Evan Schuman's StorefrontBacktalk

Even more disappointing (or frightening) is the fact that Apple has been unable to shut down the fraud. Apple blocked Borodin’s IP address and asked his ISP to shut down the server over the weekend, but Borodin just shifted the server to another country and kept going. The exploit is simple enough that there appears to be no easy way for Apple to stop the fraud without rearchitecting its transaction process.

In itself, that type of overhaul wouldn’t be a bad thing. As much as it would complicate life for app developers and users, it means Apple would have a much more secure transaction system. If Apple can lock down in-app transactions, it can credibly claim to be able to do in-store mobile payments securely, too.

But as things stand now, Apple’s credibility is eroding just as the company is dipping a toe into mobile payments. The actual number of fraudulent transactions isn’t high. But what everyone remembers is that with every faked transaction, the seller isn’t getting paid. If Apple’s goal is to convince retailers it should handle the money, this isn’t the way to do it.

Then there’s the collateral damage to Apple’s technical cred. It turns out that account IDs and passwords are being sent unencrypted—which wasn’t really safe even when Apple thought the only place they were going was to Apple’s servers. The fact that Apple requires app developers (read that as “retailers”) to essentially provide their own transaction security to confirm receipts sounds simultaneously cheap and unrealistic.

And Apple’s assumption that no users would make adjustments to their iPhones or iPads to steal from those retailers seems incredibly naive.

There’s bound to be a learning curve with mobile payments, especially when it comes to security. Google has had its fumbled demonstrations and security holes, and PayPal is still depending on its insecure phone-number-plus-PIN system in-store. (ISIS still hasn’t officially started its mobile payments trial scheduled for this summer, but there are still a few weeks of summer left.) However, hardly anyone is using any of these mobile payment services, so the risk has been minimal.

But for Apple, mobile payments are already a billion-dollar business—and that’s before an NFC-enabled iPhone makes in-store payments possible.

Everyone’s assumption is that if anyone can convince mobile users to use tap-to-pay with their phones, it’s Apple. That’s still the most likely scenario, no matter how long Apple waits for the best time to launch in-store mobile payments.

But if Apple can’t clean up its current mobile payments mess—and fast—it will effectively shoot itself in the foot, with both retailers and customers. If that happens, no matter how much we like the idea, we’ll never get the chance to see whether or not Apple really does represent competition with Visa.