I Don’t Use Apple Pay Because It’s Less Secure ...: Perception of Security and Usability in Mobile Tap-and-Pay

—This paper reports on why people use, not use, or have stopped using mobile tap-and-pay in stores. The results of our online survey with 349 Apple Pay and 511 Android Pay participants suggest that the top reason for using mobile tap-and-pay is usability . Surprisingly, for nonusers of Apple Pay, security was their biggest concern. A common security misconception we found among the nonusers (who stated security as their biggest concern) was that they felt storing card information on their phones is less secure than physically carrying cards inside their wallets. Our security knowledge questions revealed that such participants lack knowledge about the security mechanisms being used to protect card information. We also found a positive correlation between the participants’ familiarity with security of mobile tap-and-pay and their adoption rate, suggesting that the participants who are more knowledgeable of the security protections in place are more likely to be using the technology.


I. INTRODUCTION
In October 2014, Apple launched iPhone 6 (and 6 Plus) and their first mobile payment solution called "Apple Pay" in the United States.Their marketing pitch was: tap-and-pay with iPhones in stores is faster and more secure than swipe-and-pay with traditional debit or credit cards.It quickly became the biggest tap-and-pay mobile payment solution, accounting for two out of every three dollars processed through contact-less payment systems in the United States [1].Google launched their own mobile payment solution called "Android Pay" around September 2015, quickly catching up with the popularity of Apple Pay [2].Both companies claim that their tap-and-pay solutions are more convenient and more secure than swipe-andpay with traditional debit or credit cards.
In this paper, we investigate why people use or not use mobile tap-and-pay solutions.Our aim is to (1) understand to what extent usability and security factors have affected people's decision to use or not use mobile tap-and-pay, and (2) analyze specific usability and security concerns and misconceptions that people have.Based on gathered evidence, we also discuss potential strategies for improving adoption rates of tap-and-pay solutions.
First, we conducted in-person interviews with 36 participants to define hypotheses and develop questionnaire for a follow-up, large-scale study.Using that questionnaire, we conducted an online survey through Amazon Mechanical Turk, collecting 860 responses in total.The survey results suggest that the top reason for using mobile tap-and-pay is because it is more usable than traditional debit or credit cards.In contrast, our survey identified user security concerns as the top reason for not using Apple Pay.In fact, Apple Pay nonusers were not too concerned about usability.These findings are not intuitive, and contrast with the findings from [3]: without any empirical research, it is hard for one to guess that the top concern for nonusers is security, while the top reason for users is usability.These findings suggest that, to improve adoption rate, Apple should primarily focus on addressing the security concerns of nonusers.
Even though security was one of the top concerns for nonusers, about 81% of them (compared to about 66% of users), had limited knowledge of the actual security mechanisms being used.We found a positive correlation between the level of knowledge the participants have about the security mechanisms used by mobile tap-and-pay technologies, and their adoption rate.Furthermore, 69% of the nonusers whose top concern was security said they would use mobile tap-and-pay if they learn that using it is more secure than using debit or credit cards.They were mostly concerned about "insecure storage of card information on their mobile phones," which we believe is a security misconception, and is due to their lack of understanding of the actual card protection mechanisms (e.g., Apple's secure element) being used.We also identified a common usability misconception where about 27% of the participants believed that they need to first unlock their phones, and start a payment application in order to make a payment.This was the top reason for feeling mobile tap-and-pay is inconvenient and slow.However, neither technology requires users to start an application, and Apple Pay does not require users to unlock their phones before paying.To the best of our knowledge, this is the first scientific analysis of the specific security and usability concerns that are preventing people from using mobile tap-andpay, and common misconceptions that need to be addressed.

II. BACKGROUND: APPLE PAY AND ANDROID PAY
"Tap-and-pay" payment solutions by Apple Pay and Android Pay, allow users to pay through their mobile devices at pointof-sale (POS) terminals.This paper only focuses on this tapand-pay feature and not on online payments.Apple Pay works on iPhone 6 and later versions, however this research was conducted prior to the release of iPhone 7. Android Pay is supported on multiple Android devices that are running version 4.4 or later and support near field communication (NFC).

A. Setup and use
To set up Apple Pay, users simply add a debit or credit card on the Wallet app.The card information can be imported from iTunes, entered manually, or added by taking a picture of a card.Users can start using Apple Pay after the card verification process.To tap-and-pay in stores, users need to hold their iPhone close to a NFC reader.A default payment card can be pre-selected on the Wallet app.Users then place a finger on Touch ID (fingerprint scanner) to authenticate themselves, and complete the payment process.The Wallet app immediately notifies users about confirmed transactions.Android Pay can be activated by entering the debit or credit card information through the Android Pay app.The overall tap-and-pay procedures are similar to that of Apple Pay, except that Android Pay users are required to first unlock their device (e.g., by drawing a screen lock pattern or password), and then place their device near a POS terminal.

B. Apple Pay security
According to the iOS security guide [4], the card information entered by a user is sent over TLS to the Apple server and the bank for card number and expiration date verification.After this check, Apple Pay performs "link and provision," sending the card's CVV information to the bank and asking the bank's approval to add the card.After adding the card, the payment network or bank creates a "device account number," which is a random 16-digit number that is unique to the user's device and card; it is also referred to as the "token."The device account number is encrypted, and sent over to the user's iPhone.A cryptographic token key is also encrypted and sent; this key is used to generate "dynamic security codes" that are unique to each Apple Pay transaction.The encrypted device account number and token key cannot be decrypted by Apple, and are added to the "secure element" of the user's iPhone.All payment related information are stored in the secure element, which is a hardware chip that is designed to securely store and protect confidential information of hosting applications [5].
Apple Pay uses NFC to interact with payment terminals.A single touch on Touch ID authenticates the user, ensuring that only the owner of the iPhone is allowed to make payments.After authentication, the secure element provides the device account number, one-time unique number, and transactionspecific dynamic security code.All of this information is sent to the payment terminal.The user's credit card number is never shared with the merchant.Before approving the payment, the payment service verifies the payment information by checking that the dynamic security code is tied to the user's iPhone.

