Apple Pay FAQ

10|2014

1. What is Apple Pay™? What does it mean to merchants and their customers?

With the new iPhone® 6 release, Apple® is poised to accelerate the growth of mobile commerce and catalyze the “card-less” environment in an unparalleled manner. It provides a digital “wallet” in the device, in which consumers can store payment options that can be used to ‘tap and pay’ for goods and services. This contactless use of a mobile device to perform payment transactions is facilitated via Near Field Communication (NFC) communications technology. While contactless payments have been around for a while and First Data can expertly support them, the ability to use one’s phone to ‘tap and pay’ – particularly at so many merchant locations, with so many payment options – is a brand new development for the marketplace. Consumers will begin utilizing their phones to transact more frequently, and will expect that they can be accepted everywhere. This means we should encourage our Clients to be ready to accept mobile payments – from their new Clover Station™ solution, or their contactless terminals.

2. How secure are Apple Pay transactions?

Apple Pay software in the new iPhone 6 with iOS 8 leverages Tokens to initiate transactions, eliminating the use of the card number within the transaction flow from the merchant, the Acquirer, and to the Network. The Tokens are generated within the hardware- based Secure Element (a special chip processor) of the device and are not usable independent of the device. Biometric identification on the device is required for initiating the transaction and further secures against the possibility of fraudulent transactions being conducted on stolen devices. (See the section on Tokenization Security for more on this topic.)

On the acquiring side, the merchant may also be eligible for transaction protection with the TransArmor® solution. This protects all transactions not only those from Apple Pay with data encryption and tokenization throughout the payment journey.

3. Which merchants can participate?

Any merchant can participate, provided they have the POS equipment that accepts contactless transactions, and the acquirer/processor must be compliant with networks’ requirements. The Clover Station solution is a strong option which encourages a merchant to accept contactless payments from Apple Pay – and all other contactless payment cards. First Data also supports contactless terminals. Terminals must be ISO 14443 or 18092 compliant; usually these terminals will show the universal contactless symbol.

If a merchant asks how they can also participate with their own payment option in the Apple PayTM “passbook”, investigate whether they have an online presence, or a developer that they work with. If they don’t, refer them to a business consultant who can help them get started with First Data’s eCommerce solutions – as well as the ability to accept Apple Pay. If they have a developer in mind, simply refer them to Payeezy.com for a developer tool kit that will assist them in integrating the Apple Pay solution to their application.

4. What is First Data™s role in enabling Apple Pay?

First Data views Apple Pay provisioning and acceptance as an enhancement to the many innovative solutions we have introduced during our business transformation. In addition to ensuring both FI and Acquiring platforms’ readiness and compliance with network requirements, First Data is helping issuers participate in the inApp experience by provisioning their services to the “passbook” and with integrated token processing services. First Data can also help large merchants with their own payment solutions provision to the inApp experience, and helps merchants of all sizes and in all locations with contactless acceptance.

5. What do I, as a merchant, have to do to accept Apple Pay with these new devices?

There has never been a better time to consider an upgrade to your Point-of-Sale. With EMVTM requirements around the corner, and the opportunity presented by Apple Pay acceptance, you may want to consider the Clover Station solution. It has everything you need to transform your POS into a business partner, and now it can accept Apple Pay, too. If Clover isn’t the right fit for your business, consider an upgrade to a First Data contactless terminal. An upgrade to the Clover Station or a contactless terminal will help your business be ready for the future with EMVTM compliance, and also securely accept Apple Pay with ease.

6. How can I let customers know I accept Apple Pay transactions?

When you receive your new Clover Station solution or contactless terminal, you will receive a sticker to help you communicate your acceptance of contactless transactions – inclusive of Apple Pay. Contactless terminals also display the universal contactless symbol on the terminal itself and in the digital display.

7. What payment network choices do I have in accepting Apple Pay and how do I, as a merchant, exercise that choice?

Visa®, MasterCard®, American Express®, Interlink® and Maestro® are participating at launch. Please consult with your Business Consultant to help you determine the appropriate POS equipment that best facilitates these transactions in your environment, and suits your business needs.

8. Will contactless work for all types of cards, including debit?

Apple Pay supports MasterCard® and Visa® credit and signature debit transactions, American Express® credit transactions, Maestro® transactions and Interlink® PIN debit transactions.

