MacDailyNews - Where Mac news comes first

 MacDailyNews Poll

5 Day Most Commented

Opinion Archive

Current Headlines

Latest Joy of Tech

  • Latest Joy of Tech!

MacNN

AppleInsider

Macworld UK

TUAW

MacRumors

Yahoo! Finance AAPL

iTunes Top 10 Albums

Mac OS X Downloads

Thu, Jan 08, 2009 - 12:43 PM EST  —  AAPL: 91.12 (+0.11, +0.12%)  |  NASDAQ: 1595.43 (-3.63, -0.23%)

Is Apple’s iPhone credit card policy, use of credit card info legal?
Monday, November 05, 2007 - 01:30 PM EST

"First, it is true that if you walk up to a cash register at an Apple Store with $399 in cash [to buy an iPhone], you will be told that you need a credit or debit card," David Berlind blogs for ZDNet. "As I’m taking four $100 bills out of my pocket, the clerk informs me that I must pay with a credit card."

"Just as interesting however is the fact that you don’t need a credit/debit card for the entire purchase. When it became clear that my $399 in cash was no good at the Apple Store (for an iPhone), the clerk that I spoke with suggested that I pay $1 of the purchase price with my credit card and the rest in cash. This of course makes it clear that Apple needs the information on your credit card for something important," Berlind writes. "But what?"

"Apple apparently is in a bind right now. It’s in a cat and mouse game with hackers who have made it possible to divorce (”unlock”) Apple’s iPhones from the AT&T wireless service that Apple is contractually bound to keep the phones married to," Berlind writes.

Berlind writes, "As far as unique indentifiers go, credit cards are a pretty good token for authenticating someone’s identity. At the very least, Apple is probably retrieving (from the credit card) and keeping the name of every person who buys an iPhone. This way, when you go to buy another one, they can see if an iPhone has already been purchased by someone with the same name. But then comes the question of whether they are retaining your credit card number as well. How could they not?"

"Although nobody has yet to go on record, as it turns out, there’s a security and privacy standard called PCI DSS that practically every participant in the credit card ecosystem is required to adhere to. As far as I can tell, the standard policy potentially yields two important results. First, it protects the privacy of cardholders. Second, it helps merchants and card issuers manage risk," Berlind writes.

"If Apple is using credit card numbers for the purpose of tracking (as seems to be the case here) — that Apple might not only be in violation of PCI DSS, it could also be breaking some laws (some of which are based on PCI DSS) as well as breaching the terms of its agreements with card issuers and credit card companies," Berlind writes.

Berlind explores if what Apple seems to be doing is legal in the full aritcle here.


  • Social Web
  • E-mail






Always -- Free ground shipping with orders over $50 at the Apple Store.

Reader Feedback: ( = registered)

Nov 05, 07 - 01:39 pm Comment from: The SteenMachine

Isn't it possible that Apple has already asked their lawyers about the legal nature of this? With Apple's penchant for detail, I would assume so.

Nov 05, 07 - 01:40 pm Comment from: petey

I Apple is doing this then they are just one of 100,000s of companies worldwide that are doing exactly the same thing.

ANY company that accepts credit or debit cards for payment (not just shops!) can quite easily do this.

Why pick on just one company when you can pick on Microsoft or Joe's Plumbing Emporium or any other company...

Nov 05, 07 - 01:42 pm Comment from: fenman

While I am familiar in detail with PCI (as I am a computer security consultant and auditor) there is a more fundamental issue here.

In every country I have travelled to (currently 37) it is actually illegal to refuse cash for a transaction executed in person provided the value of that transaction is less than various sums (such as USD 10,000) that are set for money laundering regulations.

If Apple are refusing cash for a purchase then they are in breach of the law. I really hope they reconsider before someone takes them to court and generates all sorts of negative publicity. I am a fan of Apple so this is from a positive perspective.

Cheers

Nov 05, 07 - 01:47 pm Comment from: Hoosier Mac daddy

Oddly enough - you can pay cash if you buy at an AT&T;store, but they verify your account and tie it to your phone number before you leave, FYI.

Nov 05, 07 - 01:47 pm Comment from: me

You have to use a credit card to rent a car. The value of the car extends beyond the value of the rental. Therefore, the merchant (Hertz, whatever) needs protection.

