Consumer Action Non-Profit Org. 1170 Market Street, Suite 500 U.S. Postage San Francisco, CA 94102 PAID San Francisco, CA CONSUMER Permit # 10402 ACTION Change Service Requested News www.consumer-action.org • Fall 2015 Mobile Payments Guide tap-and-pay terminals. Unlike other wider adoption cited by retailers platforms, Sam- are cost (NFC terminals can cost Electronic payments sung Pay can store and convey the $500 to install) and fear of security information traditionally contained breaches. on a card’s magnetic stripe to most Even so, the number of merchants using your smartphone point-of-sale terminals using a accepting has more than By Alegra Howard process called near field communi- technology called magnetic secure tripled in the last year to more than cation (NFC). In the store, payment transmission (MST). 700,000 stores. Android Pay is he idea behind mobile pay- information is transferred wirelessly accepted at over a million retailers, ments is simple: Instead of from a smartphone equipped with Acceptance including Duane Reade and Wal- paying with cash, check, an NFC chip to an NFC “reader” at If you are confused about which greens, Chevron, American Eagle, Tcredit or debit card, consumers can checkout. This is the same wire- retailers accept mobile payments, McDonalds, Jamba Juice and Foot use their smartphone to pay for less technology used by Bluetooth you’re not alone. According to a Locker. More than 18,000 stores purchases via a mobile app. (Apps devices, retail inventory control mobile payments survey by risk accept PayPal Mobile, including are software applications specifically tags and keyless door entry apps. In management firm Kount Inc., near- Famous Footwear, Dollar General, designed to run on smartphones order for the transaction to work, ly 24 percent of merchants accept Home Depot, Babies“R”Us and and other mobile devices.) the two devices must be close to payments from mobile wallets either Toys“R”Us. PayPal’s app features a To help consumers understand each other. Typically, customers tap online or in stores. Most retailers map of nearby businesses that ac- their mobile payment choices, their phones on the reader to pay have not converted their payment cept PayPal Mobile payments. Consumer Action looked into how (“tap-and-pay”). Apple Pay, Android terminals. The biggest hurdles to “Payments” continues on page 3 four of these payment systems work. Pay and use NFC Popular mobile payment systems technology. Apple Pay and PayPal Mobile re- In addition to enabling NFC Web Bonus cently gained two new competitors: tap-and-pay purchases, Samsung Android Pay and Samsung Pay. Pay also can be used at terminals Find a complete rundown on the mobile payment systems we examined as Find complete details in our that read the magnetic stripe on well as more related articles online! online Mobile Payments Guide the back of payment cards. When a (http://bit.ly/CA_News_Fall_2015) (http://bit.ly/mobile_payments_ credit, debit or gift card with a mag- • Mobile payments: What happens to all that data? guide_2015). Our at-a-glance chart netic stripe is swiped through a card appears on page 4 of this newsletter. reader at a store, financial details are Mobile payments collect a massive amount of data about our where- exchanged and the purchase is com- abouts and what we buy. How can we limit its use? The technology basics pleted. For many years, consum- • Beyond the popular payment systems Mobile payments made using ers have relied on magnetic stripe a smartphone typically employ a technology to pay, and the terminals Here are a couple of mobile payment apps that we thought you might short-range wireless communication are far more widely available than want to know about.