9. Are there plans to extend this program to other mobile devices beyond the new Apple device?

As of now, only the new devices being introduced by Apple this fall will support In-Store and inApp solutions. It is also expected that other device manufacturers will also leverage similar payment methodologies after the launch of Apple Pay.

10. Can my customers use Google Wallet for contactless or is there any other specific digital wallet that needs to be enabled?

The Apple Pay Digital wallet, or “passbook”, is needed in order to facilitate an Apple PayTM transaction. That said, should a customer have an active GoogleWallet, it will also ‘work’ on the NFC-enabled contactless readers for both Clover Station and contactless terminal solutions.

11. Does this program support multiple/foreign currencies?

No, Visa®, MasterCard® and American Express® have currently only mandated/made available transactions in the U.S. at this time.

12. Is there training available for my staff to learn how to use this new technology at the store level?

While we do not have a formal training program for your staff, information about the Clover Station solution can be found here, along with more information about the many ways we support small and mid-size businesses for growth. For more information about our contactless terminal options, please visit www.firstdata.com.

13. Does a cardholder have to use their physical card with a merchant before they can use the Apple Pay?

No. The Apple Pay solution works just like the card – only the consumer “taps and pays” with Apple Pay instead of “swiping” the card at the point of sale. A cardholder should be able to use Apple Pay just as she/he does a card – it’s just the manner that’s different.

14. Is Apple Pay a new NFC-based payment system, or based on existing standards?

Apple Pay issuance is based on existing EMVTM contactless standards, including MasterCard PayPass®, Visa PayWave®, and ExpressPay from American Express®. NFC acceptance standards have been in place since 2004. The Clover Station solution and First Data’s contactless terminals adhere to these secure contactless (NFC) acceptance standards.

Pricing

15. What does Apple Pay cost me? Am I charged card-present or card-not-present rates?

NFC-based transactions are treated just like other in-store transactions (assessed at Card Present rates). In-app purchases operate and are assessed as eCommerce transactions (even if executed in store).

Differences Between Other Initiatives

16. What is the difference between First Data’s TransArmor® solution and First Data’s issuer token processing solution?

TransArmor is First Data’s innovative merchant solution that employs a combination of end- to-end encryption and tokenization, solving for our merchant clients many of the vulnerabilities that exist in the payments-processing chain.When combined, encryption and tokenization provide an effective method for securing sensitive data throughout their lifecycle. SMBs can enjoy not only this level of industry-leading data protection for their business and cardholders’ sensitive cardholder data, but will also benefit from other aspects of the solution: streamlined payment card industry (PCI) compliance, EMVTM protection from fraudulent card usage; up to a $100,000 waiver for card association fines or costs in the event of a security breach, and live, expert help when they need it.

First Data® Integrated Token Services supports issuing clients with cardholder protection. It replaces the personal account number (PAN) with a token (a proxy number) within a digital wallet or card-on-file merchant. The solution uses the token rather than the PAN between the merchant and the Brand (American Express®, MasterCard®, Visa®). The token remains valid as long as the PAN is valid. The token is stored and maintained at the corresponding Brand, serving as the TSP.

17. I am a TransArmor solution customer. How will this affect my use of TransArmor?

Acceptance of Apple PayTM will not impact TransArmor processing; in fact it will enhance your mobile acceptance transaction protection. TransArmor offers an additional layer of protection where the token PAN will be re-tokenized. All other non-token transactions (non- mobile or contactless) will remain secure throughout the payment journey via the TransArmor solution process.,/

First Data Tokenization Security

18. Is First Data supporting Tokenization?

Yes, First Data is participating in the launch of this initiative.

19. How does Tokenization work?

Tokenization is a secure approach to transaction processing. The token replaces the original cardholder account number and is utilized in the transaction processing process. Merchants do not receive actual cardholder account number. It removes the risk for merchants having to securely store the original cardholder account number. This greatly reduces the risk related to useful data for committing fraud in the event of a data compromise.

20. How does tokenization impact my reporting and CRM systems that used to rely on a card member (PAN)?

Any system that ties the card account to an individual will be impacted, as the token assigned to a card will be unique by device or card/merchant combination. The same account holder may appear as two tokens depending on use case.

