new iPhone payment system Apple Pay may offer several advantages, but it certainly doesn't add any privacy protection.
“With Apple Pay, you can use your iPhone 6 and iPhone 6 Plus to pay in an easy, secure, and private way,” begins the Apple Pay security overview. Well, it depends on what we mean by “private.” As with any commercial product, the user manuals portray the features much more ideally than the reality.
In terms of security, Apple Pay is definitely a step ahead of using the first credit or debit cards. Assuming, of course, that everything works properly and there's no bug. We've seen that happen all the time, haven't we?
Much of the project has been done in collaboration with banks that process credit cards on a regular basis. As MasterCard explains in its infographic , the iDevice doesn’t store the card number, but only the specific device with its Device Account Number (DAN). If another device attempts to make a transaction using the same DAN, the transaction won’t go through.
If the device is lost or stolen, the DAN of the device should be canceled, and not the card number linked to the DAN. This is one of the advantages of the payment system. But let's not forget that a card will never run out of battery and will still be necessary in stores that do not use high-tech systems. So to speak.
But let's get to the privacy side. Apple can't see what you've purchased, and the merchant can't see your card number. "Apple Pay doesn't collect any transaction information that can link the transaction to you, the merchant, or your bank," Apple's guide says.
[alert variation=”alert-info”]But to say that a transaction is “private” we would probably have to stretch the meaning of the word a lot.[/alert]
The time, location, and value of your financial transactions will be known to Apple and your card provider – or any other business that might share their data. The merchant knows what specific goods or services were purchased with that amount, but not who bought them. But in all of this, it’s true that there’s no matching of data – either directly between the participants, or by providing the data to data brokers like Acxiom, Equifax, Experian, or Datalogix, or by partnering with any of the companies tied to the many data-logging apps that already exist on your smartphone.
Considering the volume of data collected and exchanged these days, supposedly anonymous transaction data can be identified very easily.
In a recent data exercise, Neustar's Anthony Tockar analyzed a database of New York City taxi routes to find the home addresses of frequent visitors to Larry Flynt's Hustler Club. Finding their names would be an easy second step. It just takes more time, or more computing power.
As the International Business Times wrote about this research, “It only takes one or two other pieces of information to turn seemingly anonymous metadata into accurate and specific information about millions of people. – And not just those who are famous.”
In recent years, other researchers have found that they could recognize and identify Netflix users from the ratings they give a movie.
Now add all of the above with the security cameras that almost every retail business has and the fact that facial recognition technology is constantly evolving, reports ZDNet.
Apple Pay can't give merchants any data that allows them to create logs of what a particular customer bought, but their security systems can help. If the customer does anything in the store, it provides timestamps and geotags in the data log that can be easily cross-referenced. So the anonymity disappears.
