Google, Apple and Samsung are not members of APCA and would be required to sign the voluntary code for it to be enforceable, even though the underlying payment systems they are using are APCA members. Apple Pay launched with American Express in Australia in November and Android Pay should be available here by April. Several banks – including Commonwealth Bank and Westpac in 2015 and NAB on Monday – have released their own digital wallets. But the software and phone makers wallets are expected to be more popular as any card can be used on them. The APCA consultation paper says Apple Pay was adopted quickly when it was first released in the US in October 2014, with 25 per cent of respondents to a survey in April 2015 by Clearing House saying they had Apple's mobile wallet app on their phones. A follow up survey in July found this had dropped to 13 per cent. The biggest reason cited for the drop was poor security. The decline followed reports of people using stolen credit card numbers and US social security numbers – which can be bought on the "dark market" online for as little as $US1 each – as proof of identity when loading their iPhones with card details. Fraud rates were reportedly up to 6 per cent on Apple Pay, compared with around 0.1 per cent for in-person transactions on cards. As well as lax practices at banks, the banks complained Apple didn't provide enough data on the phone owner to check identity. Some say mobile devices connected to the internet are more vulnerable to fraud. Online fraud is much higher than "card present fraud" because numbers can be stolen and quickly used to buy things online. Without strict ID checks, a stolen card number can be added to a mobile device as easily as a website. APCA's 2015 financial year statistics show online transactions account for 80 per cent of all card fraud and this rose by more than 25 per cent in the year to June from $256.5 million to $322.7 million. Ryan Yuzon, a director of bank consultant RFi, said US banks initially were slack about checking the identity of the user. Most now check that the phone number is registered to the same person as the card, as well as making other checks. As a result, fraud rates have declined, but he agreed this could change as mobile devices replaced plastic. "[Contactless] on the phone seems to offer a bridge for fraud perpetrated at the physical point of sale using stolen card numbers, rather than being limited to card-not-present payments." The digital wallet code, however, endorses existing methods of identification. Banks here require several documents, including passport or drivers licence numbers as well as salary and bank statements and employment details. Instead, it says the device and software makers should have identification and verification methods as strong as the banks. It would also make it compulsory to use a new security measure called tokenisation of card numbers if the device providers are not using security chips embedded in the phone or SIM card, which is considered as safe as present chip cards. Several new tokenisation methods store the tokens in software, which are considered more vulnerable to hacking.
Talks are ongoing between Australia's financial institutions and its mobile banking and payments companies, to establish a new security protocol. The new protocol aims to address the levels of security and privacy requirements for customer-sensitive information for banks and payment companies such as Samsung Pay, Android Pay, and Apple Pay. The proposed agreement would involve Samsung, Google, and Apple signing a voluntary code to maintain certain levels of security, which the regulator would then have the power to enforce.