A similar case can be made for the iPhone and the service agreement.

What is the big deal if you don't intend to break the user agreement?

No kidding, MDN word is "car"

Nov 05, 07 - 01:51 pm Comment from: dix99

Don't pick on Apple on this one. Have you ever tried to rent a car using cash. They be sure to tell you where to go...

Nov 05, 07 - 01:51 pm Comment from: thraxisp

It is legitimate, under PCI DSS, for them to keep your name and part of the card number (first 4 and last 4 digits). This doesn't disclose the card number, but would generate a pretty unique value for them to check for duplicate purchases.

Nov 05, 07 - 01:54 pm Comment from: Rainy Day

Cash is good for all debts, public and private. Apple cannot legally exclude cash sales.

Nov 05, 07 - 01:58 pm Comment from: Lawyer

Rainy Day,

You couldn't be more wrong. It is not illegal for Apple to have a no-cash policy. Apple could require payment only in jellybeans and it would be legal in the U.S.

Nov 05, 07 - 02:00 pm Comment from: fenman

@me,

As a matter of fact I have used cash to hire a car. However they do require additional identification as security against default of terms. It usually means an additional deposit and information such as additional proof of address and ID. All perfectly reasonable.

Nov 05, 07 - 02:02 pm Comment from: Wil

Can someone explain to me what the big deal is if someone wants to buy more than one iPhone and resell them? How would tracking credit card information stop that?

Nov 05, 07 - 02:03 pm Comment from: fenman

By the way, I bought two iPhones for cash in an Apple Store. I was informed that I would need a credit card in order to activate.

Nov 05, 07 - 02:04 pm Comment from: kalel666

"Cash is good for all debts, public and private. Apple cannot legally exclude cash sales."

Wrong: http://www.treas.gov/education/faq/currency/legal-tender.shtml

Nov 05, 07 - 02:06 pm Comment from: Not a Lawyer, but....

...what I understand is that the requirement to accept cash is only for paying debts. For instance, if I owed someone $20 and offered to pay him in cash, but he refused, I could claim the debt was paid off. On the other hand, if there's no debt, the two parties can do business on whatever terms they like.

Nov 05, 07 - 02:07 pm Comment from: brett

One way hashing algorithm anyone? As in: CC# -> Hash, it's non-reversible. 3DES, MD5, etc. Non-event.

Nov 05, 07 - 02:10 pm Comment from: Thomas from Deutschland

Rainy Day:

"Cash is good for all debts, public and private. Apple cannot legally exclude cash sales."

Yes, but if Apple refuses to sell you the iPhone because you do not present a credtit card, there is no debt because there was no sale. Got it?

Nov 05, 07 - 02:11 pm Comment from: DBL

"Isn't it possible that Apple has already asked their lawyers about the legal nature of this? With Apple's penchant for detail, I would assume so."

In other words, if Apple does ... it must be legal?

Yeah, I'll say the word: FANBOY!

Nov 05, 07 - 02:11 pm Comment from: U.S. Treasury FAQ

Q: I thought that United States currency was legal tender for all debts. Some businesses or governmental agencies say that they will only accept checks, money orders or credit cards as payment, and others will only accept currency notes in denominations of $20 or smaller. Isn't this illegal?

A: The pertinent portion of law that applies to your question is the Coinage Act of 1965, specifically Section 31 U.S.C. 5103, entitled "Legal tender," which states: "United States coins and currency (including Federal reserve notes and circulating notes of Federal reserve banks and national banks) are legal tender for all debts, public charges, taxes, and dues."

This statute means that all United States money as identified above are a valid and legal offer of payment for debts when tendered to a creditor. There is, however, no Federal statute mandating that a private business, a person or an organization must accept currency or coins as for payment for goods and/or services. Private businesses are free to develop their own policies on whether or not to accept cash unless there is a State law which says otherwise. For example, a bus line may prohibit payment of fares in pennies or dollar bills. In addition, movie theaters, convenience stores and gas stations may refuse to accept large denomination currency (usually notes above $20) as a matter of policy.

http://www.treas.gov/education/faq/currency/legal-tender.shtml

Nov 05, 07 - 02:13 pm Comment from: AJ

Here's the exact answer from Kalel666:

The pertinent portion of law that applies to your question is the Coinage Act of 1965, specifically Section 31 U.S.C. 5103, entitled "Legal tender," which states: "United States coins and currency (including Federal reserve notes and circulating notes of Federal reserve banks and national banks) are legal tender for all debts, public charges, taxes, and dues."

