Our response to the CMA's consultation on iPhone contactless payments

Summary

The Centre for Digital Consumers welcomes the opportunity to respond to the Competition and Markets Authority's (CMA) consultation on its proposed conduct requirement for Apple on near field communication (NFC). NFC lets a phone pay or open a door when it is held near a reader.

We support the proposals. The requirement covers two technologies. A 'secure element' (SE) is a separate high-security chip in the phone that stores the card's details. With 'host-based card emulation' (HCE), an app on the phone handles the payment, usually using details stored securely online. We support access to both at the developer's choice. We also support three provisions. They stop Apple treating developers differently without justification because of their choice of technology (paragraph 9(b)(iii)). They give other apps the features behind Express Mode and Power Reserve (paragraph 8). And they give other apps "the same or equivalent authentication features as those to which Apple's own apps have access, including biometrics" (interpretative note 9(c)).

Our concern is how consumers will fare once other apps arrive. Most people pick a wallet once and keep it, and they cannot see which technology it uses. We make four recommendations, and set out our reasoning under the question each relates to.

• The CMA should add security incidents, split by HCE and SE, to Apple's compliance reports, and work with the Financial Conduct Authority (FCA) and the Payment Systems Regulator (PSR) to get fraud data on the same split.
• The CMA should oblige Apple to show people choosing a default contactless app whether it works without a mobile signal and when the battery is low.
• The CMA should make sure that people who use an app as their default are told promptly, and shown how to switch, when Apple restricts or suspends it.
• The CMA should work with the FCA to make clear where people can take a complaint about a wallet provider that is not regulated, and whether there is a gap.

Question 6.8

Would providing access to the iOS functionalities used by Express Mode and Power Reserve create any security or privacy risks? If so, please provide a detailed description and any measures which might mitigate them.

Chapter 5: Security and privacy (paragraphs 5.53 to 5.72)

We have no evidence that giving other apps access to Express Mode and Power Reserve would create security or privacy risks, and we agree with the CMA's provisional assessment, including on HCE. We think the evidence it relies on should be checked once the requirement is in force.

The CMA's assessment is careful

The CMA sets out Apple's concerns about HCE and weighs them against evidence from the National Cyber Security Centre, the European Commission and others. It reports fraud figures from one stakeholder showing that in-person payments "using Apple Wallet or Google Wallet had fraud count rates closely comparable to each other and three times lower compared with physical cards" (paragraph 5.60(c)). It accepts that "the on-device hardware-backed security provided by SE may be better suited for certain use cases such as those involving high-assurance credentials" (paragraph 5.68), and lets developers choose.

It concludes that "any residual additional security or privacy risk arising from the proposed NFC Access CR is likely to be low" (paragraph 5.72). We have found no evidence to the contrary.

But the comparative evidence is limited

Apple "did not provide any documents setting out independent audits of its SE and HCE solutions, fraud statistics comparing these solutions, or stakeholder complaints about actual harms" (paragraph 5.56). The fraud comparison the CMA does cite comes from a single stakeholder, is not published, and compares Apple Wallet with Google Wallet rather than the two technologies on the iPhone (paragraph 5.60(c)). A 2021 review by UL Solutions found no difference in risk (paragraph 5.60(b)), but we have not found more recent published data comparing the two. UK Finance's 2026 fraud report gives a single figure for contactless fraud on cards and mobile devices, and does not split it by technology.

The CMA notes that rival wallets have used HCE on iPhones in the European Economic Area since May 2025 without evidence of "any material increase in harms to consumers" (paragraph 5.67). It also says that it does "not treat the absence of reported harm in the EEA as conclusive" (paragraph 5.66).

The assessment rests on self-regulation that the compliance reports would not measure

The CMA finds that "industry self-regulation has been effective at mitigating the risks" (paragraph 5.70), and that developers have incentives to keep their apps secure (paragraph 5.81). Apple would send the CMA compliance reports every three months (paragraph 4.259). The metrics proposed for them cover applications (split by HCE and SE), suspensions and the reasons for them, processing times, terms, fees, complaints and the protection of developers' information (paragraph 4.261). Suspensions for security reasons would show up. But nothing would show fraud or security incidents affecting consumers, or whether either technology fares worse.

Express Mode lets a phone pay without being unlocked. Power Reserve lets it keep paying for a while after the battery is too low for the phone to work normally. The CMA found no evidence that opening these up would materially increase risk (paragraph 5.71), and notes no major security incident from similar features on Google and Samsung phones (paragraph 5.63). We support giving them to other apps. If a weakness emerges, the CMA should be able to see it.