C. Android Pay security
Android Pay also uses tokenization [6], and never sends debit or credit card information to merchants.Instead, it uses a virtual account number (like the device account numbers used in Apple Pay).What is different between the two is that Android Pay primarily uses a card emulation method called host-based card emulation (HCE) compared to Apple Pay's card emulation processed through the secure element.Due to the insecure nature of host CPUs, Android Pay app moves all the card data to remote secure cloud servers (instead of routing them to the CPU) where most of the card processing (including tokenization) and storage takes place.During a transaction, transaction-specific tokens are generated in the cloud, or fetched from spare token payloads locally available on the device if server connections are not available, and forwarded to a user's device along with the virtual account number.Android Pay requires users to first unlock their device, ensuring that only the owner of a device can use the tap-and-pay feature.

A. Methodology
For our first study, we conducted in-person interviews to better understand the reasons for why people use, not use, or stop using mobile tap-and-pay, and their feelings toward mobile tap-and-pay security and usability.We focused on qualitative data collection while designing the interview.We applied semistructured interview techniques to allow the participants to freely share their thoughts, feelings, and concerns.Interviews were conducted on two different participant pools within the United States -we recruited 21 participants from a university, and 15 participants through online advertisements such as Craigslist, targeting a more general audience.Prior to the aforementioned interviews, we also conducted a pilot study with 19 (11 Apple Pay and 8 Android Pay) participants from a large IT company, and used their feedback to revise the interview structure, questions, and guidelines.
Interviews were conducted by two researchers together to ensure that all of the questions were asked and consistently understood by the participants.On average, the interviews took about 35 minutes, and every participant was compensated for their time with a $24 Amazon gift card.We recorded audio of all the interviews with the participants' consent.Using the ATLAS.tisoftware, the two researchers separately performed thematic analysis of each interview, independently creating lists of themes observed in the responses to each question.Such themes are referred to as "codes" in grounded theory [7].After every few coding session, the two researchers got together to discuss the identified codes until they reached a consensus.As a result, after coding 36 responses (21 from the university group, and 15 from the online advertisement group), we were able to create two unified codebooks.The codebook for the university group consisted of 40 unique codes, and the codebook for the online advertisement group consisted of 38 unique codes.There were 28 common codes between the two codebooks.The researchers disagreed on three responses, achieving an interrater agreement of 91.67%.Both of our studies were approved by a university Institutional Review Board (IRB).

1) Participant recruitment:
To achieve strong diversity in participants' responses, we recruited participants from two separate pools.The first group was recruited from a university through university mailing lists, university Facebook group, and advertisements posted on public notice boards; the second group was recruited through online advertisements that were posted on Craigslist, Backpage, Adoos, and Oodle.Our inclusion criteria were participants of age 18 years or older who own a phone that supports Apple Pay or Android Pay, and has some familiarity with Apple Pay or Android Pay.With the responses collected from the university pool, we did not identify any new code after the 18th interview, and stopped scheduling new interviews.With the responses collected from the online advertisements, we did not identify any new code after the 13th interview.
2) Procedures: After agreeing to be interviewed, the participants were asked to show us their phone (we checked whether their phone supports Apple Pay or Android Pay), and read and sign a consent form.Next, the interviewers explained the purpose of the interview.To avoid priming, the security and usability focus of the interview was revealed after asking why they use, not use, or stopped using mobile tap-and-pay.The interview consisted of the following parts: 1) Usage: In the first part, we asked the participants about their familiarity with Apple Pay and Android Pay, whether they have set it up, and whether they use it to pay in stores.2) Why use or not use: Next, we asked the participants why they use, not use, or stopped using Apple Pay or Android Pay.We then asked how they feel about its security and usability.3) Familiarity with security: In the last part, we asked if they understand (1) how Apple Pay or Android Pay protect their tap-and-pay transaction privacy and security, (2) how it protects debit or credit card details, and (3) how it ensures that only they can pay with their phone.

B. Results
1) Demographics: From the university pool, we recruited 21, out of which 14 were Apple Pay participants, and 7 were Android Pay participants.9 were females, and the average age was 27.4 (σ = 10.5).16 participants were students.Among the Apple Pay participants, 8 were users, 5 were nonusers, and one was using it before but stopped using it.Among the Android Pay participants, two were users, three were nonusers, and two were stopped users.We recruited 15 through the online advertisements, where 8 were Apple Pay participants, and 7 were Android Pay participants.4 were females, and the average age was 32.8 (σ = 7.7).Those participants had various occupations, ranging from computer and mathematical occupations to education, training and library, and consultant occupations.Among the Apple Pay participants, 4 were users, two were nonusers, and two were stopped users.Among the Android Pay participants, three were users, three were nonusers, and one was a stopped user.
2) Reasons for not using mobile tap-and-pay: First, we analyzed the responses to the question "If you are not using Apple (Android) Pay to pay in stores, why do you not use it?"From the university group, 8 codes emerged from the Apple Pay nonusers' responses, and 7 codes emerged from the Android Pay nonusers' responses.Note that some participants provided multiple reasons (translated into multiple codes).
From the university group, the most frequently cited reasons for not using Apple Pay were not many stores support it, and less secure (than using debit or credit cards), which were each mentioned by 4  For Android Pay (from the university group), the most frequently cited reasons were: less secure, not many stores support it, and less convenient, each of which was mentioned 3 out of 3 nonusers as an important reason for not using it.Responses include:

".. it's very easy to get into other people's phone as most of them use [screen] lock patterns." (P15)
"I am not used to unlocking my phone to pay." (P16) From the online advertisement group, 7 codes emerged from the Apple Pay nonusers' responses, and 5 codes emerged from the Android Pay nonusers' responses.The most frequently cited reason for not using Apple Pay were, again, not many stores support it, and less secure, each of which were mentioned by 2 out of 2 nonusers.As for Android Pay, the most frequently cited reason was not many stores support it, which was mentioned by 3 out of 3 Android Pay nonusers, while less secure, and less convenient, were mentioned by 2 nonusers.
3) Reasons for using mobile tap-and-pay: We then analyzed the responses to the question "If you are using Apple (Android) Pay to pay in stores, why do you use it?"From the university group, 9 codes emerged from the Apple Pay users' responses, and 5 codes emerged from the Android Pay users' responses.The most frequently cited reason for using Apple Pay were more convenient (than using debit or credit cards), and more secure (than using debit or credit cards), which were each mentioned by 8 out of 8 users.Responses include: "It's more convenient.. rather than taking my wallet, finding my card, and swiping it.." (P7)

" .. you have to .. authorize [its use] with the thumb print. So that makes [Apple Pay] very secure." (P13)
Other usability reasons, faster (than using debit or credit cards), and fun to use were each mentioned by 7 users:

"It's faster as you have to just hold your phone over the machine and that's it, you're done!" (P3)
For Android Pay, the most frequently cited reasons were more convenient, and more private, which were mentioned by 2 out of 2 Android Pay users.
From the online advertisement group, 8 codes emerged from the Apple Pay responses, and 7 codes emerged from the Android Pay responses.The most frequently cited reasons for using Apple Pay were more secure, more convenient, and faster, each of which were mentioned by 4 out of 4 Apple Pay users.One participant, P27, mentioned the iPhone location service as a reliable security feature: "Apple Pay is more secure because of the inbuilt mechanism to locate my phone in case I lose it" (P27) Responses about the two usability factors include:

"I always carry my phone rather than my wallet" (P30)
"It is quicker than inserting or swiping cards" (P26) The most frequently cited reasons for using Android Pay were more convenient, faster, more private (than using debit or credit cards), and more secure, each of which were mentioned by 2 out of 3 users.Responses include:

"It's quicker to pay than pulling out my wallet. I can use multiple cards, and I don't have to fish for those cards from my wallet." (P28)
"More secure .. because my actual credit card number isn't sent to the vendor side."(P22) 4) Reasons for stopping use: Next, we analyzed the responses to the question "If you stopped using Apple (Android) Pay to pay in stores, why did you stop using it?"From the university group, one code emerged from the Apple Pay responses, and 4 codes emerged from the Android Pay responses.The one reason for stopping use of Apple Pay was not many stores support it:

"I'm having a hard time identifying stores that have an Apple Pay terminal.." (P10)
The top two reasons for stopping use of Android Pay were less secure, and less convenient, each of which was mentioned by 2 out of 2 stopped users.One participant, P20, mentioned the inconvenience associated with having to set up a screen lock:

"It asks [you] to put a screen lock on your phone. That was really inconvenient for me. That's why I uninstalled it." (P20)
The participants also mentioned forgot to use it, and not many stores support it as other reasons for stopping use of Android Pay.
From the online advertisement pool, 6 codes emerged from the Apple Pay responses as well as from the Android Pay responses.The most frequently cited reasons for stopping use of Apple Pay were not many stores support it, and less convenient, which were each mentioned by 2 out of 2 stopped users.As for Android Pay, all of the codes identified in this section were mentioned once, except for forgot to use it, which was never mentioned.

5) Familiarity with the security mechanisms:
From the university group, 4 out of 14 Apple Pay participants were knowledgeable about how Apple Pay protects tap-and-pay transaction security and privacy.Two codes that emerged were hides the credit card number from merchants and generate unique token.One participant, P5, knew about encryption and tokenization: ".. it encrypts all our personal information and they present a non-identifiable token."Only 2 participants knew how Apple Pay protects debit or credit card details.The codes that emerged were encrypt card details, secure element, and generate unique token.Just one participant, P7, was aware of the secure element and how it worked: "I read about secure element, a dynamic smart chip in the processor .. responsible for handling security."10 participants knew how Apple Pay ensures that only they can pay in stores with their phone, mentioning biometric authentication as the security mechanism.From the online advertisement group, 3 out of 8 Apple Pay participants knew how tap-and-pay transaction security and privacy are protected, 2 knew how debit or credit card details are protected, and 7 knew how authentication with Touch ID ensures that only they can use their phone to pay.
As for Android Pay, from the university group, 1 out of 7 Android Pay participants knew how Android Pay protects tap-and-pay transaction security and privacy.One participant knew how Android Pay protects debit or credit card details through encrypt card details. 4 participants had good understanding of how Android Pay ensures that only they can use their phone to pay.The emerged code was screen lock passwords or patterns.From the online advertisement group 2 out of 7 Android Pay participants knew how tap-andpay transaction security and privacy are protected, 2 mentioned encrypt card details for protecting card details, and 4 knew about screen lock passwords or patterns used for authentication.Overall, 25 out of 36 participants knew about the authentication mechanisms.But there were only 10 participants knowledgeable about the transaction security mechanisms, and 7 knowledgeable about the card protection mechanisms.

C. Hypotheses
While the Apple Pay responses showed clear winners among the reasons for using and not using it, responses for Android Pay did not reveal clear winners with multiple common reasons getting similar levels of support.This observation warrants a separate investigation of the two technologies in the second study -each technology with its own set of hypotheses -to further analyze the differences in the importance levels of the cited reasons.After merging the codes from both groups, the three dominant factors for using Apple Pay were more secure (12), faster (11), and more convenient (12).There were just three counts for more private.For not using Apple Pay, not many stores support it (6) and less secure (6) were the dominant concerns.Based on those code counts, we defined the first two hypotheses: H1: usability (more convenient and faster) is a more important factor than security (more secure and more private) for using Apple Pay; H2: security (less secure and less private) is a more important factor than usability (less convenient and slower) for not using Apple Pay.
For using Android Pay (after merging the codes), the dom-inant factors were more convenient (4) and more private (4).Faster and more secure just had two counts each.For not using Android Pay, not many stores support it (6), less secure (5), and less convenient (5) were the three most important concerns.Based on those observations, we defined the following null hypothesis: H3: there is no statistically significant difference between the importance of usability and security factors when it comes to using or not using Android Pay.

