Apple Pay Frequently Asked Questions UK Version 1.0 (July 2015) First Data Merchant Solutions is a trading name of First Data Europe Limited, a private limited company incorporated in England (company number 02012925) with a registered address at Janus House, Endeavour Drive, Basildon, Essex, SS14 3WF. First Data Europe Limited is authorised and regulated by the UK Financial Conduct Authority (FCA register No. 582703). First Data Europe Limited has appointed FDR Limited as payment and collection agent for the services provided under your Merchant Agreement. FDR Limited is a company incorporated in the State of Delaware, United States, under registration number 22692 35, registered in England as a branch of an overseas company with limited liability (company number FC015955) and branch number BR001147, whose registered office in the United Kingdom is at Janus House, Endeavour Drive, Basildon, Essex, SS14 3WF. 2015 First Data Corporation. All Rights Reserved. All trademarks, service marks, and trade names referenced in this material are the property of their respective owners. EMV is owned by EMVCo LLC. Apple and iphone are trademarks of Apple Inc., registered in the U.S. and other countries. Apple Pay is a trademark of Apple Inc.
Table of Contents General Product/Capability Page 3 Pricing Page 6 First Data Tokenization & Security Page 6 POS/Implementation Page 9 In-app/eCommerce Page 9
Apple Pay UK Launch - Frequently Asked Questions- For additional information, please go to: https://www.firstdata.com/en_gb/all-features_international/apple-pay.html General Product/Capability 1. What is Apple Pay TM? What does it mean to me as a merchant and my customers? With the launch of the iphone 6 and new Apple watch, Apple is poised to accelerate the growth of mobile commerce and catalyze the card-less environment in an unparalleled manner. It provides a digital wallet in the device, in which consumers can store payment options that can be used to tap and pay for goods and services at a physical store POS (instore payments) or within participating mobile apps (in-app payments).the contactless use of a mobile device to perform payment transactions is facilitated via Near Field Communication (NFC) technology. While contactless payments have been around for a while and First Data can expertly support them, the ability to use one s phone to tap and pay particularly at so many merchant locations, with so many payment options is a brand new development for the marketplace. Consumers will begin utilizing their phones to transact more frequently, and will expect that they can be accepted everywhere. This means we should encourage our clients to be ready to accept mobile payments from their new Clover Station solution, or their contactless terminals. 2. How secure are Apple Pay transactions? Apple Pay software in the new iphone 6 and Apple Watch with ios 8 leverages Tokens to initiate transactions, eliminating the use of the card number within the transaction flow from the merchant, the Acquirer, and to the Network. The Tokens are generated within the hardware - based Secure Element (a special chip processor) of the device and are not usable independent of the device. Biometric identification on the device is required for initiating the transaction and further secures against the possibility of fraudulent transactions being conducted on stolen devices. (Refer to Tokenization & Security.) 3. Which merchants can participate? Any merchant can participate, provided they have the POS equipment that accepts contactless transactions, and the acquirer/processor must be compliant with networks requirements. The Clover Station solution is a strong option which encourages a merchant to accept contactless payments from Apple Pay and all other contactless payment cards. First Data also supports contactless terminals. Terminals must be ISO 14443 or 18092 compliant; usually these terminals will show the universal contactless symbol. For in-app payments, merchants must have a successfully integrated mobile application. 3
If you would like to know how you can also participate with your own payment option in the Apple Passbook, but don t have an online presence or a developer that you work with, please contact your Business Consultant who can help get you started with First Data s ecommerce solutions as well as the ability to accept Apple Pay transactions. If you have a developer in mind, simply refer your developer to Payeezy.com for a developer tool kit. 4. What is First Data s role in enabling Apple Pay? First Data views Apple Pay provisioning and acceptance as an enhancement to the many innovative solutions we have introduced during our business transformation. In addition to ensuring both FI and Acquiring platforms readiness and compliance with network requirements, First Data is helping issuers participate in the in-app experience by provisioning their services to the passbook and with integrated token processing services. First Data can also help large merchants with their own payment solutions provision to the in-app experience, and helps merchants of all sizes and in all locations with contactless acceptance. 5. What do I, as a merchant, have to do to accept Apple Pay with these new devices? Merchants with contactless POS terminals will be able accept Apple Pay this could be Clover Station with FD40 peripheral or any other contactless enabled device. For merchants seeking to accept payments within a mobile app, we provide a Software Development Kit (SDK) on our developer page developer.payeezy.com that allows rapid enablement of Apple Pay In-app payments into ios apps through our Payeezy ecommerce solution. An upgrade to the Clover Station or a contactless terminal will help your business be ready for the future and securely accept Apple Pay transactions with ease. 6. Will contactless work for all types of cards, including debit? Apple Pay supports MasterCard and Visa credit and debit transactions and American Express credit transactions 7. Are there any plans to extend this programme to other mobile devices beyond the iphone 6 or Apple watch? Apple Pay can also be enabled on ipad Air 2 and ipad mini 3 for in-app transactions. It is also expected that other device manufacturers will leverage similar payment methodologies after the launch of Apple Pay. 8. Which digital wallet do customers need to have enabled to facilitate Apple Pay? The Apple Pay Digital wallet, or passbook, is needed in order to facilitate an Apple Pay TM transaction. 9. Does this program support multiple/foreign currencies? No, Visa, MasterCard and American Express have currently only mandated/made available transactions in the U.K. at this time. 4