Recommendation

The CMA should add security incidents affecting NFC apps on iOS, split by HCE and SE, to the metrics at paragraph 4.261. It should work with the FCA and the PSR to get fraud data from card issuers on the same split, so that its provisional view can be tested against evidence once the requirement is in force.

Question 6.11

What are the main parameters of competition (that is, what do consumers care most about; eg, price, quality, range or service) in the supply of (i) payments and (ii) non-payment NFC-based apps?

Chapter 6: Questions for consultation

Most consumers care that their wallet works when they need it, and that they are protected if something goes wrong. Most do not compare wallets at all.

People choose a wallet once and keep it

Which? research, which the CMA also cites, found that consumers "are generally not discerning about which wallet they use". Of 2,625 digital wallet users surveyed, 48% said they used their preferred wallet because "it was already set up on my device or account". Almost three-quarters (74%) of wallet users had never considered switching.

The CMA itself notes that "users may not be aware that activating the full range of functionality for NFC transactions requires an app to be set as the default" (paragraph 4.252). We support the default status provisions (paragraphs 23 to 26) for that reason.

What people will notice is whether it works

Nobody will ask whether a wallet uses HCE or SE. They will notice if their phone fails at a ticket barrier because it has been offline too long, or stops working when the battery is low. The CMA's call for evidence said that "users can generally only use an HCE contactless app to make a finite number of offline transactions" before the app needs a connection again. Whether an app offers features like Express Mode and Power Reserve depends on the developer's choices, and only works when the app is the default (paragraph 8). The CMA refers to these features as being for SE apps (paragraph 5.50(c)).

These differences are legitimate, but they are invisible at the point of choice. Setting a default is the moment to tell people.

Recommendation

The CMA should oblige Apple to show, where people choose a default contactless app, whether the app works without a mobile signal and when the battery is low. This could sit alongside the default status provisions (paragraphs 23 to 26), with the developer supplying the information.

Question 6.12

Please list any other benefits or costs you foresee arising (i) to you and (ii) more generally from the proposed NFC Access CR, and please provide an estimate of the magnitude of their effect, including any supporting evidence available.

Chapter 3: Our proposed NFC Access CR and interpretative notes

We see two risks to consumers that the proposals could address cheaply. Neither can be measured in advance.

A suspension leaves people without their way to pay

Where a developer or third party breaks the law or industry standards and this causes or threatens, among other things, "another form of serious harm to UK End-Users" (paragraph 6(c)), Apple may suspend the app's access without advance notice. We support this power. But the CMA's expectations on notice concern the developer: Apple "will engage with the affected Authorised Developer as soon as possible" (interpretative note 11(a)). Nothing in the proposals deals with the people who use the suspended app as their default. Many would find out only when a payment fails at a till.

People need somewhere to complain about the wallet itself

If a payment is made without permission, the person's bank or card provider must refund it, whichever technology was used. The FCA and the PSR have confirmed that card issuers are liable "including transactions made through a digital wallet" (FS25/1, paragraph 3.49).

But a complaint about the wallet itself, such as a failure to work or a poor response to a suspension, is different. The FCA and the PSR note that "the card issuer is regulated by the FCA, while the digital wallet provider is not" (FS25/1, paragraph 3.56). The complaints process in the proposals is "for the purpose of handling complaints from Developers" (paragraph 27). The CMA is right that the requirement "does not determine the regulatory status of any participant", and that existing regulatory obligations continue to apply (footnote 282). But as new wallet providers enter, more consumers may find they have nowhere to take that kind of complaint.

Recommendation

The CMA should make sure that, when Apple restricts or suspends an app, people who use it as their default are told promptly and shown how to switch. Paragraph 7 or interpretative note 11 could be extended to cover them. It should also work with the FCA to make clear where people can take a complaint about a wallet provider that is not regulated, and whether there is a gap.

References are to the consultation document on the proposed NFC access conduct requirement for Apple's mobile platform, published by the Competition and Markets Authority on 20 October 2026. The proposed requirement and its interpretative notes are in Chapter 3. We also refer to the CMA's call for evidence, Issues relating to NFC access on iOS, published on 30 June 2026. The consultation closes at 5pm on 17 November 2026, and anyone can respond by email to mobilesms@cma.gov.uk or through the consultation portal.