and Galaxy Note 5 devices; and An- technology to facilitate payment. droid Pay is compatible only with NFC allows devices to talk to each What to know before chip-enabled Android phones. (A other, so a consumer who has a de- list of compatible Android phones is vice with an NFC chip can pay by you pay on the go available at www.nfcworld.com/nfc- phone if a merchant has an NFC- phones-list/.) enabled terminal, or reader. NFC By Monica Steinisch Samsung Pay. These mobile wallets PayPal Mobile is in a class of its technology is what allows Trader or tap-and-pay systems are the only Joe’s customers to wave their phones ho needs a wallet when own. It’s available to anyone with a ones that are accepted in stores, at the counter to pay for groceries. you’ve got a smartphone mobile phone, regardless of make online and in app by unaffiliated or model, but does not (yet) enable Samsung Pay was launched in in your pocket? The abil- merchants. (See “Electronic pay- ityW to pay for purchases—from your tap-and-pay purchases. the U.S. on September 28 and, ments using your smartphone,” just morning coffee and weekly groceries uniquely, also works with traditional above. A chart on page 4 gives a Payment technology magnetic-stripe terminals—the to household items and electron- quick overview of the mobile pay- Pay-by-phone options fall into kind found in virtually every store ics—with a tap of your phone is ment platforms we reviewed.) becoming more available. two categories: digital wallets and nationwide where credit/debit cards We also reviewed retail mobile mobile payment systems. are accepted. Consumer Action researched payment systems implemented PayPal Mobile, a wallet, enables Android Pay launched two weeks your mobile payment options in by individual companies such as you to store account information earlier to replace Google Wallet as this ever-evolving market. Whether Starbucks, and CurrentC, a branded for credit cards, debit cards and Google’s mobile payment system. you’ve already embraced mobile payment app developed by a group bank accounts to make payments Google Wallet hasn’t disappeared payments or plan to get on board of retailers for use only in their in stores (at participating retailers), entirely, though. It is now the com- soon, this introduction to the sys- stores. (See more about this in our online and, in some cases, to indi- pany’s peer-to-peer payment system, tems, processes and protections will online Web Bonus story at http:// viduals. PayPal also allows you to allowing individuals to make pay- help you make informed decisions bit.ly/CA_News_Fall_2015.) about paying by smartphone. maintain a “wallet balance”—cash ments to each other. All but one of these payment stored in your mobile account—and PayPal Mobile account holders Small provider pool systems require a particular device. even receive money. may have two options to pay. They Apple Pay requires use of an iPhone Consumer Action’s survey features Apple Pay, Android Pay and Sam- will either enter a mobile phone 6, or an Apple Watch paired with the major mobile payment systems: sung Pay do not store funds. They number and PIN or use a one-time an iPhone 5 or later; Samsung Pay Apple Pay, Android Pay, PayPal are mobile payment systems that use four-digit code for purchases at a is designed for Samsung Galaxy S6 Mobile and the newest entrant, near field communication (NFC) “On the go” continues on page 4 (which are prepaid) likely would fall Consumer Action under CFPB consumer protections, www.consumer-action.org while Apple Pay, Android Pay and Consumer Action has been a Samsung Pay would not. (The latter champion of underrepresented link to customer bank and credit consumers nationwide since 1971. card accounts and do not store A non-profit 501(c)(3) organization, funds.) Consumer Action focuses on financial education that empowers PayPal has asked the CFPB to low- and moderate-income exempt its accounts from any new and limited-English-speaking rules if customers link at least two consumers to financially prosper. payment sources (credit, debit, pre- By providing financial education paid cards) to their PayPal accounts materials in multiple languages, that already provide consumer a free national hotline and protections. ongoing financial services research, Consumer Action helps Whether funds stored in a pre- consumers assert their rights paid account or mobile wallet are in the marketplace and make protected by FDIC deposit insur- financially savvy choices. ance will depend on where you Advice and referral hotline deposit the money. PayPal no longer offers FDIC insurance, but other Submit consumer complaints to prepaid accounts may. The CFPB’s our hotline: Emerging tap-and-pay proposed rules would not require [email protected] (415) 777-9635 or (213) 624-8327 FDIC insurance on prepaid prod- Chinese, English and Spanish consumer protections ucts or stored-value mobile payment spoken accounts. It would, however, require By Ruth Susswein resolution and fraud protection customer notice about the lack of San Francisco with most mobile payment services. FDIC insurance. 