Apple Pay
Apple Pay enables e-commerce merchants to capture conversions on iOS and macOS devices through hardware-bound biometric authentication. Cardflo orchestrates these encrypted wallet tokens across multiple acquirer partners to ensure high authorisation rates during Safari checkouts.
- Category
- Methods
- Capabilities
- 10
- Available on
- All plans
Offer Apple Pay to your customers for streamlined mobile transactions. Cardflo integrates directly with Apple Pay, enabling secure, one-touch payments across your platforms.
This integration helps reduce friction at checkout, improving conversion rates by simplifying the payment process for a significant user base.
Apple Pay transactions, secured through biometric authentication, help merchants reduce PCI DSS scope and remove checkout friction, boosting approval rates. The process ensures high levels of security and user convenience, promoting higher conversion.
Apple Pay overview
Apple Pay functions as a digital wallet that utilises near-field communication (NFC) for proximity payments and the Payment Request API for web and in-app transactions. Within the payments stack, it acts as a container for tokenised card credentials, where the actual primary account number (PAN) is replaced by a Device Account Number (DAN).
By facilitating Strong Customer Authentication (SCA) through biometric verification such as Face ID or Touch ID, Apple Pay satisfies PSD2 requirements without necessitating additional redirects to 3D Secure pages. The mechanism relies on a secure element within the hardware to store encrypted payment data, which is only released to the acquirer upon successful user authorisation.
For merchants, this reduces the technical burden of handling sensitive plainsight card data, as the system provides a one-time security code for each transaction, effectively minimising the risk of certain types of card-not-present fraud whilst maintaining high authorisation rates across the Visa, Mastercard, and American Express networks.
How apple Pay works
Merchant identity validation
The merchant registers a domain and validates it with the scheme through the payment service provider. This process involves hosting a specific verification file and using a Merchant Identity Certificate to establish a secure handshake between the server and the Apple Pay servers, ensuring the request originates from a recognised entity.
Tokenised data transmission
When a customer initiates a payment, the device generates a dynamic security code and a network token. This token replaces the actual card number. The encrypted payload is sent to the payment gateway, which then forwards the specialised cryptogram to the acquirer for processing via the relevant card schemes.
Biometric SCA verification
The user confirms the transaction using Touch ID, Face ID, or a device passcode. This action performs the required two-factor authentication under SCA regulations. Because the authentication is bound to the physical device and the biometric signature, it confirms both possession and inherence, reducing the probability of unauthorised use.
Authorisation and settlement
The issuer receives the cryptogram and verifies the token against the original account. Once the authorisation is granted, the transaction proceeds through the standard settlement cycle. The merchant receives funds in their configured currency, with the transaction marked as an Apple Pay method within the settlement reports.
Why apple Pay matters
Reduced PCI DSS Scope
By utilising tokenisation and the secure element, merchants do not handle or store actual credit or debit card numbers. This architecture shifts a significant portion of the security responsibility away from the merchant infrastructure. Consequently, the merchant may qualify for a simplified PCI DSS Self-Assessment Questionnaire, such as SAQ A-EP or SAQ A, reducing the administrative and technical burden of annual compliance audits.
Enhanced Authorisation Rates
Industry data suggests that transactions authenticated via biometric wallets often see higher authorisation rates compared to traditional card-entry methods. Issuers generally view these transactions as lower risk because the multi-factor authentication is built into the flow. This can lead to a decrease in false declines, particularly for high-value or cross-border transactions where traditional fraud filters might be more restrictive.
Apple Pay use cases
Safari express checkout
Retailers using Apple Pay on Safari can replace card entry and account creation with a payment sheet containing tokenised credentials and delivery details. Cardflo supports Apple Pay web integration, merchant validation and gateway orchestration, while its acquirer partners authorise the resulting network token transactions.
Native iOS app payments
iOS app merchants need Apple Pay payment sheets to pass authenticated purchase data from Face ID or Touch ID without exposing primary account numbers. Cardflo connects native application flows to gateway APIs, applies payment routing and sends device-account-token transactions to suitable acquirer partners for authorisation.
Multi-domain merchant validation
Retail groups operating several branded websites must register and validate each eligible web domain before presenting Apple Pay within supported Safari checkout journeys. Cardflo coordinates domain-association setup, merchant validation sessions and certificate-dependent gateway configuration, then routes authorised token payloads through its acquirer partner network.
Biometric checkout recovery
Apple Pay checkouts can fail when Face ID or Touch ID is cancelled, the selected card is unavailable or the payment token expires before authorisation. Cardflo records wallet-specific response data, supports controlled retry logic and routes fresh Apple Pay token payloads to an appropriate acquirer partner.
