Is Apple Entering the Payment Acceptance Business?

In July, Apple acquired Mobeewave, a relatively unknown payments-technology startup in Montreal, Canada for, reportedly, $100 million. For nine years, Mobeewave has been developing technology to convert conventional smartphones into payment-accepting devices without requiring additional hardware components.

What may seem to be just another acquisition for Apple could have broad implications for the payments industry.

Mobeewave enables smartphones to be payment-accepting devices without additional hardware components.

mPOS

Before digging into the Mobeewave acquisition and how it threatens the status quo enjoyed by Square and others, some background on mobile point-of-sale (mPOS) is useful.

The “Great Recession” of 2008 prompted many merchants and the entire payments industry to find a better way of serving customers.

Ecommerce had made huge gains by providing improved service, better prices, and unprecedented convenience. Brick-and-mortar stores had to react. One of the industry’s responses was mobile points of sale — the ability for merchants to leave the front checkout counter and accept credit and debit card payments throughout the store.

Around this time, Square, with its card reader that easily plugged into a smartphone’s headphone jack, made big strides. By allowing merchants to accept payments from anywhere, Square profoundly changed the payments industry. It wasn’t long before others, such as Clover, improved on Square’s offering with mPOS services that supported chip-and-PIN and contactless tap-to-pay.

Traditional acquirers and payment processors were slow to respond to this massive shift in the small-to-midsize business segment. Eventually, the leading processors either developed their own mobile point-of-sale products or partnered with one or more mPOS providers. This is where the industry stands today.

Evolution of mPOS

For all of the interesting use cases and convenience that mPOS provides, it does have one major fault: separate hardware is required. Merchants can accept card payments on their phones and tablets only if a card reader or a card-reading PIN-pad is connected either wirelessly via Bluetooth or physically with a dongle, cable, or plug.

Carrying and connecting a small card reader or a mini PIN-pad isn’t horrible, but it certainly reduces the convenience. All of this hardware must be charged, maintained, and secured. Worst of all, it’s often expensive.

Several startups — Mobeewave was foremost — understood that mPOS is more viable without all the cumbersome dongles, readers, and PIN-pad attachments.

Unfortunately for Mobeewave (but fortunate for the traditional players), the separate hardware was necessary. That’s because Visa, Mastercard, and the other card brands allowed mobile payment transactions only if the hardware was certified (for security) by organizations such as PCI Security Standards Council and EMVco.

And PCI and EMVco correctly understood that transmitting credit card details through a smartphone alone was not secure and, thus, could not be certified.

New Technology, Certifications

New technology and certification standards arose in roughly 2018 to overcome the security challenges of passing credit card data through smartphones. While the acronyms are seemingly impossible to decipher, the underlying benefits are clear.

• TEE (Trusted Execution Environment). An extremely secure area of memory in a smartphone that protects credit card details without the need for separate hardware. Mobeewave’s phone-only mPOS solution relies on TEE.

• EMVco. A private organization comprised of representatives from Visa, Mastercard, American Express, Discover, JCB, and China UnionPay. EMV is the acronym for Europay, Mastercard, and Visa — the founders and original members of EMVco. EMV creates and maintains rules and regulations for chip-and-PIN, contactless, and electronic payments.

• PCI SSC (Payment Card Industry Security Standards Council). The independent organization that works with EMVCo to create, maintain, test, and certify a wide range of electronic payment services, including mPOS.

• COTS (Commercial Off-the-shelf). A fancy way of saying “a smartphone or tablet that was purchased from a store,” as opposed to buying a traditional card reader and PIN-pad from a factory (typically operated by an acquirer).

• CPoC (Contactless Payments on a Commercial Off-the-shelf Device). A new standard and certification program from the Payment Card Industry Security Standards Council that outlines the rules for allowing tap-to-pay payments directly on smartphones with near field communication (NFC) capability. Mobeewave became a viable business as soon as this standard was released.

• SPoC (Software Payments on COTS). Similar to CPoC, this standard covers PIN entry directly on the phone wherein customers can type their PIN directly on the phone’s glass touchscreen.

Mobeewave

The new technology and standards gave Mobeewave and a few other startups the opportunity they needed.