10. Is there training available to learn how to use this new technology at the store level? While we do not have a formal training program for staff, information about the Clover Station solution can be found here, along with more information about the many ways we support small and mid-size businesses for growth. For more information about our Contactless terminal options, please visit www.firstdatams.co.uk. 11. Does a cardholder have to use their physical card with a merchant before they can use Apple Pay? No. The Apple Pay solution works just like the card only the consumer taps and pays with Apple Pay instead of entering their PIN at the point of sale. A cardholder should be able to use Apple Pay just as she/he does a card it s just the manner that s different. 12. Is Apple Pay a new NFC-based payment system, or based on existing standards? Apple Pay issuance is based on existing contactless standards, including MasterCard PayPass, Visa PayWave, and ExpressPay from American Express. NFC acceptance standards have been in place since 2004. The Clover Station solution and First Data s contactless terminals adhere to these secure contactless (NFC) acceptance standards. 13. Will the 20 Contactless limit apply to Apple Pay transactions? All new terminal deployments support the latest contactless specifications for MasterCard and Visa including HVP (high value payments) and any NFC transactions over 20 will request consumer device verification. In essence this means that the HVP limit is set by the terminal vendor and is in all cases 500 apart from Verifone which is still 20. Further increases in ceiling limits for transactions are currently being worked on and will be notified in due course 14. Can I accept Apple Pay on my Terminal now? Most First Data Merchant Solution terminals support the latest Contactless standards and so will automatically support Apple Pay. If terminals are not supported, please call 0845 841 2414 to upgrade today. 5
Pricing 15. What is the cost of the Apple Pay solution? Am I charged at card-present or card-not-present rates? NFC-based transactions are treated just like other in-store transactions (assessed at Card Present rates). Apple Pay in-app purchases operate and are assessed as ecommerce transactions (even if executed in store). First Data Tokenization & Security 16. Is First Data supporting Tokenization? Yes, First Data is participating in the launch of this initiative. 17. How does Tokenization work? Tokenization is a secure approach to transaction processing. The token replaces the original cardholder account number and is utilized in the transaction processing process. Merchants do not receive actual cardholder account number. It removes the risk for merchants having to securely store the original cardholder account number. This greatly reduces the risk related to useful data for committing fraud in the event of a data compromise. 18. How does tokenization impact reporting and CRM systems that used to rely on a card member (PAN)? Any system that ties the card account to an individual will be impacted, as the token assigned to a card will be unique by device or card/merchant combination. The same account holder may appear as two tokens depending on use case. 19. What entity assigns the token? The token service provider (TSP) assigns the token. A token is generated from a BIN range, assigned specifically to that issuer for that brand. A BIN range dedicated for token use is unique and separate from BIN ranges used to assign PANs. 20. What is a token vault? Tokens "reside" in a token vault, which is maintained by the Token Service Provider (TSP). The vault is also where the transfer of data (converting the PAN to token, verifying authorization of the cardholder at the time of the transaction, etc.) takes place. 21. If merchants are using tokens, will FDMS be the token vault or the networks? Networks are the token vaults today. Visa will allow others to become token vaults in the future. First Data is also reviewing becoming a Token Service Requester (TSR) on behalf of merchants. 22. Which specification is FDMS using (i.e. EMV, networks, etc.)? First Data is updating several of our specifications. Merchants or vendors that code to First Data specifications should visit the First Data Specification website for their specification updates for EMV and 3D Secure. 23. Are there any other issues with supporting PIN debit for token transactions? Not at this time. 6
24. How does Tokenization impact customer identification? It further protects consumer information. First Data is compliant with PCI DSS and networks mandates and only maintains information as required. 25. How does Tokenization impact receipt warehousing? The process should be the same as today except the token PAN will replace the original PAN. There may be a cross reference issue if a consumer does not have a receipt. The card/original PAN will not be able to cross reference; therefore, use of other information will be necessary (i.e. consumer's name, amount and/or date). 26. How does Tokenization impact returns? If the customer has their device, the returns process should be as normal. If a customer does not have their device and wants to do a return with the receipt it may only have the last 4 digits of the token. This too should work as normal if merchant has a cross reference process (manual or automated). If the customer has no device or receipt and only has actual card number, there may be no way for the merchant to match and the merchant may have to make alternative return policies (i.e. store credit) or try to match using other transaction data (i.e. consumer's name, amount and/or date). 27. How does Tokenization impact voids? There will be no impact if done real-time. 28. How does Tokenization impact disputes and chargebacks? The disputes + chargeback processes should work as normal. The issuer will initiate the dispute/chargeback via the token number which is the number stored on acquiring systems and available to the merchants. 29. Will settlement be different? Settlement will be the same assuming the same back-end platform is used for token transactions. 30. If a member uses a token for a purchase but returns the item using the original card, will you be able to match the transactions (possibly if they do not have the receipt)? No, there will be nothing available to the merchant to match to the card account number to token (the number available to merchant). The merchant will need to determine returns policy in that scenario. If the cardholder presents the original PAN, the merchant will not be able to match it with the token. The merchant will have to determine the return policy (i.e. the merchant may have an account number or email address for the cardholder that may identify previous orders). 