D. Limitations
One of the limitations is that the results of the interviews are not generalizable.The results of the analyses could have been impacted by our biases, which we tried to minimize by having two separate coders and periodically discussing disagreements to reach consensus.Moreover, the participants could have misunderstood some of the questions or could have interpreted them differently.To keep the chances of such misunderstanding low and ensure consistency, we had two researchers interviewing together, and conducted a pilot study with 19 participants prior to the real interviews.

IV. SECOND STUDY: ONLINE SURVEY
To address the limitations of the first study, and test the hypotheses listed in Section "Hypotheses," we conducted a large-scale online survey, and statistically analyzed the relative importance of the reasons for using, not using, and stopping use of mobile tap-and-pay solution.

A. Methodology
The online survey questionnaire was designed based on the codes we identified through the first study, closely resembling the overall in-person interview structure.The clarity of the questions and distinction between the terms used (e.g., "faster" versus "more convenient") were thoroughly validated through the first study.We recruited participants on Amazon Mechanical Turk (MTurk) between March and April 2016.We limited MTurk workers to those in the United States, and asked MTurk workers to participate only if they have some familiarity with Apple (Android) Pay, and own a phone that supports Apple (Android) Pay.Before collecting responses, we conducted a pilot study with 8 Apple Pay and 9 Android Pay users, and improved clarity and readability of the questions based on their feedback.None of the demographic questions (asked at the beginning of the survey) were mandatory, and did not contain any personally identifiable information.
The participants were asked during the survey to submit two photos: (1) a photo of the back of their phone taken in front of a mirror while showing their thumbs up, and (2) a photo of the front of their phone taken in front of a mirror with the selfie mode.We later used those photos to validate the claimed phone model and Apple/Android Pay support.We excluded responses from those who (1) did not provide us with photos, (2) did not follow the photo instructions (attention checking), (3) provided photos that did not match their claimed phone model, or (4) provided photos of a device that does not support Apple/Android Pay.We asked the participants about their familiarity with Apple/Android Pay and paid $3.00 to all the participants (except for those who did not submit photos).
Hence, there was no reason for participants to lie about their familiarity with the technology.We excluded responses from those who said "I have no idea what Apple/Android Pay is and how it works."We randomized option orders in all applicable questions.
Without making any assumptions on data distributions, we performed the chi-squared test to compare the proportions of mobile tap-and-pay usage for Apple/Android Pay.The statistical confidence in the reasons for using, not using, and stopping use of Apple/Android Pay were tested using Mann-Whitney U test because the collected data was not normally distributed.Post-hoc comparisons were corrected for multiple-testing using Bonferroni correction when appropriate.To analyze the correlation between the participants' security knowledge level and their adoption rate, we performed Pearson's correlation.

1) Demographics:
In total, we recruited 454 Apple Pay and 675 Android Pay participants.From the 454 Apple Pay participants, we excluded 75 who failed at least one of the photo checks, 21 who failed the attention check question, and 9 who said they are not familiar with Apple Pay.This left 349 (76.87%) responses for data analysis.For Android Pay participants, we excluded 130 who failed at least one of the photo checks, 24 who failed the attention check question, 10 who said they are not familiar with Android Pay, leaving us with 511 (75.70%) responses for data analysis.Most of the Apple Pay participants were whites (73.5%), and the majority were in the age groups of 25-34 (51.3%), 19-24 (23.5%), and 35-44 (13.5%).53% were male.53.6% had a university degree, and 23.8% had a high school diploma.44 different occupations were reported with students (14.3%), education (8.9%), and business (8.3%)being the top ones.Similarly, most of the Android Pay participants were whites (68.9%), and the majority were in the age groups 25-34 (55.5%), 19-24 (20.0%) and 35-44 (17.8%).59.4% were male.52.8% had a university degree, and 32.9% had a high school diploma.68 different occupations were reported with students (13.1%), computer (9.6%), sales (9.2%), and out of work (8.2%) being the top ones.

2) Security awareness levels:
To gauge the security awareness levels of our Apple Pay participants we asked the following three questions: "On your iPhone, Safari allows you to save your credit card numbers to auto-fill when requested by a website form.Do you know how to change Safari settings to disable this auto-fill feature?" "A simple passcode is a 4-or 6digit number.Simple passcode is the default unlock mechanism.Do you know how to enable longer or alphanumeric passcode on your iPhone?" and "Do you know how to turn off an app's access to your camera in the settings?"We asked similar three questions in the context of Android features for our Android Pay participants as well.About 87% of the Apple Pay participants, and about 93.54% of the Android Pay participants said "Yes" to two or more questions (see Table VII in Appendix A).This indicates that those who are aware of mobile tap-and-pay are generally tech savvy, security aware people, who seems to know how to use at least two of those three security features available on their mobile devices.