The startups recognized that attaching card-reading hardware and PIN-pads to phones is a burden for most merchants. Mobeewave solved the technical problem of attachment-free mPOS a long time ago. However, Mobeewave’s solution was never fully certified by PCI and EMV, thereby making the solution attractive but unusable except in demos and laboratories.

Once TEEs (secure areas of memory in the phone) became prevalent in modern smartphones — and as soon as PCI released the CPoC specifications — Mobeewave became a market-ready mPOS product.

Indeed, in October 2019, Samsung and Mobeewave announced a partnership and a service called Samsung POS, which allowed merchants to accept tap-to-pay payments on Samsung tablets and phones — without cables, dongles, or other hardware. The partnership, which was limited to Canadian merchants, generated more than 10,000 downloads of the Samsung POS app.

Square would have surely been aware of the Samsung POS pilot but likely didn’t feel threatened. Until now.

Apple Acquires Mobeewave

When Apple announced that it had acquired Mobeewave, a shockwave rippled through the payments industry. Suddenly, this small Canadian startup, with a compelling but poorly marketed mPOS product, could threaten established point-of-sale manufacturers, mPOS providers, and merchant acquirers.

Here’s why.

• The proliferation of TEEs in Apple phones and tablets. Unlike Samsung and other Android phone manufacturers, Apple controls and builds the hardware and software that power its phones. Apple has the resources (financial and human) to build strong TEEs on its phones. Over time, the proliferation of Apple TEEs on Apple devices will presumably get better at handling, storing, and transmitting credit card data. Very few companies can secure an entire payments ecosystem. Apple can, and relatively easily.

• Worldwide popularity. Despite their hefty price tag, iPhones and iPads are popular worldwide. Apple can leverage the iPhones and iPads that many merchants are using or planning to purchase. Adding an out-of-the-box payments-accepting service along with a potential point-of-sale app would be simple for Apple now that it has acquired Mobeewave. An Apple POS or mPOS application would be another reason for merchants to buy Apple products.

• Marketing power. Traditional acquirers and providers of POS and mPOS systems do not have the marketing arsenal of Apple. With its seemingly unlimited marketing budget, Apple could out-spend other industry players — banks, processors, acquirers, and even hardware manufacturers (such as Ingenico and Verifone).

• Experience. Apple has invested heavily in payments-related products, notably Apple Pay and the relatively new Apple Card (a partnership with Goldman Sachs and Mastercard). The triumvirate of a payment product (Apple Pay), a payment card (Apple Card), and now, a payments-accepting app could push Apple to a leadership position in the payments industry. Many commentators feel that Apple has already achieved this status.

Companies that are likely threatened by Apple’s acquisition of Mobeewave include:

• Square and its competitors. Square, Clover, iZettle, ShopKeep, Lightspeed, and Shopify POS should feel threatened. If Apple offered a free or low-cost, feature-rich mPOS that works on iPhones and iPads without the external hardware attachments, one would expect many merchants to leave Square. Pricing, ease of use, security, and support will be the key differentiators among the competing services.

• Acquirers and payment processors, especially those acquirers that have partnered with mPOS providers such as Clover. Apple can use its power to reduce fees and improve merchant account services. Many merchants consider their processors and acquirers as necessary evils; many would leave if there were better alternatives. This is especially true for small-and-midsize businesses, which are Mobeewave’s primary target market.

• Point of sale manufacturers such as Ingenico and Verifone provide equipment for merchants of all sizes. Typically, acquirers and ISOs (independent sales organizations, also called merchant account providers) purchase PIN-pads and payment terminals from Verifone and Ingenico and then add custom software before renting or selling this equipment to merchants. Merchants that use iPhones, instead, are a threat to these hardware manufacturers.

• Peer-to-peer payment services such as PayPal, Venmo, and Square Cash. Apple could create its own P2P payment service using Mobeewave’s technology. Rather than using PayPal, Venmo, or Square Cash to send funds to a friend, consumers could use an iPhone to accept a quick credit-card tap-to-pay payment. This presumes Apple can overcome the challenge of interchange and credit card fees.