1170 Market Street, Suite 500 ne of the most significant Problems with mobile transactions San Francisco, CA 94102 concerns for users of mo- paid for with a linked credit or debit Disputes (415) 777-9648 bile phone payments—of- card typically should be taken up Google’s Android Pay, Apple Pay Oten called “tap-and-pay”—is how to Email: [email protected] with your card issuer. If you are us- and Samsung Pay are pass-through resolve disputes about fraudulent or ing a credit or debit card, you have mobile payment systems. This Ken McEldowney unauthorized charges. Executive Director the right to dispute errors and limit means you link a payment card Depending on the source of funds liability for unauthorized (fraudu- (credit or debit) to make payments. Michael Heffer Business Manager used to make a mobile payment lent) charges. Generally, credit cards If you spot a billing error, contact (such as a credit, debit or prepaid provide the strongest level of legal the issuer of the credit or debit Kathy Li protection, card you Director, San Francisco (SF) Office card), the rules governing unau- thorized charges differ. Currently, capping linked to, as Nani Susanti Hansen prepaid cards and mobile payments liability for Mobile wallet and prepaid card well as the Associate Director, SF Office don’t have the same legal protec- unauthor- users have no clear-cut dispute merchant Audrey Perrott tions as credit cards and debit cards. ized use at where the Associate Director, The Consumer Financial Protection $50. and error resolution rights. transaction Outreach & Training Bureau (CFPB) is aiming to correct Debit occurred. In Monica Steinisch that with its extensive proposal to most cases, Senior Associate, Editorial card users’ regulate general purpose reloadable liability for unauthorized charges you’ll have to wait until the pur- Jamie Woo prepaid cards and other stored-value is limited to $50 if reported within chase posts to your credit or debit Community Outreach Manager payment products. In some cases two business days, and up to $500 card account before you can dispute Joseph Ridout that will include mobile payments. after two business days. However, if it. If the problem is about a charge Consumer Services Manager Clarity by regulators will be consumers do not report unauthor- you didn’t make, then contact the Angela Kwan welcome because the current en- ized debit transactions within 60 card issuer immediately to alert Web Manager vironment is confusing. Reporter days after their statement is mailed, them that someone used your card Hazel Kong Bob Sullivan recently recounted they could face unlimited liability without your permission. Office Manager a consumer’s difficulty settling a even when the charges result from Lost phone? Apple Pay, Android Kinny Li, Cui Yan Xie Starbucks mobile payment dispute. theft. Pay and Samsung Pay do not store Project Associates Starbucks has a mobile app (and a Mobile wallet and prepaid card payment card details on the phone, Vickie Tse reloadable prepaid card) that can be users have no clear-cut dispute and and they require passwords or Development Coordinator linked to a debit or credit card and error resolution rights, although PINs to make payments, so ac- Rose Chan used to make payments in its stores. most issuers voluntarily provide cess to your payment information Consumer Advice Coordinator Ryan Benharris had $200 stolen “zero liability” assurances for fraud will be limited even if your phone Schelly Gartner, Tasneem from his debit card after his Starbucks on credit, debit and prepaid cards. is stolen. All three services offer Pitalwala, Ralph Stone a way to locate and lock stolen account was hijacked recently, but To help patch these holes, the Consumer Advice Counselors mobile phones. Apple offers Find that’s not why he was furious at the CFPB has proposed new rules that My iPhone Activation Lock (http:// Ricardo Perez firm. He was angry about what hap- would apply to prepaid cards and Mail Room Operations apple.co/1jr9p1Y). You can erase in- pened next. mobile payment systems that store formation on your Android phone Rain Lee “I had to beg and plead to get my funds. Here are highlights of the Administrative Assistant using the Android Device Manager money back,” Benharris said. “They proposed rule: (http://bit.ly/1Rm6L81). And Sam- Alden Chan, Robert La lied to me…I’m an attorney, and it • Access to information: Account sung users can use the company’s Support took me four hours on the phone and balance, payment history and a list Find My Mobile service (http://bit. six weeks to get a refund.” of possible fees must be easily avail- ly/1k84rXT). Los Angeles His [Starbucks] account, with $14 able online. PayPal says it investigates all (213) 624-4631 in stored value, was hijacked and • Error resolution: Financial reports of unauthorized account use Nelson Santiago hackers sucked two $100 payments institutions would be required to in- and tries to resolve claims within 10 Community Outreach Manager from his checking account debit card vestigate account errors in a “timely days. As to customer disputes, you’d onto his Starbucks app, and then off Linda Williams manner” or credit the