This statute means that all United States money as identified above are a valid and legal offer of payment for debts when tendered to a creditor. There is, however, no Federal statute mandating that a private business, a person or an organization must accept currency or coins as for payment for goods and/or services. Private businesses are free to develop their own policies on whether or not to accept cash unless there is a State law which says otherwise. For example, a bus line may prohibit payment of fares in pennies or dollar bills. In addition, movie theaters, convenience stores and gas stations may refuse to accept large denomination currency (usually notes above $20) as a matter of policy.

Nov 05, 07 - 02:19 pm Comment from: jeff

This whole issue seems unnecessary. When I go into a Verizon store to purchase a phone they require that I activate it during the purchase. No cell plan, no phone. Why doesn't Apple activate the phones in the store before handing them to the customer? If a person chooses to unlock their phone they will be liable for the termination fee.

(That said... I'm all for divorcing phones from cell companies, but we are stuck with this system until the government gets a backbone. I like how Europeans can swap SIM cards and go with whatever company they choose.)

Nov 05, 07 - 02:32 pm Comment from: @jeff

I agree with your take 100%...

Nov 05, 07 - 02:38 pm Comment from: RC

Nobody is "required" to accept cash as payment in the US. I lived in apartments for many years before buying a house, and most of the complexes I lived in would not accept cash for the monthly rent payment. I had to pay with a check (personal or cashiers), or a money order. Their reasoning was that they didn't want to have that much cash on hand (i.e. hundreds of people paying several hundred in cash on the 1st day of the month) because it would be a perfect opportunity for them to get robbed. I'm sure there are many other examples like that out there of places that won't accept cash.

Besides, if you have a debit card, you're an idiot for ever carrying more than $20 in cash on your person anyway. Debit cards are accepted virtually everywhere, and you're just asking to get robbed if you're carrying around a wad of cash.

Nov 05, 07 - 02:41 pm Comment from: The SteenMachine

@DBL

I never stated if Apple does then = legal. I stated that they would've checked it out thoroughly beforehand. Any reputable company would.

Can you read AND interpret at the same time?! Frickin' numbnuts.

Nov 05, 07 - 02:44 pm Comment from: Long duc Dong

You cannot pay cash to get a room in most hotels nowadays. Tell me if that is legal or not.

Nov 05, 07 - 02:47 pm Comment from: mark

You can't use cash to bid for a hotel room on priceline. They use your credit card no, name, and address to ensure you are following the bidding rules.

Nov 05, 07 - 02:48 pm Comment from: PC Apologist

As demonstrated (again and again) here, there's no federal law requiring acceptance of cash for a private sale. Anyone live in a state where there's a more restrictive law?

A name, billing address, and last 4 digits of the credit card should be sufficient for them to ID you, without retaining the whole card number in violation of PCI-DSS.

Jeff - the reason they don't lock the phone to an acct. at point of sale is so that they can be given as gifts. That's pure Apple showmanship right there. What better feeling than a shiny new iPhone under the tree or in a wrapped up box with a bow?

Sorry, Charlies. For now at least, Apple's rule is probably legal.

Nov 05, 07 - 03:11 pm Comment from: Hg Wells

I think part of the problem here, minimally, is disclosure. Clearly, Apple is using the card info for something. Disclosure as to what info and what purposes (SPECIFIC purposes) would be quite appropriate. Apple AND OTHER COMPANIES should be doing that and privacy advocates should be going after this.

Nov 05, 07 - 03:15 pm Comment from: yet another steve via iPodDailyNews

I don't know what Apple is doing, but one way functions-->hashes are wonderful wonderful things just for this sort of requirement. Enables exact matching of a CC# without retaining ANY of the CC#.

Or... what about standard address validation on a CC# (as is always done online). Your CC must match your address, Apple only retains your name and address. Once again, no need to retain ANY of the CC#.

