Apple Platform Security
- Welcome
- Intro to Apple platform security
-
- System security overview
- Signed system volume security
- Secure software updates
- Background Security Improvements
- Operating system integrity
- BlastDoor for Messages and IDS
- Lockdown Mode security
- System security for watchOS
- Random number generation
- Communicating emergency information using satellites
- Apple Security Research Device
-
- Services security overview
-
- Apple Pay security overview
- Apple Pay component security
- How Apple Pay keeps users’ purchases protected
- Payment authorisation with Apple Pay
- Paying with cards using Apple Pay
- Contactless passes in Apple Pay
- Rendering cards unusable with Apple Pay
- Apple Card security
- Apple Cash security
- Tap to Pay on iPhone
- Secure Apple Messages for Business
- FaceTime security
- Glossary
- Document revision history
- Copyright and trademarks
How Apple Pay keeps users’ purchases protected
Secure Element
The Secure Element hosts a specially designed applet to manage Apple Pay. It also includes applets certified by payment networks or card issuers. Credit, debit or prepaid card data is sent from the payment network or card issuer encrypted to these applets using keys that are known only to the payment network or card issuer and the applets’ security domain. This data is stored within these applets and protected using the Secure Element’s security features. During a transaction, the terminal communicates directly with the Secure Element through the near-field-communication (NFC) controller over a dedicated hardware bus.
NFC controller
As the gateway to the Secure Element, the NFC controller helps ensure that all contactless payment transactions are conducted using a point-of-sale terminal that’s in close proximity to the device. Only payment requests arriving from an in-field terminal are marked by the NFC controller as contactless transactions.
Payment with a credit, debit or pre-paid card (including store cards) is authorised by the cardholder after using one of the following methods:
Biometric authentication
Device passcode or password
Double-clicking the side button of an unlocked Apple Watch
The payment applets in the Secure Element prepare contactless responses. The controller then routes them to the NFC field. In this way, the payment details stay within the NFC field and never reach the Application Processor. In contrast, payment details for in-app and web payments first go to the Application Processor. However, they are encrypted by the Secure Element before reaching the Apple Pay server.