account for better pay close attention to your Community Outreach & Training the app to a gift card they controlled. the disputed amount while continu- transactions. Manager Ultimately, Starbucks refunded ing to investigate. PayPal’s website (http://bit. the stolen $200-plus and sent him • Fraud protection: Losses would ly/1k84ymg) states that merchants Washington, DC a $100 gift card “for his trouble.” be limited on prepaid accounts and or sellers are advised to resolve dis- (202) 544-3088 (Read the story online at http://bit. stored-value mobile payment ser- putes with buyers within 20 days. If ly/1OxFGkC.) Linda Sherry vices. As with debit cards, consumer a problem isn’t resolved before that Director, National Priorities The bank that issues your debit liability would be capped at $50 if time, customers should contact Pay- Ruth Susswein card usually handles disputes, but in reported within two business days. Pal and ask to file a claim. After day Deputy Director, National Priorities this case a hacker accessed the debit Prepaid cards and mobile payment 20, disputes are closed and “cannot (Editor, Consumer Action News) card through a mobile payment accounts would have to be regis- be reopened or escalated to a claim.” Lauren Hall system. In this dispute, Starbucks tered (with the issuer or financial Regardless of PayPal’s policies, if Associate, National Priorities restored the funds—but is it the institution) to be eligible for reim- a credit or debit card was used in a Alegra Howard bank or the coffee company that bursement and other protections. contested purchase or for unauthor- Associate, National Priorities should be resolving your problem? Only mobile payment accounts ized (fraudulent) charges, Consumer Consumer Action News is printed by the Consumer protections for mobile that can store funds (mobile wallets) Action recommends that custom- Dakota Printing Company. We use Bitly. payments are what you might call would be covered by CPFB rules. ers preserve their legal rights and com to shorten lengthy Internet URLs. a “work in progress.” The underly- That means PayPal (which can store dispute the PayPal charge with their © Consumer Action 2015 ing funding source is key to error funds) and Starbucks accounts card issuers. n

Page 2 • Fall 2015 • Consumer Action News means you wouldn’t need to cancel Payments your cards due to a breach or if you lost your phone. Apple’s Find My How to get the most out Continued from page 1 iPhone feature also allows users to remotely shut down Apple Pay (and of mobile payments Consumers have been slow to other apps) in case the phone is lost Secure it. Apart from fingerprint fortification, the best way to ensure adopt mobile payments. Nine out or stolen. that your mobile wallet is as safe as possible is to password-protect your of 10 consumers who don’t have phone. a mobile wallet said they were Android Pay/Google Wallet Validate it. Android Pay requires you to enter a payment PIN unlikely to start using one, accord- Google Wallet was recently re- (personal identification number) before you tap and pay. PayPal also ing to a July Gallup poll. Just 13 launched as a peer-to-peer payment uses a mobile PIN or four-digit code. Samsung Pay and Apple Pay use percent of U.S. adults have a digital system allowing anyone with a U.S. fingerprint verification or PIN. wallet on their smartphone, and of debit card to send and receive mon- Turn it off. When not making a payment, disabling Near Field those, most hadn’t used it in the last ey for free using email addresses, month. While men and Millennials Communication (NFC) (under your phone’s Settings) will prevent oth- even if the recipient doesn’t have the ers from accessing your device. (now 14-34 years old) were more Google app. Now Android Pay has likely to use a mobile wallet, secu- replaced Google Wallet as Google’s Register it. Register your mobile payment account with the account rity was the biggest concern. More mobile payment system. Since the issuer to ensure that you qualify for all available consumer protections, than half cited fear of a lost phone system is so new, we found that we such as loss limits for fraud and theft and the ability to address billing or a data breach as reasons they had couldn’t get many of our questions errors. If you use a prepaid card as an underlying payment source, this not adopted the technology. answered through Google customer is especially important. Know before you go. Check online before you shop to see if your Apple Pay service but were able to learn more from Google executives. mobile wallet is accepted where you plan to shop. Apple Pay is a mobile payment Reap rewards. Register your loyalty cards or coupon programs in system that can be used to make Android Pay is a free mobile pay- your mobile payment account, or app, to receive discounts at retailers purchases in stores, at NFC-enabled ment app that comes pre-installed you frequent. terminals, and in certain apps. Its on new Android phones and is built-in app (formerly compatible with Android 4.4 Check coverage. If you store funds in a mobile wallet, ask if that called Passbook, now Apple