31. What changes will need to be made for chargebacks in general? There should be no changes for the disputes process for acquiring. The process will work off the token PAN. The Issuer will need to cross reference, via the TSP, the original cardholder account number to the token account number. First Data will work with Networks to ensure supporting documentation will include the token PAN information. 32. What happens if there is more than one wallet per device? The consumer has the ability to manage his/her digital wallets and will likely have more than one wallet per device. Each wallet will be able to hold multiple cards/accounts and corresponding tokens. 7
33. What tools do merchants use for customer service, frauds, disputes, etc.? A client would use a combination of existing First Data tools as well as the lifecycle management portals of each Brand. 34. Where is the authorisation decision made and can token data be used as part of that decision? Authorisation decisions are generally the issuer s decision and this does not change for tokened transactions. There are added fields that will eventually provide more detail about the token; however, networks have not released details at this time. 35. For each transaction, will my customers be able to see the token on their device as reference? No, the token is not visible to the customer. The last 4 digits appear on the receipt. 36. What is the difference between Chip and PIN and Tokenization? Chip & PIN and tokenization are both important tools in the payment environment, ensuring the highest level of cardholder data security. Chip and PIN focuses on the security of the chip-enabled card at the point-of-sale, while tokenization replaces the PAN between the merchant (either POS or online) and the token service provider. 8
POS/Implementation 37. What First Data POS solutions work with Apple Pay TM? The Clover Station solution accepts Apple Pay with the First Data TM FD40 PIN pad, also the First Data TM FD130 terminal. 38. What choices do I have for contactless readers? Segment Current State NFC Readiness Immediate Leading Strategy Bricks & Mortar Mobile Clover TM Station FD130 Internet Payment Gateway Clover Station + FD40 FD130 Internet Payment Gateway with API Capabilities In-app/eCommerce 39. What is Payeezy SM? Payeezy is a new way of going to market for SMB ecommerce solutions for First Data. The internal processes are trailing the market-facing name of Payeezy, so anticipate that many support materials, legal documents and contracts will carry the respective gateway names for the time being (e.g. IPG). While First Data connects to merchants directly with business consultants to help them assess their ecommerce opportunities, we can now also connect to them indirectly through web and app developers. Payeezy.com is our way of directly meeting the support needs of the developer community. 40. Can you tell me more about Payeezy.com? Payeezy.com connects developers to what they want to know fast. It has everything they need to get coding and get a merchant started with accepting Apple payments right away. It provides the code, a software development kit (SDK), and supporting documentation necessary to integrate payments into an App or ecommerce solution. It also provides the means necessary to establish a merchant account on behalf of a merchant. 41. Can SMB merchants sign up directly at Payeezy.com? No. These merchants should consult with their business consultant or relationship manager, who can engage an ecommerce Product Sales Specialist for guidance on manual boarding. 42. Will in-app allow a merchant to accept purchases through a merchant ecommerce site (from a home PC or laptop, and not within a merchant s mobile app)? No, In-app only works in an ios app optimised for iphone 6. It does not work on a PC or laptop. However, the Payeezy API s will allow a broad range of ecommerce capabilities if you do not want capabilities for a PC or laptop. Payeezy API s are not currently available in the UK but will be coming soon. 9
43. Who should a merchant talk to if they decide to set up an app? Merchants will need to work with a developer directly (or leverage internal developer assets, if available) to create a merchant-specific app. First Data provides tools for app developers to help them integrate the payment functions made available through the Apple Pay. Integration partners should be directed to developer.payeezy.com to get the Apple Pay specific documentation. 44. What does a cardholder have to do before using in-app at an online store? Cardholders would need to download a merchant s app from the Apple App Store and configure their preferred payment methods to be available for purchase within that app. This functionality will only work within an app running on the appropriate device. It will not work while browsing through Safari or other browsers currently. 45. What's the process for a merchant to find an app developer to create an app? They should check with the current provider of their web-store or app software. They can connect to Payeezy.com for a developer tool kit that will assist them in integrating the payment components of an application. 46. Where does a customer download a merchant app? Merchants will need to work on download instructions for their application with their application developer. The payment components will be embedded within the app they have created. 47. Where do app developers go to begin integrating the in-app Solution? Developers should visit Payeezy.com to begin creating an integrated in-app solution. Developers should click on the Get Coding Now button. There is a specific area highlighting the ios SDK. 48. How does a merchant enable a web-optimised or mobile app they have for Apple Pay software? The current Apple Pay TM solution only works through in-app solutions. Browsers optimised for mobile devices will not support the solution. To update an existing application, go to Payeezy.com for complete on-line instructions on how to begin. 49. Can merchants use the same account for in-app or do they need another? Apple Pay transactions run through the Internet Payment Gateway. As such, merchants need to be set up as an ecommerce merchant in order to enable the transaction flow. 10