21. Can I discount my TransArmor® solution fees since I can now tokenize a card?

No, TransArmor and Tokenization are different. Please see response above in Question 16.

22. What entity assigns the token?

The token service provider (TSP) assigns the token. A token is generated from a BIN range, assigned specifically to that issuer for that brand. A BIN range dedicated for token use is unique and separate from BIN ranges used to assign PANs.

23. What is a token vault?

Tokens “reside” in a token vault, which is maintained by the Token Service Provider (TSP). The vault is also where the transfer of data (converting the PAN to token, verifying authorization of the cardholder at the time of the transaction, etc.) takes place.

24. Is First Data’s STAR® Network going to be a Token Service Provider?

We are currently evaluating the opportunity to join Visa®, MasterCard® and American Express® as a TSP.

25. Will the FICO® scorecard be updated to reflect if a transaction was completed using a token or not?

At this time, we do not anticipate any changes to the FICO scorecard.

26. If merchants are using tokens, will FDMS be the token vault or the networks?

Networks are the token vaults today. Visa® will allow others to become token vaults in the future. First Data is also reviewing becoming a Token Service Requester (TSR) on behalf of merchants.

27. Which specification is FDMS using (i.e. EMV™, networks, etc.)?

First Data is updating several of our specifications. Merchants or vendors that code to First Data specifications should visit the First Data Specification website for their specification updates.

28. What Data Elements are the networks requiring for tokenization?

There are several new fields being utilized by networks as it relates to tokenization by use case. First Data Payments Compliance will communicate this information via the Business Release process and revised specifications will be released by First Data Certification group.

29. Will FDMS support the common AID for Debit?

Yes, First Data will be an early supporter once networks release requirements

30. Are there any other issues with supporting PIN debit for token transactions?

Not at this time.

Tokenization Transactions

31. How does Tokenization impact customer identification?

It further protects consumer information. First Data is compliant with PCI DSS and networks mandates and only maintains information as required.

32. How does Tokenization impact receipt warehousing?

The process should be the same as today except the token PAN will replace the original PAN. There may be a cross reference issue if a consumer does not have a receipt. The card/original PAN will not be able to cross reference; therefore, use of other information will be necessary (i.e. consumer’s name, dollar amount and/or date).

33. How does Tokenization impact returns?

If the customer has their device, the returns process should be as normal. If a customer does not have their device and wants to do a return with the receipt it may only have the last 4 digits of the token. This too should work as normal if merchant has a cross reference process (manual or automated). If the customer has no device or receipt and only has actual card number, there may be no way for the merchant to match and the merchant may have to make alternative return policies (i.e. store credit) or try to match using other transaction data (i.e. consumer’s name, dollar amount and/or date).

34. How does Tokenization impact voids?

There will be no impact if done real-time.

35. How does Tokenization impact disputes and chargebacks?

The disputes + chargeback processes should work as normal. The issuer will initiate the dispute/chargeback via the token number which is the number stored on acquiring systems and available to the merchants.

36. Will FDMS be ready to support the BIN Table updates for token BINS? Is there a limit to how many routing options FDMS can support?

First Data will be ready to support token BINs in BIN tables. Today there is not an option to route token BINs differently. This will be reviewed within the Dynamic Routing Project.

37. Will settlement be different?

Settlement will be the same assuming the same back-end platform is used for token transactions.

38. If a member uses a token for a purchase but returns the item using the original card, will you be able to match the transactions (possibly if they do not have the receipt)?

No, there will be nothing available to the merchant to match to the card account number to token (the number available to merchant). The merchant will need to determine returns policy in that scenario. If the cardholder presents the original PAN, the merchant will not be able to match it with the token. The merchant will have to determine the return policy (i.e. the merchant may have an account number or email address for the cardholder that may identify previous orders).

39. What changes will need to be made for chargebacks in general?

There should be no changes for the disputes process for acquiring. The process will work off the token PAN. The Issuer will need to cross reference, via the TSP, the original cardholder account number to the token account number. First Data will work with Networks to ensure supporting documentation will include the token PAN information.