3) Limited adoption rate:
To gauge the number of participants who use or not use mobile tap-and-pay, and enable  conditional branching on the questions, we asked "Do you use Apple (Android) Pay to pay in stores?"The participants were asked to choose from the following three options: "No, I have never used it," "Yes, I use it," and "I was using it in the past but stopped using it."As shown in Table I, there is a much larger percentage of Apple Pay users (36%) than Android Pay users (21%), and lower percentage of those who stopped using Apple Pay (10%) than those who stopped using Android Pay (15%).This indicates that Apple Pay is the more popularly used technology among those who have some familiarity with them.The difference in the distribution of users, non users, and stopped users between the two technologies was statistically significant (p < 0.0001, chi-square test).It is also worth noting that the percentage of those who have never used it are much larger than those who use it for both technologies, indicating that mobile tap-and-pay has somewhat limited adoption rate.
4) Reasons for not using mobile tap-and-pay: We asked the nonusers "If you are not using Apple (Android) Pay to pay in stores, why do you not use it?Rank the options below in order of importance from 1 to 8, 1 being the most important reason.If there is no other reason, leave its ranking as blank."We also asked the participants "If you had other reason and ranked it, please specify what that reason is."Figures 1 and 2 show the reasons for not using Apple Pay and Android Pay, respectively, sorted based on the overall distribution of the importance ranks between 1 and 8.The option order was randomized in the survey.
For Apple Pay, "It is less secure than using debit or credit cards to swipe-and-pay in stores" (less secure) and "It is less private than using debit or credit cards to swipe-andpay in stores" (less private) were the top two reasons.To clarify, the term "private" was defined as follows in the survey: "Private means limiting access others, including Apple, may have to your card details and transaction information."Usabilityrelated reasons, "It is less convenient than using debit or credit cards to swipe-and-pay in stores" (less convenient) and "It is slower than using debit or credit cards to swipe-andpay in stores," (slower) were ranked lower than the securityrelated reasons.The differences in rank distribution between less secure and slower, and between less private and   slower were statistically significant (all p < 0.005, Bonferronicorrected Mann-Whitney U test).Not many stores support it ranked third, indicating that availability is another important reason for not using Apple Pay.Not many stores support it ranked higher than slower and not an early adopter (p < 0.05, Bonferroni-corrected Mann-Whitney U test).
In contrast, Not many stores support it was the top reason for not using Android Pay.Not many stores support it ranked higher than slower, not an early adopter, "I just forgot to use it" (forgot), and other with statistical significance (p < 0.005, Bonferroni-corrected Mann-Whitney U test).This is probably because Android Pay (launched later) is less available than Apple Pay.Less convenient ranked second for Android Pay (compared to being ranked fourth for Apple Pay), indicating that the Android Pay nonusers have more concerns about its usability.Difference in the ranking distribution between less secure and slower was statistically significant (p < 0.05, Bonferroni-corrected Mann-Whitney U test) but the difference between less private and slower was not (p = 0.08, Bonferroni-corrected Mann-Whitney U test).
Table II shows the number of participants who chose each reason as the most important reason for not using.The top two reasons for both technologies were less secure (22.22% and 16.67% for Apple Pay and Android Pay, respectively) and not many stores support it (19.44%and 20.13%), indicating that security and availability are the prevalent reasons for not using mobile tap-and-pay.For Android Pay, however, the gap between less secure and less convenient was much smaller (just 3.56%) compared to Apple Pay (11.66%).Between the two usability-related reasons, the participants were less concerned with slower than less convenient.

5) Reasons for using mobile tap-and-pay:
We asked the users "If you are using Apple (Android) Pay to pay in stores,  why do you use it?"We used the same option-ranking format as the previous ("reasons for not using") question.Figures 3  and 4 show the reasons for using Apple Pay and Android Pay, respectively, sorted based on the overall distribution of the importance ranks between 1 and 8.
For Apple Pay users, "It is faster than using debit or credit cards to swipe-and-pay in stores" (faster) and "It is more convenient than using debit or credit cards to swipeand-pay in stores" (more convenient) were the top two reasons.Both were usability-related reasons.This contrasts with the observations for the nonusers who picked security as their biggest concern.Faster ranked higher than "It is more secure than using debit or credit cards to swipe-and-pay in stores" (more secure), "I'm curious about a new technology" (curiosity), "It is fun to use" (fun), "It is more private than using debit or credit cards to swipe-and-pay in stores" (more private), "It is more reliable than using debit or credit cards to swipe-and-pay in stores" (more reliable), and other with statistical significance (all p < 0.05, Bonferroni-corrected Mann-Whitney U test).Even though more secure was not the most important factor for using Apple Pay, it ranked third overall, indicating that security is still an important factor.The differences in the ranking distribution between more secure and more reliable, and between more secure and other were statistically significant (all p < 0.05, Bonferroni-corrected Mann-Whitney U test).Similar trends were observed with Android Pay users, where the top three reasons were the same as the reasons for using Apple Pay.This reinforces the observation that usability is the most important factor for mobile tap-and-pay users.
Table III shows the number of participants who chose each reason as the most important reason (i.e., ranked first) for using Apple Pay or Android Pay.The top two reasons for Apple  Pay were faster and more convenient, both at 25.21%.Usability also dominated the Android Pay responses; more convenient was chosen as the most important reason by 29.90% of the users.More secure came at third for Apple Pay with 14.29%, and second for Android Pay at 12.37%.However, for Android Pay, the differences between the second, third, and fourth factors were small.

6) Reasons for stopping use:
We also asked the participants "If you stopped using Apple (Android) Pay to pay in stores, why did you stop using it?"For both technologies, the participants who stopped using mobile tap-and-pay picked not many stores support it and less convenient as the two most important reasons.This indicates that usability and availability are the two most prevalent factors for stopping the use of mobile tap-and-pay (see Figures 7 and 8 in Appendix B).

7) Security knowledge and adoption rates:
We asked the same three questions described in the first study "Procedures" about the security mechanisms used in Apple (Android) Pay, and gave 6 options to choose from -there was only one correct answer for each question.There was no motivation for the participants to use smart guessing techniques to answer these questions correctly as there was no additional reward for getting them right.
As shown in Table IV, for both Apple Pay and Android Pay, about 77% of the participants got just one or less correct, indicating that the majority have limited knowledge about the specific security mechanisms being used in mobile tap-and-pay.
In particular, about 81% of the nonusers (for both technologies) answered one or less correctly.About 68% Apple Pay users and 63% Android Pay users answered one or less correctly, indicating that the users, overall, were more knowledgeable.
Next, we analyzed the correlation between the participants' using or not using status and the number of security knowledge questions they correctly answered (i.e., the security knowledge level).We found a positive correlation for both Apple Pay (ρ = 0.19, p < 0.0001) and Android Pay (ρ = 0.20, p < 0.0001).As shown in Figures 5 and 6, participants who are more knowledgeable about the security mechanisms are more likely to be using mobile tap-and-pay.