Retaining the CC# isn't all that helpful. Some people have a surpising number of cards.

Nov 05, 07 - 03:36 pm Comment from: yet another steve via iPodDailyNews

Ironically zd.net always wants more info that I care to give, so I can't comment there.

But the more I think about it, CC# to individual is a many-to-one relationship. You'd use the CC to verify the individual and address; but the only thing worth retaining is the name and address. No value in retaining the CC#, people have lots of different CC#s. (And no need to use a one way hash or something technically clever.)

Basic database concept here. I feel soooo logical and clever (undoubtedly I'll be humbled by another software bug soon.)

Since I refuse to give zdnet my personal information... you all feel free to enlighten them. =)

Nov 05, 07 - 03:38 pm Comment from: Demon

Apple's System does not retain your Credit Card information, in fact the Apple POS system does not even transfer your CC number or the name on it out of the local Apple Store's POS System. The iPhone's serial number is sent to Apple's Inventory Control System only. The Credit Card requirement came about because iPhones purchased with cash by people whom did not have a Credit Card or Debit Visa/MC card and were unable to activate the iPhone with AT&T;due to no credit or bad credit. AT&T;requires an AT&T;Account to buy an iPhone so, you already have credit with AT&T;. Apple requiring the Credit/debt Card to purchase an iPhone is a 99% accurate way to tell if you have the credit to get an account with AT&T;for activation. Without doing a credit check.

MDN Word: issue -- Apple requiring a credit card to buy an iPhone is not a legal issue.

Nov 05, 07 - 03:50 pm Comment from: lbuschjr

What Apple is likely doing here is tying a name (the purchaser) to the iPhone serial number. That way if the purchaser sells the iPhone to someone else who unlocks it, Apple can deny warranty claims because it's not the original owner. Apple also has a case to deny warranty claims because the subsequent buyer never registered the iPhone with Apple, and that the iPhone was likely hacked in violation of the user agreement.

In other words, if you want an iPhone unlocked, you're probably forfeiting any warranty, even if you try to restore the software. Steve is watching.

Nov 05, 07 - 04:39 pm Comment from: Woody

Kalel666's link nailed at least part of this FUD to a post in the sun, drove a stake through its heart, poured holy water on it, and tied garlic around its neck. Still it will rise again.

Nov 05, 07 - 04:47 pm Comment from: de kölsche jung

first, most businesses reserve the right to refuse business to anyone for any reason. second, regardless of the hacking, apple needs to limit its purchases for its growing international market for the iphone. if we all cannibalized iphones in the us, we're creating a problem for those people in other markets, and vice versa.

it's always a few pesky people who would complain about anything (service provider, etc.) and those who break the contract, to which they agreed when they activated the phone, that are the bottom of every problem.

pure democracy and free-markets are utopias. quit your bitchin'.

Nov 05, 07 - 05:05 pm Comment from: Hg Wells

Demon, if true (and it sounds good to me), Apple should make this known or allow people to take their chances by signing a disclosure agreement without having to use a credit card.

Nov 05, 07 - 06:05 pm Comment from: Big Al

Thousands of those iPhones for cash are being sold in black markets all over the world.

My money is on Homeland Security.

Nov 05, 07 - 06:36 pm Comment from: Answer

There's only one answer. Apple is Evil. Did you misinterpret the 1984 Ad Apple put out. They were showing you their plans for you right there.

It was Future Steve on the big screen, and the chick with the sledgehammer was just showing you what Steve will have somebody do to your shiny new Apple product if you do something with it that he doesn't like.

Nov 05, 07 - 10:31 pm Comment from: Legal

If I walk around in a store with goods I intend to buy... should I be approached by security who may think I might possibly be shop lifting. No.

What is being described is a one sided POSSIBLE scenario.
Is Apple using credit cards to track iPhone sales to stop people from disconnecting them from the AT&T;connection.

Hmmmmmmmm.

Sounds similar to how I opened my comment.

Once someone chooses to void their product with AT&T;, there is a degree of STEALING going on.

PERHAPS that is when APPLE uses the credit card to track and nab the buyer... then it maybe QUITE LEGAL to do.
Besides, all COMPANIES love to have your NAME, ADDRESS, POSTAL CODE and PHONE NUMBER handy on there systems.