40. Will FDMS/Merchants support any stand in capabilities for tokens?

This process should not change for merchants doing stand-in.

41. Will there be any changes to the time out settings due to tokenization?

Timeout settings are not changing.

42. Will FDMS support international token contactless transactions?

FDC will be reviewing the impact of non-U.S. international token changes once information is received from the Networks and will then announce a plan for international support.

43. What happens if there is more than one wallet per device?

The consumer has the ability to manage his/her digital wallets and will likely have more than one wallet per device. Each wallet will be able to hold multiple cards/accounts and corresponding tokens.

44. What tools do clients use for customer service, frauds, disputes, etc.?

A client would use a combination of existing First Data tools as well as the lifecycle management portals of each Brand.

45. What is the difference between payment authorization vs. provisioning authorization?

Payment authorizations support the token’s capability to approve or decline the consumer’s purchase. Provision messages support the provisioning, or creation, and assignment of a token to a PAN.

46. Where will the token provisioning decision be made?

Currently, provisioning decisions are made at the TSP, using issuer-defined rules.

47. Where is the authorization decision made and can token data be used as part of that decision?

Authorization decisions are generally the issuer’s decision and this does not change for tokened transactions. There are added fields that will eventually provide more detail about the token; however, networks have not released details at this time.

48. For each transaction, will my customers be able to see the token on their device as reference?

No, the token is not visible to the customer.

Tokenization and EMV

49. What is the difference between EMVTM and Tokenization?

EMVTM and tokenization are both important tools in the payment environment, ensuring the highest level of cardholder data security. EMVTM focuses on the security of the chip-enabled card at the point-of-sale, while tokenization replaces the PAN between the merchant (either POS or online) and the token service provider.

50. Is Tokenization part of the EMVTM standard?

Yes, tokenization is part of the EMVCo standard first proposed in October, 2013 and adopted in March, 2014. EMVCo published payment token technical specifications, which provided the framework for tokenization. All participating payment network Brands reviewed and provided feedback to the framework.

POS/Implementation

51. What First Data POS solutions work with Apple PayTM?

Clover Stationâ„¢ accepts Apple Pay with the FD40 PIN pad, FD130 and FD410. A significant amount of First Data’s existing devices (FD50, FD100, FD200, FD300) will work with Apple Pay with the simple addition of an FD35 PIN Pad. Please see chart below.

52. What choices do I have for contactless readers?

*The FD130 is NFC/EMV Capable

53. Can my current device be used or adapted to accept Apple Pay™ transactions? Is there a peripheral that can be added to adapt my current terminal?

Yes, for First Data products, an FD35 PIN Pad can be added to the FD100, FD200 and FD300 products. The FD400 wireless products require an upgrade to the FD410 wireless product to support EMVTM Contact and Contactless.

54. What will I need to do (if anything) if I am already NFC enabled? Can I just start taking Apple Pay transactions immediately?

Yes, any merchant that accepts PayPass® and PayWave® can accept Apple Pay from Day 1.

55. How will this work if I have different POS systems at the same location? (i.e. Clover Station at the counter, and FD200 at a drive-through window)?

Only the terminals that are NFC-enabled will be able to accept contactless transactions.

56. What changes do I need to make to my store and back-end systems for this to work?

For NFC, you will need to implement Contactless terminals on North platform. This should require no additional changes to store and back office. InApp will require integrating (from a reporting and reconciliation perspective) of InApp transaction flow (currently available thru the First Data Compass FE and North BE) with any existing transaction flows on any First Data platforms. Additionally, for inApp, a new merchant number is needed and pricing will be different from Contactless (in-store) transactions.

57. How does an NFC transaction work? How does it change what I do today?

For NFC transactions, there should be no change to your process. The phone is waved over the device and the transaction processing flow would work as any non-tokenized transaction. The one significant difference is that the cardholder receipt may contain the last 4 digits of the token which is not the same number on the card holder’s actual card (see Question 16 on Tokenization).

58. Does First Data have contactless readers installed today?

Yes, over 400,000 First Data enabled merchants are accepting NFC transactions today.

59. How can I get sample readers?

Please contact your business consultant to arrange a sample unit of the EMVTM Contact and Contactless products that you would want to evaluate.