8) Perception of security:
To study potential effects of educating nonusers about the security mechanisms on the mobile tap-and-pay adoption rate, we invited back the nonusers (from the second online study) who mentioned less secure  as the top concern for not using mobile tap-and-pay, and asked them the following two questions: "Why do you feel that using Apple (Android) Pay to tap-and-pay in stores is less secure than using debit or credit cards to swipe-and-pay in stores?" and "Tell us whether you agree or disagree with the following statement: If I learn that using Apple (Android) Pay to tap-andpay in stores is more secure than using debit or credit cards to swipe-and-pay in stores, I would then use Apple (Android) Pay to pay in stores." For Apple Pay, 10 out of 12 nonusers (who came back to participate) strongly agreed or agreed with the above statement; for Android Pay, 8 out of 14 nonusers strongly agreed or agreed.Those results indicate that by educating the nonusers about the security mechanisms and explaining why using mobile tap-and-pay can be more secure, one could potentially improve the adoption rates for both technologies.
We used open coding to code the responses to the first question.Across both technologies, insecure storage of card information was the most frequently mentioned reason, being mentioned by 13 out of 26 nonusers.An Apple Pay participant said "I don't think storing credit card information on my phone that can be accessed with a passcode is very secure.I also don't always think that the software used to store my credit card information is very secure."An Android Pay participant mentioned "I inherently feel that Android Pay is less secure just because the information would be on my phone, which is less secure than my wallet."In fact, all of the Android Pay nonusers falsely believed that the card information is stored in the device, when it is actually stored in secure cloud servers.Only 2 out of those 13 nonusers correctly answered the question about security mechanisms used to protect card details, demonstrating the need to educate them about the security guarantees provided through the secure element (Apple), and HCE and secure cloud server (Google) technologies.Stealing phone and making purchases, mentioned 7 times, was another popular reason.An Apple Pay participant was worried about ".. someone who  had access to my phone could use Apply Pay to pay for their purchases."Similarly, an Android Pay participant mentioned ".. if I were to lose my phone, it would make it too easy for someone to use [it] to pay for things."Unfamiliarity with new technology was mentioned 5 times.As shown in Tables VI and VI, the top reason for both technologies was need to unlock phone and start app at 26.67% and 26.52%.Interestingly, this is a usability misconception since neither technology requires users to start a payment application (see Section II-A).Apple Pay does not even require users to unlock their phones.One Apple Pay participant mentioned "The time taken to dig out the phone, unlock it, open the app is slower compared to grabbing a card and swiping it."25% of the Android Pay participants and 14% of the Apple Pay participants responded saying that it feels slower than getting a card out and swiping it.An Android Pay participant mentioned "Pulling out a wallet, grabbing credit card, [and] swiping, is faster and easier for me than pulling out phone, unlocking phone, opening app, and using it."A larger percentage of the Android participants could have felt that way as Android Pay requires users to first unlock their phones, which is not necessary on Apple Pay.Getting phone out was another common reason as many female participants mentioned that finding their phones and getting them out from their purses is slow and inconvenient.One Android Pay participant mentioned that "Usually I have my phone tucked away in my purse, and it's just easier to grab my debit card."At 14% and 15.91%, untrained cashiers was also frequently mentioned.An Apple Pay participant mentioned ".. and cashiers cannot troubleshoot issues on the spot since they're largely unfamiliar with Apple Pay as well."Service availability related reasons, Apple (Android) Pay availability and uncertainty about Apple (Android) Pay availability were common too.The participants explained that the uncertainty about whether a store supports mobile tap-and-pay, and just the lack of supporting stores make mobile tap-and-pay inconvenient.

C. Limitations
Our online survey has three limitations.First, we asked our participants to take two photos, and email them to us during the survey.This part of the survey could have introduced a bias toward a more technically savvy group of smart phone users.We mitigated this limitation by presenting clear example photos, and providing guidelines that are easy to follow.Also, through the first study, we learned that a large portion of those who are aware of mobile tap-and-pay are technically savvy in nature anyway.Second, the MTurk workers do not always represent general Apple Pay or Android Pay users, and all of our participants were from the United States.Hence, any generalization of the results presented in this paper need to be performed with caution.Third, we only focused on the physical tap-and-pay feature of mobile payment solutions, and compared them with the traditional, physical swipe-and-pay transactions made using debit or credit cards in stores.When we first started designing the user studies, Apple Pay was only available in the United States, and chip-and-PIN readers were rarely used in the United States.In fact, swipe-and-pay is still the most commonly used payment method [8].

A. Importance of usability for Apple Pay users
More convenient and faster were ranked as the top two factors for using Apple Pay (see Figure 3).Faster showed statistically significant superiority in the overall ranking distribution over both more secure and more private.Table III reinforces this observation.We collected sufficient evidence from the second study to accept the first hypothesis "H1: usability (more convenient and faster) is a more important factor than security (more secure and more private) for using Apple Pay." Considering that mobile tap-and-pay is a securitycritical application, this finding is intriguing, as Apple Pay users still favor usability over security as the primary reason for using the technology.

B. Security concerns for Apple Pay nonusers
The second hypothesis was "H2: security (less secure and less private) is a more important factor than usability (less convenient and slower) for not using Apple Pay."Our ranking results in Figure 1 show less secure and less private as the top two factors for not using Apple Pay.The differences in the importance score distribution between less secure and slower, and between less private and slower were statistically significant.Table II shows that a much large proportion of Apple Pay nonusers chose less secure (22.22%) as the most important reason, compared to less convenient (10.56%) and slower (3.33%).Based on this evidence, we accepted the second hypothesis.One of the key, non-intuitive findings of this paper is this reverse ordering of the usability and security factors between the users and nonusers.Those findings suggest that Apple should primarily focus on addressing their nonusers' concerns about security to improve the adoption rate, which is still only about 36%.