Wal- KitKat (released September 2013) money is FDIC-insured. If it’s not FDIC-insured or otherwise protect- let) holds the user’s debit and credit and later versions. You can store an ed from loss, consider other payment options. — R.S. card information as well as loyalty unlimited number of credit, debit, card information, digital coupons, gift card and loyalty card numbers e-tickets and boarding passes. in the app, and shop at over one million stores using its tap-and-pay phone. Mobile users are asked to the Galaxy S6, S6 edge, S6 edge+ Apple Pay is compatible only with NFC technology. Eventually you register their cell phone number and and Note5 smartphones. Users also newer iPhones (6, 6S and 6 Plus); will be able to use Android Pay to set up a permanent mobile PIN. must provide a supported payment the app comes pre-installed on these make purchases online and in retail- PayPal will send you a text message card from a participating bank and models. However, iPhone 5 users ers’ apps. to confirm that your mobile num- establish a separate Samsung ac- can use Apple Pay if they have an ber has been registered successfully. count. Samsung Pay’s NFC tap-and- There is no fee to make a purchase Apple Watch, a small, wireless de- pay technology uses fingerprint ID with Android Pay. While you may PayPal Mobile users have two op- vice worn on the wrist that is com- verification to authorize transactions be able to make a few purchases tions for using their digital wallet to patible with an iPhone 5 or later. via the phone’s Internet connection. offline using the device’s memory, make purchases: If the phone can’t connect to mobile Every transaction on your iPhone typically you will need a mobile 1. Choose PayPal at a store’s broadband, you can still make requires authentication with Touch Internet connection to use tap-and- payment terminal and enter your purchases “off-” because the ID (an Apple fingerprint recogni- pay in stores with an NFC terminal. mobile phone number and PIN. Samsung Pay app can securely send tion feature) or passcode. To make To pay, tap your phone at the pay- Following a successful transac- card details for a limited number of a purchase, raise your iPhone to ment terminal and enter a four- tion, you’ll get a receipt from the transactions to merchants’ magnetic an NFC sales terminal with your digit Android Pay PIN to authorize merchant and an email notification stripe or NFC readers. You must au- thumb placed on its Touch ID payment. The terminal will flash from PayPal. Technically, this op- thorize these purchases at the point (home) button. You’ll feel a slight or beep to show your payment is tion doesn’t require your cell phone of sale with your Samsung Pay PIN. vibration and hear a beep, which complete. The four-digit PIN pro- to make purchases, just your phone tells you the transaction is complete. vides an extra layer of security since number and mobile PIN. Samsung Pay uses tokenization to You’ll receive a physical receipt Android phones don’t yet feature 2. Download the PayPal app, encrypt your financial details and from the merchant that includes fingerprint ID capability. which is free and compatible with does not share actual card informa- tion with merchants. A data connec- dollar amount, date, time, your Your receipt includes the mer- all smartphones. (The app displays tion is needed to generate tokens. name, the last four digits of your chant’s location, dollar amount, nearby merchants that accept PayPal However, as noted previously, a Apple account number and the transaction ID, date, type of pay- as payment.) The app will generate limited number of purchases can be bankcard you used. ment card used and its last four dig- a four-digit code good for only two made without reconnecting to the When the notification feature is its. You can review past transactions hours at a specific merchant loca- Internet. enabled, also will send in the app by selecting the card you tion. At checkout, choose PayPal you copies of transactions made used, but you will still need the and enter the code. An electronic If your phone is lost or stolen, with Apple Pay. Date and location merchant’s paper receipt to return receipt will be sent to you by email Samsung’s Find My Mobile feature of past transactions will be saved merchandise. immediately after your purchase. can be used to locate, lock or clear the phone. in your Apple Wallet but you’ll Like Apple Pay, Android Pay uses Recent transaction activity is stored need to review your credit card or in the PayPal app. tokenization technology, generating The emerging landscape bank statement to see the purchase a one-time virtual number for the PayPal doesn’t share your finan- PayPal and Android Pay will ap- amounts. transaction. In the case of a data cial information with merchants. peal to some consumers because Making purchases with Apple breach, thieves would gain access According to PayPal, as long as you both systems are compatible with Pay is free, and iPhone owners can only to a token number, not your don’t share your mobile PIN with older phones and operating systems. link to more than 2,500 banks and actual payment