How Does Apple/Google Pay Work?

Checkout our bestselling System Design Interview books:

ABOUT US:
Covering topics and trends in large-scale system design, from the authors of the best-selling System Design Interview series.

[_dekinci]

GPay token is definitely stored on Google servers as it allows you to pay online with a Google account, e.g. on a PC.

[AminFaudzi]

I was informed by a GPay representative in Malaysia that GPay and Google Wallet is 2 separate things. Both might be offered in your country or just one of it or none at all. Google Wallet is where you store your credit card info, passes, tickets, or anything that could be sync with it. GPay is where the payment take place.

[muhdaimanharith]

Google implementation make sense considering not all android manufacturers willing to add additional chip due to cost.. this way they can provide the service to any customer with a phone that have NFC chip without compromise the security due to lack of dedicated chip..

[LimitedWard]

Okay several followup questions:
1. What's the difference between the token used by iOS vs Android? You mentioned Apple Pay uses a DAN while Google Pay uses a DPAN, but never really clarified how they differ.
2. If this token is a secret, then why does the device provide the payment token to the PoS during checkout? Wouldn't that be vulnable to a compromised PoS or MitM attack?
3. This feels like an ideal use case for public key cryptography. Why not have the bank issue a private key to each device for payment authorization, and then the payment authorization flow would just involve signing the transaction with the private key?

[nidri]

Google wallet was initially released in May 2011.
Apple pay was initially released in October 2014

[ashutoshgarg]

Can please make a video about how India's UPI works?
How it is different from tokenization as there are no credit or debit card needed

[heikkisorsa]

Very interesting. Can you make another video about the registering process of both as well since they are quite different (afaik Apple uses in-app provisioning).

[olehstakhiv]

If Apple stores tokens in the device's secure element and does not store them in the cloud, how are my cards added on iPhone available on Mac?

[abcd]

can you also compare samsung pay? i know its a little different than google pay but i want to know what exactly

[axeltrujillo]

That a was a neat explanation. I didn’t know there was a chip in iPhones dedicated for payment. Considering how Android must run on several devices, it makes sense that google pay uses other methods 🧐🤔

[swagatpritamsahoo]

In INDIA Gpay is used for UPI mostly.not for card payment.

[ReflectionOcean]

Tokens:
PAN = Primary Account Number
DAN = Device Account Number

PAN (from device) => BANK => DAN (to device)

[evenex.]

I wonder what the Titan M2 Security Chip (built-in Pixel 6 and 7 Series) is doing then, when the payment token is stored in GPay itself.

[TheGreyOwl]

Gpay works with UPI in India, should have mentioned it.

[ejzgxyu]

Thank you for a brilliant video.
If a user is using a merchant web interface to purchase on line using Apple Pay / Google Pay would the same tokenization process and DPAN / DAN creation apply?

[DK-oxze]

POS terminals are designed to accept credit cards, which I believe use a different tech to encrypt the credit card number and cvv. So how does these terminals directly accept the token from Apple or Google pay? Unless Apple pay converts that in the format acceptable to POS terminal.

[Su.darshan]

Does it work differently in European countries with IBAN? For example when Apple Pay was released in The Netherlands, terminals didn’t need to be replaced or software update, as long as it had NFC. It just worked. I was on vacation in USA, at Walmart I used Apple Pay and the employee looked surprised at me because apparently they don’t support it. But somehow it worked.

[markus.schiefer]

Not sure about Apple, but Google Pay has horrible customer service. Added an address, the payment profile was suspended and I got an email asking for addition information. Provided information, immediately received and email citing COVID as reason for delayed responses which is just ridiculous at this point. That was two weeks ago and still haven't received any update.
I sure wouldn't want to rely on them.

[Cheelex]

Does the Google Pay system function the same way on Pixel devices as it does other Android devices? Doesn’t the Titan M handle tokens like this?

[sanesharma]

Plz also make a video on the following topics:
1). How does Cloud Computing work?
2). How does AI work?
3). Fundamentals of ML
4). How do Siri/ Alexa work?
5). How does Whatsapp, Messenger work?