Apple Pay launches - but not for all

Credit: 360b/Shutterstock.com

Users will be able to make transactions of up to £20, in more than 250,000 shops and anywhere else that accepts contactless payments.

But not everyone who was expecting to be able to use their iPhone or Apple Watch to make payments from today will be able to.

Despite being listed among the first banks to support the service, customers of HSBC and First Direct will now have to wait until "the end of July".

Deceptively simple

Apple Pay isn't the only contactless payment system out there - we've looked at the other ways to pay with a mobile phone here - but being from the creators of the iPhone, it's the one many pundits are watching carefully.

Only people who have accounts with Nationwide, Santander, and the RBS group - including Natwest and Ulster Bank - or credit cards from MBNA and American Express, can use Apple Pay.

As far as using it goes, it couldn't be much simpler:

• A user stores the details of the card they want to pay with in the device's Passbook.
• With the iPhone, they simply hold it near a contactless reader with their finger over the phone's Touch ID scanner.
• Apple Watch users double click the side button as they hold it to the contactless reader.
• In both cases a beep and vibration will confirm that payment has gone through.

Behind the scenes it's much more complicated.

The card number itself isn't used at all after it's been registered with the device. Instead it's used to generate a "Device Account Number" (DAN) which is then encrypted and stored on a dedicated secure chip within the device, along with an encryption key specific to that DAN.

Each time a payment is made, the encryption key generates a fresh security code which is transmitted along with the DAN; the payment provider checks the two belong together before authorising the payment.

Apple say this is more secure than paying with a standard contactless card because none of the card's details are ever visible - to Apple, the merchant, or people hovering behind us in the queue.

Generating a fresh security code for each transaction means that anyone intercepting the information can't use it for themselves, either for other payments or to reverse engineer the original encryption key or card details.

All the same, Apple are warning against people with Apple Pay allowing others to add their fingerprints to their phones.

Some payment providers have also asked that users notify them as soon as a phone or watch is lost or stolen, just as we would if we lost a payment card, in order not to be liable for unauthorised spending.

Going it alone

Perhaps the biggest name yet to commit to joining Apple Pay is Barclays. They say they'll be offering it at some point in the future - but they already have two payment systems of their own.

In March, their Pingit app became the first to allow users to send payments to others using a Twitter handle.

They've also been providing contactless payment via the bPay wristband since last summer.

Last month they launched a new version of the wristband, alongside key fobs and stickers that attach to any flat surface - like the back of a mobile phone - last month.

Like Pingit, bPay is available to more than just Barclays customers; anyone who has a Mastercard or Visa debit or credit card can register for the service.

Before they can be used, the account holder must load them with credit, as they would with a prepaid card.

Users who manage their accounts online can set them up so each device has its own spending limits, or so that any cash paid in is available across all of them.

It's a much cheaper system to get involved in than Apple Pay, as there's no need to buy a brand spanking new phone - but it does cost.

The sticker - for turning that old Nokia into a contactless marvel - costs £14.99, the key fob costs £19.99, and the wristband is £24.99.

Playing catch-up

The cost of going contactless with anything other than our cards may be another reason it's taken so long for payment using near field communication (NFC) to catch on.

It's estimated that last year there were 58 million contactless debit and credit cards in circulation, with sales made using them up by 255% compared to 2013.

But there have also been concerns about security and speed as well as a lack of compatible devices thwarting efforts to get people using their phones to pay.

While the technology is arriving, it's taking its time.

Samsung Pay, announced in March, is only available on the Galaxy S6, although S5 owners can use their fingerprints to authenticate Paypal payments.

That's left plenty of time for Paypal to evolve, and for apps like Pingit and Paym to develop instead.

At this year's Mobile World Congress, Google announced plans for Android Pay as their new answer to Apple Pay, following a decided lack of enthusiasm for Google Wallet.

As well as acting as a standalone app, Android Pay is being talked of as providing the payment source for other apps. It won't replace Google Wallet, but it will be integrated into that service.

Like Apple Pay, Android Pay will use card details to generate unique authentication codes for each transaction - but unlike Apple Pay it will also store the card details locally so payment can be made when there's no data connection available.