60. How do I order test cards in bulk?

There are two types. Full certification packs for acquirer certification can be purchased from vendors such as B2 Payment Solutions. Field test cards to validate a working system and for use in demos and training are still in development by the Card providers. We will share more information as these become available.

61. The connectivity related to my NFC terminal appears to be weak, and certain transactions are not flowing through contactless. Who can help resolve this?

Please refer to your merchant statement, which has the accurate technical help desk number to reach someone who can help you.

inApp/E-Commerce

62. What is PayeezySM?

Payeezy is a new way of going to market for SMB eCommerce solutions for First Data. It streamlines the current Global Gateway e4SM and IPG gateways into one global offering. The internal processes are trailing the market-facing name of Payeezy, so anticipate that many support materials, legal documents and contracts will carry the respective gateway names for the time being.

While First Data connects to merchants directly with business consultants to help them assess their eCommerce opportunities, we can now also connect to them indirectly – through web and app developers. Payeezy.com is our way of directly meeting the support needs of the developer community.

63. Can you tell me more about Payeezy.com?

Payeezy.com connects developers to what they want to know – fast. It has everything they need to get coding and get a merchant started with accepting Apple payments right away. It provides the code, a software development kit (SDK), and supporting documentation necessary to integrate payments into an App or eCommerce solution. It also provides the means necessary to establish a merchant account on behalf of a merchant.

64. Can SMB merchants sign up directly at Payeezy.com?

No. These merchants should consult with their business consultant or relationship manager, who can engage an eCommerce Product Sales Specialist for guidance on manual boarding.

65. Are MOTO merchants able to use this product?

Yes, they are but through the inApp solution.

66. Who should I talk if I decide to set up an app? My business consultant or VAR?

Talk to your business consultant or VAR, who can help you find the right people to start accepting Apple PayTM right away.

Merchants will need to work with a developer directly (or leverage internal developer assets, if available) to create a merchant-specific app. First Data provides tools for app developers to help them integrate the payment functions made available through the Apple Pay. Integration partners should be directed to developer.payeezy.com to get the Apple Pay specific documentation.

67. What does a cardholder have to do before using inApp at my online store?

Cardholders would need to download a merchant’s app from the Apple App Store and configure their preferred payment methods to be available for purchase within that app. This functionality will only work within an app running on the appropriate device. It will not work while browsing through Safari or other browsers currently.

68. What’s the process for me to find an app developer to create an app for me?

Check with the current provider of your web-store or app software. They can connect to Payeezy.com for a developer tool kit that will assist them in integrating the payment components of an application.

69. Where do my customers download my app?

You will need to work on download instructions for your application with your application developer. The payment components will be embedded within the app you have created.

70. How do I make it known to customers that I accept inApp?

This will ultimately be a decision you make with the developer of your app. They will create the user interface and any marketing content.

71. Where does my app developer go to begin integrating the inApp Solution?

Developers should visit Payeezy.com to begin creating an integrated inApp solution. Developers should click on the “Get Coding Now” button. There is a specific area highlighting the iOS SDK.

72. How do I enable a web-optimized or mobile app I have for Apple Pay software?

The current Apple PayTM solution only works through inApp solutions. Browsers optimized for mobile devices will not support the solution. To update an existing application, go to Payeezy.com for complete on-line instructions on how to begin.

73. Can I use the same account for inApp or do I need another?

Apple Pay transactions run through the Global Gateway e4SM and Compass platforms. As such, merchants need to be set up as an eCommerce merchant in order to enable the transaction flow.

74. Why can’t I just add Apple Pay acceptance to my existing storefront account?

The Card Brands consider inApp ordering to be a separate and distinct eCommerce transaction. Therefore, we need to set up a new merchant account in order to adhere to credit standards and review policies required by the Networks.

75. Will Clover merchants be able to accept inApp payments?

Our goal is for all Clover merchants to be able to accept inApp payments to support online- to-offline transactions (e.g. order ahead, order and pay at table).

Information and Reporting

76. Is there reporting I can see on the number of contactless transactions every day?

There will be no unique reporting for Apple Pay transactions at this time.

77. If I am a current InsighticsSM client, is there any additional information provided if I am part of this program?

There will be no unique reporting for Apple Pay transactions at this time.