Apple Pay by the numbers
Typical implementations show that biometric wallet checkouts can be completed significantly faster than manual card entry, though actual times vary by network latency.
Merchants often observe an uplift in mobile conversion when introducing wallet-based checkouts due to the removal of form-filling friction, based on standard industry benchmarks.
Standard industry ranges suggest that authenticated wallet transactions often maintain very high approval rates, as they are pre-verified by the issuer's biometric protocols.
Methodology: these figures are illustrative ranges drawn from published industry data and observed merchant cohorts, not guarantees. Actual results depend on your risk profile, card mix, geography and acquiring setup, and are confirmed only in your own pricing and approval terms.
Related terms
Talk to our team about a live rollout across our acquirer partners' rails.
What you get with Apple Pay
- Native integration for Safari browsers on iOS, iPadOS, and macOS devices for web checkouts.
- Hardware-level biometric authentication satisfying European SCA mandates under current PSD2 and future PSD3 frameworks.
- Support for Merchant Initiated Transactions to facilitate recurring billing and subscription-based business models.
- Direct integration via Payment Request API to capture billing and shipping details during authorisation.
- Tokenisation of sensitive card data using Device Account Numbers to minimise merchant data liability.
- Support for Apple Pay on the Web using Javascript SDK for cross-device payment consistency.
- Detailed reporting of Apple Pay specific metadata within the merchant dashboard for reconciliation.
- Compatibility with major card schemes including Visa, Mastercard, and American Express for global reach.
- Automatic updates for expired cards through network token synchronisation with participating banking institutions.
- Simplified refund and dispute management using the original transaction reference or ARN provided.
A short scoping call, then a written plan for your MIDs.
Questions about Apple Pay
How does Apple Pay impact the merchant's PCI DSS compliance requirements?
Apple Pay significantly reduces the merchant's PCI DSS scope. Since the merchant never receives the actual primary account number (PAN) but instead receives a one-time token and a cryptogram, they do not store, process, or transmit sensitive cardholder data.
Most merchants using this method for their entire checkout flow can move to the most basic levels of PCI self-assessment, provided they do not store other sensitive data. This reduces the security controls they must implement and verify annually.
Are there additional fees for processing transactions through Apple Pay compared to standard cards?
Apple does not charge merchants or payment service providers a fee for using the service. The transaction is typically processed at the standard interchange-plus or blended rate applicable to the underlying card type (e. g. , credit vs debit).
However, merchants should verify with their acquirer if there are specific gateway fees for processing mobile wallet transactions. The primary cost components remain the interchange fee, scheme fees, and the acquirer margin.
How is Strong Customer Authentication handled for Apple Pay in the UK and EEA?
Apple Pay is considered inherently SCA-compliant. The two factors required (possession of the device and inherence via biometrics) are verified at the time of the transaction.
Unlike traditional 3D Secure 2 flows which may pop up a challenge window from the issuer, the Apple Pay flow completes the authentication on the device itself.
This usually results in a 'frictionless' flag being sent to the issuer, which satisfies the legal requirements of PSD2 and the RTS.
Can Apple Pay be used for recurring payments or automated dunning processes?
Yes, Apple Pay supports recurring payments through the use of merchant-linked tokens. During the initial Customer Initiated Transaction (CIT), the user authorises the merchant to perform subsequent Merchant Initiated Transactions (MIT).
The gateway stores the token, and the merchant can then trigger future payments for subscriptions or variable billing without the user being present, provided the initial mandate was correctly established and authorised.
What happens if a customer requests a refund for an Apple Pay transaction?
The refund process for Apple Pay is identical to a standard card refund. The merchant uses the unique transaction ID or Acquirer Reference Number (ARN) to initiate the refund via their PSP or gateway.
The funds are returned to the account associated with the Device Account Number used for the original purchase. Because it is a tokenised transaction, the merchant does not need to see the customer's actual card number to process the return.
Does Apple Pay work for cross-border transactions and multiple currencies?
Apple Pay supports cross-border transactions as long as the underlying card network (Visa, Mastercard, etc.) and the merchant's acquirer support the relevant currency.
The currency conversion is handled either by the issuing bank at the time of the transaction or by the acquirer if the merchant is settled in a different currency.
The user will typically see the estimated amount in their home currency within the Apple Pay interface before they confirm the payment.
Related guides.
See how Cardflo compares.
Ready to improve your payments setup?
Tell us about your business. We'll match you with the right acquiring partners and the right route, typically inside a week.