C. Smaller gaps between the usability and security factors for Android Pay
Our null hypothesis stated "H3: there is no statistically significant difference between the importance of usability and security factors when it comes to using or not using Android Pay." Figure 4 shows the same top three reasons for using Apple Pay, in the order of faster, more convenient, and more secure, indicating that usability is considered more important than security.However, none of the differences in the ranking distribution between those factors were statistically significant.Despite this relatively smaller importance of the usability factors among the Android Pay users (compared to the Apple Pay users), more convenient did dominate Table III with 29.90%, which was much larger than more secure (12.37%) and more private (9.28%).Those observations do indicate that usability is the top reason for using Android Pay as well.From the Android Pay nonusers, we did find a statistically significant difference in the importance ranking distribution between less secure and slower.But unlike Apple Pay, which showed less secure and less private as the top two reasons for not using it, less convenient was ranked as the second reason.We did not collect sufficient evidence to reject the null hypothesis.

D. Learning about the security protections
Insecure storage of card information was the most frequently cited reason among the nonusers (who chose security as their top concern) for feeling mobile tap-and-pay is less secure than traditional swipe-and-pay (see Section IV-B).Educating those nonusers about the card information protection technologies that are already in place (see Section II) could help them understand that card information stored encrypted on their phones is more secure than physically carrying cards inside their wallet and overcome this security misconception.Stealing phone and making purchases was another commonly cited reason.By learning about the authentication mechanisms and lost/stolen phone features that allow one to quickly disable mobile tap-and-pay remotely, nonusers could realize that using stolen phones to make purchases is actually harder than physically using stolen cards.

E. Usability improvements
Our usability analysis in Section IV-B revealed that a large proportion of those who feel mobile tap-and-pay is inconvenient or slow falsely believe that they need to start a payment application before they can start making payments.Apple Pay participants also believed they had to first unlock their phones before paying, which, again, is not true.To overcome those misconceptions, Apple and Google need to educate their customers that such steps are not necessary, and their solutions can be faster than swiping to pay.Many participants complained that pulling out their phones from their purses or pockets to make a payment is inconvenient and slow, especially with larger smart phones that are in use today.To address this issue, existing wearable devices, e.g., smartwatches, can be designed to support mobile tap-and-pay.In fact, Apple Watch already does, allowing users to pay without having to pull out their phone.
For issues related to uncertainty about Apple (Android) Pay availability, we imagine that Apple and Google could offer a location-based service for stores to install, which would automatically inform users (e.g., through a popup message on their phone or smartwatch) about the availability of a mobile tap-and-pay terminal when they enter a store.
Radio Frequency technologies such as Wi-Fi, Bluetooth and RFID, ultrasound, infrared, and magnetic fields could be used to enable an indoor mobile payment discovery system [9].To deal with issues around untrained cashiers, Apple and Google can work with the stores that support mobile tap-and-pay, and provide training and learning materials and programs for cashiers to quickly learn about the technologies and integral troubleshooting practices.

VI. RELATED WORK
Much of the previous research has been focused on developing a variety of models based on the "theory of reasoned action" and "theory of planned behavior" to examine mobile payment user behaviors.Among them, the most popular one is the "technology acceptance model" [10], [11], [12].Linck et al. [13] examine security issues in mobile payment from the customer's perspective, concluding that simple, secure, and inexpensive payment services are preferred.Schierz et al. [14] conclude that the most important drivers for consumer's acceptance of mobile payment services are perceived compatibility and individual mobility.Dahlberg et al. [15] identify the factors relevant to acceptance of mobile payment as ease of use, usefulness, and trust.However, most of the mobile payment research mentioned above was done before mobile tap-and-pay solutions became available.In contrast, our work explicitly focuses on the physical tap-and-pay method, and people's perceptions on using it for payments at stores.
As Apple Pay and Android Pay are fairly new technologies, there is not much work done to date on investigating people's perceptions on their usability and security.Fiedler et al. [16] investigate factors that influence acceptance of Apple Pay but their study was conducted in Germany where the tap-andpay feature is still not available.Further, their hypotheses and analyses do not directly evaluate how security affects the acceptance of Apple Pay.Morosan et al. [17] explain people's intentions to use NFC-based mobile payments in hotels.They did not find any relationship between perceived security and people's intentions to use them in hotels.Oliveira et al. [18] found that compatibility, perceived security, and performance expectations would have significant effects over adoption of mobile payments in general (including online mobile payments).However, they do not dive deep into specific security and usability issues.Shaw [19] studies the factors that influence intention to use mobile wallet adoption in the United States.Again, specific security and usability issues are not discussed.Krol et al. [20] show that purchasing habits and reward schemes are primary factors that influence decisions to use a payment technology, only lightly touching on contactless payment methods.Our results showed that Apple Pay and Android Pay users and nonusers have different perceptions, and their concerns and adoption reasons are ordered differently (see Tables II, III, and VIII).Studies such as [19], [18] that generalize and group all mobile payment solutions together would miss such differences in perceptions, and issues that are specific to each technology.Luca et al. [3] showed that usability is the top argument for both using and not using Touch ID, which is a fingerprint-based authentication mechanism used on iPhones.For Face Unlock, which is a face recognition-based authentication mechanism for Android devices, usability (22%) was again the more important factor than security (8%) for not using it.Those results contrast with our findings for Apple Pay where the top factor for not using it was security -we surmise that the higher security risks associated with using mobile tap-and-pay may have impacted this.Egelman et al. [21] provide insight on the correlation that exists between users' risk perceptions and their willingness to use a locking feature on their phones.We found a positive correlation between the participants' knowledge about the security mechanisms being used and their likelihood of using mobile tap-and-pay.Some recent online (non-academic) surveys studied Apple Pay adoption rates and reasons.An Apple Pay adoption study [22] was conducted in a collaborative effort between "PYMNTS" and "InfoScout" to determine the degree to which consumers use Apple Pay (the population statistics are unknown though).Based on the responses collected through a single quarter (July to October, 2015), their results show that 16.6 % people have tried Apple Pay ever since owning an iPhone 6 or 6s.As the three major reasons for not using Apple Pay, they identified "satisfied with my current payment method" (38.4 %), "not familiar with how Apple Pay works" (33.5 %), and "security concerns about Apple Pay" (18.7%).A survey conducted by Phoenix Marketing on 3,000 people [23] found that after Apple Pay launched in 2014, it was adopted by 11% of card-holding households in February 2015, but did not offer any usage reasons.The adoption rates mentioned in those studies are lower than our rates mainly because we only recruited those who had some level of familiarity with Apple (Android) Pay.In contrast to those online surveys, we performed much deeper analyses of the participants' perceptions on security and usability, studying specific concerns and identifying misconceptions, and arrived at statistically significant results.Based on those results, we also recommend strategies for improving usability.

