0

I've just added a card to my Apple Wallet and noticed that I didn't need a PIN. Now since Apple Wallet is apparently already "secure", I don't need a PIN to use it either.

Is this a loophole or am I missing something?

7
  • Safe from what?
    – schroeder
    Feb 1 at 8:55
  • 2
    Your iPhone with a decent passcode and touchid / faceID is secure. And apple wallet will again use faceID. You may not even notice it.
    – gnasher729
    Feb 1 at 17:55
  • @gnasher729 but if i steal a credit card and add it to my own phone, i bypass the pin
    – Coconut
    Feb 2 at 3:46
  • 1
    @Coconut What is unsafe about that? I don’t get the logic here. Do you mean the PIN of the stolen credit card? You can’t just add any credit card to your wallet.
    – gnasher729
    Feb 2 at 7:51
  • 1
    In the US, credit cards generally are not used with PINs. When adding a card to e.g. Google Wallet, the bank usually makes you confirm by entering a code sent via SMS or email. Feb 3 at 20:59

3 Answers 3

0

When you use the RFID function of your card, you require a PIN. However, with the same card, you don't need to use the PIN to make a payment online. Right?

When you add the card to the Wallet, you aren't using the RFID function of the card. You are using the RFID function of the Wallet. Apple then pays the vendor and requests payment from your card provider. Making it an "online" transaction. Hence, no need for a PIN.

The "safety" is provided by Apple. They take on the risk of a stolen card since they are by-passing the RFID protection of the card. The details of that financial liability is no longer an infosec question, but a legal one.

And it's not true that you never have to use a PIN: https://support.apple.com/en-gb/HT207435

1

There's a lot of missing information here, but generally, you cannot just add cards to a phone and pay with them. When you add a card to your Apple or Google account, you need to put in the CVV2 which is on the back of the card (or the card ID number on the front for American Express). This is usually sufficient to prove you have legitimate authorization to use the card. If that card is already on your account, then some issuers will allow it to be added automatically to your phone's NFC wallet.

Some issuers, especially smaller issuers such as credit unions, will want more confirmation, and will require a code to be entered from a text message or email or will require that you call them. Sometimes it is enough that the financial institution's app is on your phone, which the wallet app can request to perform authorization on your behalf knowing that you've logged in. I'm not aware of any situation in which you are not required to enter at least the CVV2 at some point in order to add the card.

To actually use the wallet app (and often, to enable it at all), you must unlock your phone. That always requires a PIN, pattern, or biometric (such a a fingerprint or face ID), and the app will not work without it. That's because when you tap to pay, the chip which contains the cryptographic keys for the wallet app will not perform the cryptographic operations unless you've authenticated recently, and just like with a regular chip card, the cryptographic operations are a required part of the transaction. In some cases, if your phone has been unlocked for too long (say, you've been playing on your phone waiting in a long checkout line), the phone will prompt you again to authenticate to verify that it's still you.

With a regular chip card, the PIN is required for authentication, and depending on your region and issuer, it may be verified by the card (offline PIN), or it may be encrypted and sent to the issuer (online PIN). In some regions, or for people with certain disabilities, chip and signature is the norm, and you will be required to sign for your transaction instead. For contactless physical cards, some transactions are approved without a PIN or signature if certain criteria are met (amount, currency, number of times the card has been used without entering a PIN, etc.) based on policies set by the issuer and card network.

However, with a phone, the operating system and its authentication verify your identity instead when unlocking the phone, which is considered sufficient. The card numbers for the "card" on your phone and your actual card number differ and the issuer can distinguish them. If a transaction comes in and says it's a phone and has been attested to by the phone and it's a physical card number, the issuer or the card network will decline the transaction as obviously fraudulent. Similarly, your phone's card number can never work as a physical card.

In any event, the typical approach used for phones is considered secure, and it's usually considered more secure than a physical card because of the need to constantly verify yourself to the phone for every transaction.

0

When you look at risks, you look at the probability of damage, the amount of damage, and the damage/cost of security. There is a situation with zero security on an iPhone: In some areas you can get on public transport with your iPhone and nothing else. I can get on public transport with your iPhone and nothing else. This works if your battery is so low that the phone turns itself off and has just enough power for low power blue tooth. Damage: A few dollars. Risk: Someone only needs to take my phone. Cost of security: Security could mean I’m stuck miles away from home and can’t get back home. Therefore no security is provided.

In general, to access my wallet, you need to unlock my phone, you need my phone passcode or faceID (just because my phone is unlocked doesn’t mean it lets you spend my money). And wallet provides the additional security that nobody can find the card number. Not the guy at the petrol station who takes payment, or the waiter that you hand your card over to. With wallet and Apple Pay nobody ever needs your card number. Basically apple invents a card for that single payment that can never, ever be used again.

1
  • That's not the risk the OP explains in the comment. If I steal your card, I need to use a PIN to pay with it; therefore I'm blocked. However, if I add it to my Apple Wallet, I can use it to pay for things because I've never challenged for a PIN. In fact, I could take your card, add it to my Wallet app, then put the card back. The OP appears to be concerned about this type of scenario.
    – schroeder
    Feb 4 at 15:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .