[MBCook]

Apple has three advantages. First, it's on iPhone, which is a ton of devices. Second, they already have your credit card because you've used it to buy apps or music, etc. Third, people will know this exists because of the media.

So if you get a new iPhone, you're ready to start using it almost immediately. I'm sure I'll use it.

With Android, Google has to get you to sign up for wallet and get you to know that you should want to. Plus you had to have a phone that supports it (I don't know how common that is among high end Android phones).

This is one of those situations where "just being Apple" is a huge advantage.

[eevilspock]

Does Google Wallet have similar security features, such as not storing or transmitting your actual credit card number or your name, or use of a secure enclave in the phone hardware?

[thrownaway2424]

No. Google Wallet simply blurts the magstripe information into the reader over NFC. It has no security features to speak of.

[praxulus]

It doesn't use your card's number, it creates a virtual card and gives that number to the payment terminal.

https://support.google.com/wallet/answer/2676665?rd=1

[thrownaway2424]

Yes and who cares? It still is not secure. Anyone who gains the virtual card number can use it and the merchant system can charge arbitrary amounts of money to it.

A payment system that wasn't cooked up by weirdos would include actual security features such as your phone's display shows the amount of the transaction and you enter pin or password or other knowledge and your phone signs the transaction. That would be nonrepudiable and you could clear such transactions at negligible cost because there's little risk.

Square, which isn't exactly winning out there, at least does include a modest security feature of displaying the picture of the authorized card user on the terminal.

[praxulus]

I wasn't commenting on the security, just on the "blurts the magstripe information" comment. Apologies if you meant that metaphorically.

As for the rest of your comment, I don't think you're doing any risk modeling.

I have $0 fraud liability on all my cards. When fraud occurs, it takes a couple minutes to dispute a transaction. Even when it was a debit card, my credit union immediately gave me a provisional credit for the disputed amount while they investigated. The total cost to me for fraud is no more than a few minutes of my time. I have little reason to care about security.

Banks care about profit. What makes you think they haven't considered tighter security measures, and found that the cost of implementing them (including the inconvenience to consumers and resulting lost revenue) outweigh the savings from reduced fraud?

[dsimms]

That doesn't make any sense, no. Instead, they skip the secure element and transmit something non-standard (...by buying a bank and routing those through that, essentially acting as a proxy to the card networks?):

http://secureidnews.com/news-item/host-card-emulation-enable...