Suppose I work for a bank and am asked to write an NFC payment app for the iPhone 6 or Android but not use Apple Pay. To simply send the credit card details to the reader via NFC.
Now assume I'm not storing the credit card details using a one-one hash that the credit card company at the other end will match to validate the payment. Assume I'm simply giving the credit card details to the reader, in a similar fashion to a shop-assistant manually typing in the credit card numbers into the reader when the magnetic strip fails.
To do that - I've got to store the credit card details in either un-encrypted, or two-way encrypted fashion on the iPhone or Android.
If I store it as unencrypted on the iPhone or Android - then any other app could read the data and potentially send it on for nefarious use. (Similar to the way that FileApp works).
If I store it as encrypted on the iPhone or Android, then it has to be a two-way encryption, and then any other app that uses that encryption mechanism can read the data from the phone. (Ie - you could obtain the encryption mechanism by reverse engineering LLVM bytecode of my application).
My question is: Is building an NFC payment app without a secure element like Apple Pay for iPhone or Android fundamentally insecure?