@fenman
there are store policies where 20 dollar bills or 50 even 100 dollar bills HAVE BEEN refused in CANADA. Many in fact. It is up to the store to decide this all with concerns of counterfeiting.
It maybe wrong to refuse cash... but it DOES happen more times then anyone is tracking.


I agree with "de kölsche jung"

Steve is watching, Apple is Evil

ok maybe

but they have still made wonderful products, and software which I am proud to use.

And like iTunes and MP3s...
I fear not, pay and use things legally.
Apple has provided the iPhone in a CONTRACT no one CLEARLY has shown or tried to uncover... a deal with AT&T;who like the MUSIC industry may have placed LEGAL restraints on Apple for letting hackers get into iPhone.

If the author is allowed to speculate so can everyone else.

It seems to be the weeks thing to find negativity with Apple these days.

HAHAHAHAH Microsoft in WHAT... under the radar these days?

Nov 05, 07 - 11:24 pm Comment from: how convenient your video is not posted

Why David Berlind investigative style of reporting discredits him and raises legal questions as to why his video is not aired.

David Berlind has been Executive Editor at ZDNet since 1998.

Editor’s Note: The video is not currently available. We apologize for the inconvenience. -- cos you handled things illegally!!!!

Also, YOU should apologize... not "we"... don't drag your entire company down to your level of investigative reporting.

IT is ILLEGAL to record any phone conversation without the consent of the second party / person being recorded.
As is video taping or taking pictures.

Bad move... bad reporting... bad bad bad...

Hmmmm, Berlind likes braking the law and has exposed himself.

We don't need to see your credit card Mr. Berlind. We know who you are and it makes us sick.

I wanted to reply to Davids blog and leave a comment...
but UNLIKE MDN...

ZNET wants all my information.
That's right, my name, my address, my email....
blah blah blah etc... fill out a form... etc....
FOR WHAT PURPOSE....
what are you going to USE all this INFORMATION for ZNET?

I WANT TO KNOW... hmmmmmmm

too much to bother with in order to just leave a comment.

oh well

SO APPLE maybe tracking buyers and maybe braking the PCI DSS agreement with customers and credit information... BUT then it is doing BASIC steps to prevent THEFT of reverse engineering of the iPhone with this information.
Catching thieves once the act has been committed.

THERE IS NO PROOF WHAT SO EVER APPLE IS USING THE ACQUIRED INFORMATION ILLEGALLY.

ZNET = MS the mother f___ company of Znet.

"My educated guess is that Apple’s practices have kicked off a shitstorm of an inquisition in the credit card industry that has lawyers on both sides poring through the PCI DSS documentation, merchant contracts, and state/federal laws and that this isn’t the last we will hear of this."

COS Lawyers smell money.

Time will tell, we wait and see. My uneducated guess it Apple comes clean on any wrong doing.

Why?

Because there is nothing to fear if you haven't done any wrong doing.

Unlike Mr. Berlind... who apparently video taped all this
and has caught himself in some sticky legalities of his own.

All just to ride the the Apple wave.

Shame

Nov 05, 07 - 11:26 pm Comment from: GotAMac

At an Apple Store in Annapolis, MD, the sales person told me that any number of Apple Store gift cards could be used together with a credit card to purchase and iPhone. Only part or the purchase (let's say $10) is required the credit card purchase.

Nov 05, 07 - 11:34 pm Comment from: Donald Berlind Junior

@U.S. Treasury FAQ

Excellently comment !!!!

@Demon

Also a well stated comment !!!

thx for your clarity

Nov 06, 07 - 08:31 am Comment from: MKJJ

Here in the UK, as someone has stated you can't get a hotel room in most of the major chains with cash and nearly all retail outlets, garages etc don't take cheques for payment.

Nov 06, 07 - 05:10 pm Comment from: AppleBee

OFF TOPIC guys....

"As I reported in that first piece, Apple hasn’t been very forthcoming about its reasons for requiring a credit card to purchase an iPhone. So, I came up with a list of my own possibilities, all but one of which were big brother-esque in nature. After all, why else would Apple require a credit card if it wasn’t going to retain that information which includes your identity for some reason? There is no information for a merchant to retain when you buy something with cash. Apple must want that information for something. Perhaps even more worthy of scrutiny, according to some members of the credit card industry that reached out to me, is whether Apple’s practice violates any legal agreements, standards, or laws when it comes to credit card processing."

