has been taken off. (It will prompt you to enter the passcode the next time you put it back on to help prevent someone from snatching your watch and using it to make payments.)
Once that's done, you have to add your cards again, even if you already have them on your iPhone. The reason is security; remember, the information in the iPhone's Secure Enclave is exclusive to that device. To associate a card with the watch, you must use the Watch app on a supported iPhone (which includes the iPhone 5, 5S, 5C, 6, and 6 Plus). The app allows you to add cards to Passbook and Apple Pay. As on the iPhone, cards on the Watch are verified by the bank and then issued an encrypted ID number, which is then stored in the Watch's Security Enclave chip.
Note: The Apple Watch will work with any iPhone 5 or newer, but only the iPhone 6, 6 Plus, Apple Watch (and the latest iPad) can use Apple Pay. You can still set up Apple Pay for the Apple Watch with an iPhone 5 (or 5S, or 5C), because the necessary Secure Enclave is in the Watch, not on the older phone.
Once Apple Pay is set up on the Watch, there's no separate app needed to use it -- and the iPhone doesn't even have to be with you. After it's pre-configured, the Watch can be used anywhere Apple Pay is supported. To make a payment, simply press the side button beneath the Digital Crown twice, and hold your wrist up to a payment terminal. The Watch will vibrate and play a confirmation sound when the transaction is complete. (To choose between credit cards, you use the swipe gesture after pressing the Watch button twice.)
As with the iPhone, iCloud.com can be used to remove the cards you've associated with a lost or stolen Watch. But since the Watch's sensors detect when it's off your wrist -- and require that four-digit passcode to authorize future purchases -- you're most likely safe.
Just a four-digit code
My only complaint I'd like to see a longer passcode. I have a 10-digit passphrase on my phone, and online passcodes that are two-dozen digits long. So the four-digit passcode seems like the bare minimum you'd want for basic protection. It'll be enough to generally protect users, but why limit the passcode to four digits Why not six, or eight I'd trust a 6-digit password over a 4-digit one, and an 8-digit code over a 6-digit one, for sure. It's not like it would take longer to tap in and would add a little more security to the device. But I'm obviously picking nits.
With its usual attention to detail, ease of use and user experience, Apple has made it easy to buy things using devices you carry with you anyway. It won't be long before the whole idea of taking out your wallet, fumbling for the right card, swiping it at a store and punching in a PIN code will be a distant memory. That day gets much closer as soon as the Apple Watch arrives.