Apple Wallet and Apple Pay

Is Apple Pay safe?

Yes. For paying in shops, in apps and on websites, Apple Pay is safer than typing or tapping a plastic card. The merchant never receives your card number, the key that makes each payment works from a separate chip in the phone, and Apple says it keeps no record of card transactions that it can tie back to you.

We score Apple Wallet and Apple Pay 75/100, ahead of Google Wallet at 70 and far ahead of person-to-person apps such as Cash App at 47. Without its regulatory record it would score higher. In 2024 the US Consumer Financial Protection Bureau fined Apple $25 million over how the Wallet app handled Apple Card disputes.

How Apple Pay protects your card

When you add a card, Wallet encrypts what you enter and sends it to Apple, which re-encrypts it so that only your card network can read it. Your bank then creates a Device Account Number for that one device. It is stored in the Secure Element, a certified payment chip isolated from iOS, and Apple says it is never stored on Apple's servers or backed up to iCloud. Apple keeps only part of the real card number.

At the till, the Secure Element sends that device number with a security code that is unique to the transaction. A thief who copies it cannot replay it, and your bank can refuse the device number on a magnetic stripe, over the phone or on websites. Each payment needs Face ID, Touch ID, Optic ID or your passcode. The one gap is Express Transit: a transit card set to Express Mode pays with no check, so a stolen phone can still ride the metro until you put it in Lost Mode.

Online and in apps, Apple re-encrypts the payment with a key that only the merchant or its processor can open, and websites must verify their domain each time they show the Apple Pay button.

What Apple knows about your payments

Apple's own description is unusually restrained. For card payments in shops, it says it does not retain transaction information that can be tied back to you. For purchases in apps and on the web, it keeps anonymous data, such as the approximate amount, the app or developer, the rough time and whether the payment went through.

The App Store label for Wallet is less tidy. It lists payment info, coarse location and product interaction as data linked to you, used for analytics and for Apple's own advertising or marketing, plus user ID, device ID and other content for running the app. There is no "Data Used to Track You" section, so Apple does not declare tracking you across other companies' apps.

Some data does leave your phone. When you add a card, Apple may send its issuer your name and billing address, device details, your location at the time (if Location Services is on) and a summary of your Apple Account history, for fraud checks. Cards with enhanced fraud prevention also share a fraud score, your IP address and a shipping-address identifier with the payment network during online purchases.

Apple Cash, the US peer-to-peer feature, works differently. Apple Payments Inc., a licensed money transmitter, stores your balance, amounts and who you pay, separately from the rest of Apple, and Green Dot Bank holds the money.

Apple's fine over Apple Card disputes

The CFPB's October 2024 consent order explains what went wrong. Apple designed Report an Issue, the feature in Wallet that lets Apple Card holders dispute a charge. In June 2020 it added a second form; when tens of thousands of people did not complete it, Apple did not pass their disputes to Goldman Sachs, so neither company investigated them. The CFPB also found that Apple's advertising and checkout misled some buyers about Apple Card Monthly Installments. Apple paid a $25 million civil penalty, and the CFPB ended the order early, on 22 September 2025. Goldman Sachs was separately ordered to pay $45 million plus $19.8 million in redress.

In Europe, the Commission found preliminarily that Apple abused its dominance by keeping the iPhone's NFC chip for Apple Pay alone. In July 2024 it made Apple's commitments binding instead of fining it. For ten years, rival wallets in the EEA can use NFC for free and can be set as the default. Rival wallet makers were the harmed party, so we count this at half weight. In the US, the Justice Department and 16 state and district attorneys general sued Apple in March 2024, alleging among other things that it stops third-party apps from offering tap to pay on the iPhone; the case is pending in federal court in New Jersey with no ruling on the merits, so it counts only as context.

South Korea's privacy regulator fined Apple 2.4 billion won in January 2025 over Kakao Pay data sent to Alipay. That case concerned Kakao Pay as a payment method for the App Store, not Apple Pay, so it does not lower this score.

Scams that still work

The phone is hard to attack, so criminals go after the person holding it. In November 2024 ThreatFabric described "Ghost Tap": fraudsters steal card details through phishing or banking malware, then get the one-time code the bank sends to approve adding the card to a wallet. Once the card is in their own Apple Pay or Google Pay, they relay it to accomplices who tap it at shop terminals. The defence is simple: a code your bank sends to add a card to a wallet is for you alone.

Apple Cash adds the risks of any instant payment app. Money sent to a stranger for a ticket or a rental deposit is hard to get back.

How to use Apple Pay safely

1. Use a six-digit or longer passcode, since it unlocks payments as well as the phone.
2. Never share a verification code that your bank sends while someone else is on the phone.
3. Turn off Express Mode for transit cards unless you really need to tap through gates with a locked phone.
4. If you lose the phone, put it in Lost Mode in Find My at once, then call your bank.
5. In Safari's advanced settings, turn off the option that lets websites check for Apple Pay if you do not want them to know.
6. Use Apple Cash only with people you know, and pay strangers with a credit card instead.

How we scored it

Security (85) is the strongest factor: tokenised card numbers, a separate payment chip and a check for every payment, with no breach found. Privacy (74) is good but not top-tier, because the label links payment and location data to you for Apple's own marketing. The regulatory record (45) is the weakest. The $25 million CFPB fine names the Wallet app's dispute feature and harmed consumers directly, so it counts in full; the EU commitments count at half weight, and the pending US antitrust suit takes 2 points as context. For Apple's other security yardstick, see Apple Passwords at 84.