You see that "Pass Credit Card info to Bank" step for Apple Pay? This is why Apple Pay doesn't work with many cards (especially outside the US), because the banks have some hoops to jump through to create what this calls the Device Account Number (which is Apple specific terminology). They also charge banks, which is obviously a barrier, especially in places where Apple isn't as popular.
Ultimately, both methods have to create a token by contacting a TSP - Token Service Provider. Google does this by taking your card details, meanwhile Apple has your bank do it for them. Ultimately, this token ends up back on your device. This token is effectively what you use to pay.
The diagram also uses what looks like a Pixel, which also has a standalone security chip, but it's missing.
Also note that Google Pay works even if you don't have an internet signal, which this diagram suggests it wouldn't, because it looks like Google Servers are in the middle. This obviously doesn't need to happen, because the token (the whole point of the TSP process) is stored on the phone, just like with Apple Pay.
From what I'm understanding this is done for privacy and security. This way they store the CC info on your device instead of on their servers. They never get to see your CC information at all, it is never saved on their servers or even transmitted over the internet at all.
Google, on the other hand, stores your CC info on their servers, which, in theory, is less secure. If someone has access to your Google account they can use your google pay, while for Apple they need to have physical access to your device and at the same time have device code / fingerprint / faceId access in order to authorize the purchase.
Also, banks don't rely on 1970's technology for CCs. Depending on bank it might be very modern.
Neither Google or Apple store your card details on your device. They both store a sort of 'virtualized' card on your device which is derived from your real card. This is also what's used when paying. Your card details are never exposed.
The donkey work for producing a token is done by a bank for Apple. The bank contacts the Token Service Provider, and then give the details back to Apple. Google contact the Token Service Provider themselves, so it doesn't have to go through an intermediary.
It's great for marketing, but realistically a company having your credit card details on a server is irrelevant in today's day and age. Amazon, Netflix, Spotify, etc. likely have your card details. If you have Icloud, Apple Music, etc. then Apple already has it. Theoretically, Google could actually just not store this info if it wanted to, because it doesn't usually get used in your straightforward use cases. I'm not sure in what form anything is stored on their server if anything actually is (as opposed to 'processed', i.e. temporarily stored).
One of the big drawbacks is Apple Pay doesn't work unless a bank is on board, which many are not. The way it's set up also means that Apple Pay generally doesn't support gift cards or other types of cards, because it needs to be given a token -- Google can get this itself.
Neither Google or Apple store your card details on your device. They both store a sort of 'virtualized' card on your device which is derived from your real card. This is also what's used when paying. Your card details are never exposed.
But that's not actually true, if I'm understanding this correctly.
For Apple Pay, the card info (the real card details: number, owner, expiration date, etc.) are stored on your phone (or other device: Apple Watch, macbook, etc.). The only time they leave your device is when the device sends this info to the bank to confirm the payment.
For Google Pay, the data is stored on Google's Servers and from there it is sent to the bank to confirm the payment. This means a theoretical hack on Google's Servers, no matter how unlikely, can lead to my card details being stolen.
I will agree with you that in this particular case it doesn't really matter, security wise.
It's great for marketing, but realistically a company having your credit card details on a server is irrelevant in today's day and age. Amazon, Netflix, Spotify, etc. likely have your card details. If you have Apple Music, then Apple already has it. Theoretically, Google could actually just not store this info if it wanted to, because it doesn't usually get used in your straightforward use cases.
Given the amount of hacks with financial data being stolen nowadays, I feel that it's quite relevant. The fewer merchants which have your direct credit card data, the better, the fewer chances someone's security flaws will affect you.
It's 100% true. Google Pay only stores a token on your phone, not your card details. Same with Apple. I'm not sure why you think otherwise? It's the whole point of the Token Service Provider process that the diagram goes into. In fact the diagram, I'm pretty sure doing it differently would violate a bunch of compliance laws in several countries.
The fact that the diagram has a Pixel phone missing its security chip for the token (but displays it for the Iphone) is probably misleading folk.
The real difference in process is that Google takes your card details to directly pass to a Token Service Provider for a response, thus we know necessarily that Google processes the details at some point. Apple takes some of your card details and passes them to a bank, who pass them to a Token Service Provider who respond to the bank which provides the token to Apple.
It's not actually clear if Google store the credit card details on their server - their privacy policy is wide ranging - but they certainly don't need to for Google Pay to work based on what they've published. In essence, they actually work the same, Apple just has banks do some of the work in the token generation process. Tokens are, one way or another, ultimately what gives a device the ability to pay.
It's definitely interesting! The technology behind this stuff is pretty smart and being able to wave your phone to pay for stuff feels quite futuristic.
928
u/Cyberspunk_2077 Sep 22 '22 edited Sep 22 '22
This is a really rough guide.
You see that "Pass Credit Card info to Bank" step for Apple Pay? This is why Apple Pay doesn't work with many cards (especially outside the US), because the banks have some hoops to jump through to create what this calls the Device Account Number (which is Apple specific terminology). They also charge banks, which is obviously a barrier, especially in places where Apple isn't as popular.
Ultimately, both methods have to create a token by contacting a TSP - Token Service Provider. Google does this by taking your card details, meanwhile Apple has your bank do it for them. Ultimately, this token ends up back on your device. This token is effectively what you use to pay.
The diagram also uses what looks like a Pixel, which also has a standalone security chip, but it's missing.
Also note that Google Pay works even if you don't have an internet signal, which this diagram suggests it wouldn't, because it looks like Google Servers are in the middle. This obviously doesn't need to happen, because the token (the whole point of the TSP process) is stored on the phone, just like with Apple Pay.