account details. anyone but the merchant, your Apple Pay and PayPal’s phone and credit card issuers. (Apple Pay is Card information is stored in information should remain secure. PIN option do not require a data accepted at many major retailers, Google’s remote Internet datacen- PayPal says that most of the connection or Wi-Fi signal to make including Bloomingdale’s, Duane ters (“cloud” storage). To allow for 18,000 stores that accept PayPal use purchases. (We strongly advise Reade, Walgreens, Macy’s, McDon- returns, the token remains active for its mobile number and PIN system against using unfamiliar or public ald’s, Nike, Office Depot, Panera 120 days following the end of the at checkout (option #1 above). Wi-Fi to conduct financial transac- Bread, Sephora and Staples.) month in which the purchase was Retailers that accept the mobile tions.) Samsung Pay is flexible about made. Apple Pay’s transactions are number and PIN do not accept a which terminals it can use. tokenized, meaning that every time PayPal four-digit code (option #2 Apple Pay is used, it generates a PayPal Mobile above). The two major chains that But if you’re still not sure which one-time payment number and PayPal is a digital payments pio- accept option #2 are Dollar General mobile payment system to use, hold security code. Your payment card is neer; many consumers use it as an and AutoZone. on to your real wallet for the time assigned a virtual number (token) intermediary to eliminate the need being. The mobile payment industry and saved in an encrypted chip on to reveal bank account or credit card Samsung Pay is rapidly evolving—it was changing your phone. Your credit or debt numbers to online merchants. The Electronics manufacturer Sam- even while we were double-checking card details are not stored on Apple’s PayPal Mobile payment app lets you sung launched its mobile payment the results of our initial research. servers and are never shared during manage your account, send money, system, Samsung Pay, in September. With Google still rolling out the transaction. request funds and pay at some The fact that it can use both NFC Android Pay features, Samsung Pay’s The merchant doesn’t see your brick-and-mortar stores, online and and MST technology might give recent launch and PayPal’s acquisi- payment account number or your via certain retailer apps. Samsung a leg up on the competi- tion of a mobile payment service name and Apple doesn’t collect any Before you can use PayPal, you tion, since 80 percent of merchants provider, Paydiant, consumers are transaction data. If your transac- need to sign up for an account worldwide are able to accept one or likely to have new mobile payment n tions were hacked, the stolen data either online or by downloading the the other. options in the near future. would be useless to thieves. This PayPal Mobile app to your mobile Samsung Pay is only available on

Consumer Action News • Fall 2015 • Page 3 Mobile Payment Guide: At a glance All mobile payment systems listed are free to use for making purchases. Some of the newer phones will have the mobile payment apps pre-installed. If the app you’d like to use is compatible with your phone, you can download it from the Apple App Store or Google Play Store. Find complete details on these payment systems at http://bit.ly/mobile_payments_guide_2015. Please note that you are prohibited from using Consumer Action’s name or any reference to its research in advertising or for any other commercial purpose.

Payment Funding Data/ID Find Accepted System Device Needed Sources Technology Protection Disputes Locations Android Pay Android Pay comes Google Wallet Near field Tokenization Bank/card Look for NFC symbol or (Google) pre-installed on new Card and/or communication hides user’s issuer MasterCard contactless Android phones and an unlimited (NFC) account payments at retailers. is compatible with number of information; Online: www.android. Android 4.4 KitKat and credit, debit four-digit PIN com/pay/#merchants later versions and prepaid cards Apple Pay iPhone 6 or higher An unlimited Near field com- Device account Bank/card Look for NFC symbol running iOS 8.1 or number of munication (NFC) number; issuer or Apple Pay symbol at higher; Apple Watch credit and tokenized checkout. Online: www. and the latest iPads debit cards transactions; apple.com/apple-pay/ also are compatible fingerprint where-to-use-apple- (iPhone 5 is compatible ID; financial pay/ only when paired with information not an Apple Watch) saved by Apple PayPal Mobile A mobile phone that Up to eight Mobile phone Login for app; PayPal Listed in the app. can send and receive credit/debit/ mobile PIN; Online: www.. text messages and/ bank accounts app-generated com/webapps/mpp/ or an Internet-enabled transaction store-locator mobile device codes Samsung Pay Samsung Galaxy S6 Up to 10 Near field Samsung’s Bank/card Because of its dual and Note5 models and cards (credit, communication Knox security issuer technology, it can be higher; Samsung Pay debit and pri- (NFC) and software; PIN used anywhere credit comes pre-installed vate label retail magnetic secure authentication; and debit cards are on compatible devices cards) transmission tokenized accepted and can’t be added to (MST) transactions; other devices fingerprint ID