It's not about what does Apple accept for iPhone payment but you must use a credit card for an iPhone transaction.
Put it this way, no matter you use a credit card to pay 1 buck for your iPhone or the whole $399 + tax, they still want your credit card information (aka personal identity).

That's why they "suggested that I pay $1 of the purchase price with my credit card and the rest in cash." Exactly what happened to me today at Apple store. Yeah Apple could accept all cash or whatever for iPhone transaction, but more importantly Apple needs some form of your ID to be tied with the IMEI they sold to you. And they will use those information to.... who knows.

Nov 08, 07 - 09:11 am Comment from: nerdbrain

This is part of a response I made to Berlind's podcast last week. "They are not necessarily using it for tracking your purchases. What you should have done was to try making more than one purchase of a pair of iPhones (not necessarily on the same day), [and] see if it triggers anything that prevents you from doing so, besides being recognized.

I think having to use a debit or credit card forces any potential unauthorized resellers to think twice. It just makes life harder for them. Remember, your average customer isn't buying more than that.

Finally, I think your assumptions have not been rigorously tested enough to justify your accusations of the company."

Nov 08, 07 - 09:29 am Comment from: nerdbrain

I think Berlind asking questions about the legality of restricting purchases to card sales (debit/credit) is important. But I think, intelligent though he may be, he is making some crude assumption about Apple's policy surrounding iPhone purchases.

All this blog-talk may well force Apple reveal that it, indeed, can do nothing, bar restricting purchases to cards, to stop resellers buying iPhones. In other words, the is not database-checking system.

Here is what I wrote to him about this: "It will be too difficult for Apple to enforce this policy the way it is stated in the podcast... Only managers will be capable of checking card numbers against purchases. [AFAIK, this does not show customer data, only purchases relating to a number.] I know this may partly sound like a confirmation of what you are saying but bear with me.

To enforce the policy the way you've suggested, a manager will have to manually check the system *every time* there is a card transaction. Manually! It just can't be done. And it seems silly for him to have checked the way you've said in the podcast as all Apple cares about is enforcing a card only/2 per person rule.

By trying to help you pay cash he may have landed himself in trouble. These managers can sometimes be over-helpful.

... I don't think Apple has said how they are going to [enforce] the rule. I think what [the manager] told you was just an assumption. Information sometimes takes a while to be fully clarified.

... However, not being privy to the goings-on inside Apple, I would suggest contacting them on the matter."

Nov 25, 07 - 10:25 am Comment from: asim99

Apple store told me that I cannot use my cash because this is to prevent people selling iphones abroad.Ok!I could just use my debit card but I decided not to honor this store. I went to At and T store and I bought it with the same cash,They did not seem to have a problem with..Here's what happens: You have to show and Id and register at the moment when you buy an iPhone or any phone at the At and T store.YOU ARE ALREADY TRACKED. However Apple did NOT want to spend the money and time to execute this system and somebody (must be one of the executives from the nineties when Apple was falling apart) decided NOT TO TAKE cash for iPhone purchases.Is it wise ? Absolutely not! They will never stop 1000 unlocked sellers with or without cash.
Please note that no tourist can sell an outsider phone because all European countries (not sure with all the rest of the world)restricted to use the phones purchased from a different country except the owner must register with a valid passport upon entering his home by submitting the phone only once a year.
My Visa card company denied tracking customer information by credit cards submission.It is illegal.
It seems like Jobs is getting old to make wise decisions. We make 2 yrs contract with At and T not with Apple.It means that I can always change my data services to Blackberry or Mobile etc.Wait till Google phone arrives.
Finally Nokia N95 is way better phone but the stores do not carry expensive phones.

Reader feedback page 1 of 1 pages:

Always -- Free ground shipping with orders over $50 at the Apple Store.

Add Your Feedback:

Register or Login

Name:

Email: (optional)

Emoticons | Allowed HTML Tags

Remember my info   Notify me of follow-up comments?

Please enter the "MDN Magic Word" you see in the image below: