Apple says Apple Pay fraud isn’t its fault or its problem

To convince consumers to make purchases with their phones, Apple has touted the state-of-the-art security features of its mobile payment system Apple Pay. Those include tokenization (which provides merchants with one-time use tokens instead of credit card numbers), storage of sensitive information on the device’s secure element, fingerprint verification, and encrypted data transfer. But it appears Apple didn’t account for one major vulnerability: social engineering, a term for the tactics hackers use to gain access to personal accounts by posing as the people whose identities they’ve stolen. This was the very weakness that led to last fall’s high-profile iCloud breach, when hackers leaked nude photos of celebrities online. The company insisted then there wasn’t “any breach in any of Apple’s systems.” While technically that may have been true—hackers gained access to accounts not through Apple’s infrastructure but likely by using widely known details about celebrities to answer security questions—customers felt stung from the experience.