embrace mobile payments. To foster unauthorized use of your mobile nearly any retail location. On the go the budding tap-and-pay industry, device—and the apps and data it PayPal’s system does not always payment processing companies like contains—is setting it to lock after a require you to have a mobile phone Continued from page 1 Square are giving away chip readers brief period of inactivity, accessible with you at the time of payment, as particular pre-selected store. (PayPal to many small and medium-sized only by passcode or fingerprint. long as you have the phone number also plans to introduce a wallet with merchants. For the time being, it’s unlikely and account PIN or transaction NFC technology by year’s end.) you’d be able to get by without car- code. Consumer protections Use of any of these systems is rying at least one payment card or Until PayPal adds NFC function- dependent on merchant acceptance. In terms of safety against fraud, some cash. ality, consumers who are drawn to Currently, only a small percentage mobile payments that use tokeniza- According to a CBS News story, the convenience of tap-and-pay of merchants are equipped with tion have the edge. Tokenization an AP reporter tried living for one technology may find PayPal more NFC-enabled terminals, but that substitutes a unique code (token) week last year in New York without suited for its traditional uses—on- number was expected to grow by for your identification and payment carrying cash or credit cards, relying line purchases/sales and money October of this year, when some information. Even if there were a only on payments with his smart- transfers—rather than mobile pay- stores installed chip-ready terminals breach, no card numbers are stored, phone. While he found that many ments. so the one-time-use token would to fight fraud and avoid being held places accepted mobile payments, All mobile payment systems are responsible for counterfeit credit be worthless for additional transac- many did not, and the transactions tions. free to make purchases. Choosing card purchases. were not always successful. Some- one of the payment options will The U.S. credit and debit card in- Apple Pay and Android Pay use times he ended up borrowing cash likely come down to which device dustry is in the midst of a transition tokenization. Samsung Pay uses for a meal, or walking home because you have or prefer to use and which to chip cards using EMV (Europay, tokenization for NFC payments, he couldn’t reload his MetroCard so payment system is accepted at the MasterCard, and Visa) technology, but not for MST payments (those he could ride the subway. Of course, places you like to shop. that read the payment information these difficulties should diminish which requires special terminals The mobile payment environment in the card’s magnetic stripe). PayPal with time. to read the embedded chip. Learn is changing so rapidly that consum- more in Consumer Action’s “A does not use tokenization. Weighing the options ers who are on the sidelines today consumer’s guide to ‘chip’ cards” Billing errors and fraud problems might be rewarded with even better (http://bit.ly/1hHjlTi). are usually handled by the underly- Of all the major mobile payment options tomorrow. n Some chip card terminals are also ing payment source—your credit or systems, Samsung Pay has a consid- able to “read” NFC-enabled mobile debit card issuer. (For more infor- erable advantage given that its com- devices. Many merchants are expect- mation, see “Emerging tap-and-pay bination NFC and MST technology ed to invest in the NFC function in consumer protections,” page 2.) has the potential to be accepted at Smart use of The best protection against these readers to serve shoppers who smartphones The Federal Reserve Board’s fourth  annual report on Consumers and Join Consumer Action Mobile Financial Services 2015 Consumer Action depends on the financial support of individuals. Consumer Action members receive a subscription to (http://1.usa.gov/1KbWJkw) looked Consumer Action News. New members also receive How to Complain. at how consumers bank and pay us- $25, Regular Membership ing mobile phones. It also examined You can join or donate online with a credit, debit or prepaid card consumers’ use of mobile phones to $15, Senior or Student Membership using our secure server: www.consumer-action.org/join. inform shopping decisions. $_____ Donation to our Publications Fund, supporting the free distribution of Consumer Action materials to consumers While the Federal Reserve found that only 22 percent of surveyed Name Address mobile phone users made a mobile payment in the 12 months prior City State ZIP to the survey, 47 percent had used their phone to compare prices on- E-mail address line, and 33 percent had scanned a Mail to: Consumer Action, 1170 Market St., Suite 500, San Francisco, CA 94102. Donations are tax-deductible. 10/15 barcode to find the best price while shopping at a retail store. n Page 4 • Fall 2015 • Consumer Action News