It’s Secure

Naturally Apple claims that its in-app purchasing system is good for consumers, and actually works to protect them, and there’s a certain amount of truth to this, to be fair — it’s not hard to imagine a plethora of scammy apps appearing on the App Store that would leave both end users and even Apple with little recourse should money be taken directly without providing the promised content.

However, it goes well beyond fraudulent apps too. If you’re an Apple customer, chances are you already have your credit card information on file with Apple, and you trust them to keep it safe. Whenever you make an in-app purchase on an iOS device, it’s Apple, and not the developer, that’s charging your credit card and collecting the money from you. The developer not only never sees your credit card information, they actually have no part of the transaction at all. What they get is a lump-sum payout of all in-app transactions from Apple (minus its 30 percent, of course) on a regular basis.

Contrast this with an in-app purchasing system run by each developer. In order for this to work, developers would need to collect credit card or other payment information from each user, and many developers would need to store that information too (or at least offer to do so) in order to make future transactions easier. This would be especially true with gaming and subscription apps, where repeated transactions and recurring charges are the norm.

This leaves your credit card info stored in a potentially huge number of other places, and it’s not enough to simply trust the integrity of the developers you’re giving that information to (and many of them would be relatively small and unknown companies) — you also need to trust their ability to run their systems securely enough to avoid being hacked, and as we’ve seen before, even high-profile companies like Adobe and Sony aren’t immune to these kinds of problems. While it’s not inconceivable that Apple could suffer a similar fate, so far its record of defending against such hacks is entirely clean. Besides, since you’d still be using Apple’s payment system for at least some things, it’s going to have your credit card info on file no matter what, so why risk having your information stored with dozens of smaller developers too?

The other critical factor here is how developers would handle authorizing new transactions. Once your credit card payment information is stored, what confirmation do you get that you’re about to make a purchase? With Apple’s system, there’s a clear prompt that comes up asking for a password, Face ID, or Touch ID, and it appears the same way no matter what app you’re using. We’ve already seen developers try to scam their way around Apple’s in-app payment prompts, so a direct payment system would be even more for abuse, whether it’s for deliberate scams or just encouraging more impulsive purchases of in-game currency.

Of course, Apple could mitigate most of these risks by enforcing a requirement to use Apple Pay for all third-party purchases, which would certainly provide a much greater level of security, and while Apple gets a small cut of each Apple Pay transaction, that’s buried in normal credit card processing fees, so it’s actually eaten by the banks, and not the developers.