VII. CONCLUSIONS
Our study results show that usability is the most important reason for using mobile tap-and-pay.However, for Apple Pay nonusers, security concerns were the most important factor for not using it.A common security misconception we identified among the nonusers (who mentioned security as their top concern) was that they felt storing card information on their phones is less secure than physically carrying cards inside their wallets.However, only about 15% of such nonusers were knowledgeable about the secure storage mechanisms being used.We also identified a usability misconception where the participants falsely believed that a payment application needs to be launched before they can make a payment, and as a result, felt that mobile tap-and-pay is inconvenient and slow.
Our findings suggest that technology adoption rates (only about 36% for Apple Pay and 21% for Android Pay) could improve with increased awareness of the security protections and convenience offered by tap-and-pay solutions over traditional swipe-and-pay.An important future research would be to study how education of nonusers about the security protections in mobile tap-and-pay affects their mental models and decisions to use the technology.

A. Security awareness levels
Table VII shows that about 87% of the Apple Pay participants, and about 93.54% of the Android Pay participants said "Yes" to two or more questions.The security-related reasons, less private and less secure, were considered as relatively less important factors.For Apple Pay, the difference in the importance ranking distribution between less convenient and less secure was statistically significant (p < 0.05, Bonferroni-corrected Mann-Whitney U test), showing that usability was the more important factor for those who stopped using Apple Pay."Due to my habit of using cards to swipe-and-pay in stores" (habit of using cards) ranked third for both technologies.
Table VIII shows that the top two reasons for Apple Pay were habit of using cards and less convenient at 23.53% and 17.65%, respectively, confirming that both habit and usability were prevalent factors for stopping use of Apple Pay.Less secure came last at just 5.88%.In contrast, the top two reasons for stopping use of Android Pay were not many stores support it and other at 22.08% and 16.88%, respectively.This is probably because there are less stores that currently support Android Pay compare to Apple Pay.As for those who specified what the other reasons were, three participants mentioned that "store cashiers were ignorant about Android Pay," two mentioned that "their phone is too slow," and two mentioned that "it stopped working after they rooted their phone."Both of the security-related reasons, less secure and less private, were ranked as the two least important factors for stopping use of Android Pay.

Fig. 1 .
Fig. 1.Reasons for not using Apple Pay, sorted based on the overall distribution of the ranks between 1 and 8, where 1 represents the most important rank.

Fig. 3 .
Fig. 3. Reasons for using Apple Pay, sorted based on the overall distribution of the ranks between 1 and 8.

Fig. 5 .
Fig. 5. Percentages of the Apple Pay stopped users, nonusers, and users grouped by the number of security knowledge questions they answered correctly.

Fig. 6 .
Fig. 6.Percentages of the Android Pay stopped users, nonusers, and users grouped by the number of security knowledge questions they answered correctly.

9 )
Perception of usability: Toward the end of the online survey, we asked all the participants "If you feel that using Apple (Android) Pay to pay in stores is slow or inconvenient, why do you feel this way?" as open ended questions.Again, we used open coding to code the responses.

Figures 7 and 8
Figures 7 and 8 show the sorted reasons for stopping the use of Apple Pay and Android Pay, respectively.
out of 5 nonusers.Responses include:

TABLE I .
PERCENTAGE OF THE PARTICIPANTS WHO ARE USING, NOT USING, OR STOPPED USING APPLE (ANDROID) PAY.NOTE, ALL OF OUR PARTICIPANTS HAD some familiarity WITH APPLE (ANDROID) PAY.

TABLE II .
THE NUMBER OF PARTICIPANTS WHO CHOSE EACH REASON AS THE MOST IMPORTANT REASON FOR not using APPLE PAY OR ANDROID PAY.NOTE, THOSE NUMBERS MAY NOT ADD UP TO EXACTLY MATCH THE NUMBERS PRESENTED IN TABLE I BECAUSE SOME PARTICIPANTS SKIPPED QUESTIONS.

TABLE III .
THE NUMBER OF PARTICIPANTS WHO CHOSE EACH REASON AS THE MOST IMPORTANT REASON FOR using APPLE PAY OR ANDROID PAY.

TABLE IV .
THE PERCENTAGES OF THE PARTICIPANTS WHO CORRECTLY ANSWERED 0, 1, 2, OR 3 SECURITY KNOWLEDGE QUESTIONS.

TABLE V .
TOP 7REASONS FOR FEELING APPLE PAY IS SLOW OR INCONVENIENT.SOME RESPONSES CONTAINED MULTIPLE REASONS (CODES).

TABLE VI .
TOP 7 REASONS FOR FEELING ANDROID PAY IS SLOW OR INCONVENIENT.

TABLE VII .
THE PERCENTAGES OF THE PARTICIPANTS WHO RESPONDED WITH A "YES" TO 0, 1, 2, OR 3 SECURITY AWARENESS B. Reasons for stopping use

TABLE VIII .
THE NUMBER OF PARTICIPANTS WHO CHOSE EACH REASON AS THE MOST IMPORTANT REASON FOR stop using APPLE PAY OR ANDROID PAY.