We love the idea of using mobile devices to pay for stuff. For those of us who always have phone in hand, waving it at a payment reader seems more convenient than fishing a debit or credit card out of our wallets.
Apple and Google have been making a big deal about their mobile-payment services this year. So we decided to set up the two companies' mobile payment apps -- Josh with an iPhone 6S and Cliff using a Samsung Galaxy S6 -- and head out to see how far Apple Pay and Android Pay could carry us through a regular week of purchases.
How the payment tech works
Both Apple Pay and Android Pay use NFC, or near-field communication, to talk with a payment reader. As its names suggests, NFC transmits information a very short distance -- five centimeters or so -- to a store's point-of-sale device. You can, of course, also touch your phone to the reader to complete the transaction.
The Apple Pay mobile payment service works with iOS 8.1 and later on the iPhone 6, 6 Plus, 6S, and 6S Plus; the iPad Air 2, Mini 3 and 4, and Pro; and Apple Watch-compatible devices.
Android Pay requires Android 4.4 (KitKat) or later, and your Android device must be able to handle NFC. That shouldn't be too big of a hurdle, as most Android devices released in the past few years come equipped with NFC. The Samsung Galaxy line has included NFC since the S II, for example, and the HTC One phones have offered NFC from the start of the line. (Here's a list of NFC-enabled phones.)
Google just released Android Pay this fall, replacing Google Wallet, which Google is remaking into a Venmo-like app for sending and receiving money from other people.
Setting up Apple Pay and Android Pay
First, we set up the two payment apps by entering credit card information.
Setting up Apple Pay was ridiculously easy. Josh needed to sign in to his iCloud account and move through a few screens to add a credit card. Apple Pay presented a screen that let him scan his credit card, grabbing the card number and expiration date. It also offered him the choice of entering card details by hand.
Josh entered several cards, and Apple Pay made the first one the default. To change the default, go to Settings, Transaction Defaults, Default Card. Then tap your preferred default card.
Apple Pay suggested Josh's name as it appears on his Apple account instead of how it appears on his credit card account. Be sure to check that Apple Pay is using the name as it appears on your card.
Josh hit one bump when he couldn't get Apple Pay to successfully scan his Virgin America Visa. This card uses a portrait orientation to display information -- unlike most cards, which are landscape -- so we thought that might be confusing Apple Pay. Josh contacted Virgin, which informed him that the Comenity-Capital-Bank-backed card is not part of Apple Pay yet but will be around the start of 2016. Here's a list of banks that work with Apple Pay.
When Cliff opened the Android Pay app, it showed a list of credit cards he'd added to his Google account over the years and asked him to confirm some details. The cards, mostly expired, were tied to the Google Play Store.
Removing expired cards wasn't straightforward. Cliff dug around Android Pay but couldn't find an obvious way. Ultimately, he went to payments.google.com, logged in, and removed the out-of-date cards there. He could, however, remove active cards through Android Pay.
He wanted to add a new card, so he tapped Add Another Card, which took him to a screen where he could capture an image of his card. He could also enter card details manually. After successfully grabbing the image, the app took him to a screen where he could adjust card details. He needed to enter the card security code, for example, and change the card address, as the screen displayed an older address.
After tying the card to the app, Android Pay told Cliff he had to turn on NFC to pay with the device.
Adding another card was easy enough: Cliff tapped the plus sign in the bottom-right corner of the screen and then tapped "Add a credit or debit card" to step through the process again.
As with Apple Pay, the first card Cliff added to Android Pay became his default payment card. To change the default card, select the card you want and then tap Set As Default Card. You can also drag the card to the Default Card slot at the top of the screen.
Here's a list of banks that work with Android Pay and which types of transactions they do and don't support.
Security in Apple Pay and Android Pay
No one wants to buy something in a store and then discover that their credit card information has been stolen.
As part of its security, Apple Pay requires your passcode or Touch ID to complete a transaction. Behind the scenes, Apple uses a security mechanism called tokenization, which allows the company to keep sensitive credit card information off your iOS device. With tokenization, the credit card number stays with the financial company, and Apple Pay uses a substitute account number token to represent the real card number.
If you misplace your phone, someone would have to know your passcode to use Apple Pay. And if you have turned on Find My iPhone, you can suspend Apple Pay by placing your iPhone in Lost Mode using Find My iPhone. You can also remove the ability to pay with Apple Pay by erasing the device remotely using Find My iPhone.
Android Pay also requires your phone's passcode or pattern unlocking mechanism to authenticate a payment. If you are running Android 6.0 (Marshmallow) on a phone with a fingerprint sensor, you can use fingerprint authentication to trigger a transaction.
Like Apple, Google uses tokenization for Android Pay and substitutes your credit card details with a virtual account number. And if you lose track of your device, if you have turned on Android Device Manager (ADM), you can lock or erase your Android phone on Google's ADM website.
According to security experts, tokenization raises the bar on securing mobile transactions. "The security behind Apple Pay and Google Pay is sound," says Paul Ferguson, a senior threat research advisor at Trend Micro. "The technology Apple and Google use and the NFC technologies they are based on are secure."
Ferguson cautions, however, that users still need to be watchful. "There is no such thing as 100 percent secure," he told us, recommending that users still need build up their mobile security defenses, starting with good password management.
Apple Pay and Android Pay in action
We found that Apple Pay and Android Pay work equally well and are surprisingly easy to use. Tap your phone on an NFC reader, authorize the payment, and you are done. The process is very similar to using a debit or credit card. What is also surprising is that while mobile payment readers aren't scarce, less than a third of the businesses we visited in the Bay Area over a week accepted Apple Pay or Android Pay.
Here's a list of the many local businesses (including several chains) we visited and whether they accepted mobile payments.
Walgreens not only accepts both payment methods but also was able to use Josh's Walgreens mobile rewards card stored in Apple Wallet.
Peet's coffee shop accepts Apple Pay and Android Pay.
Berkeley's Monterey Market takes both Apple and Android Pay, and a store clerk said that both are popular ways to pay.
McDonald's, to Josh's relief, accepts both payment apps.
Radio Shack had one reader and could handle Apple Pay and Android Pay.
Trader Joe's takes both Apple Pay and Android Pay. A checker said, however, few customers take advantage of them.
At the downtown San Francisco Apple Store, Josh bought the new iPad Pro using Apple Pay. To their credit, the store employees didn't laugh when Cliff asked if they accept Android Pay.
T-Mobile accepts Apple Pay, but the clerks said that the store wasn't set up to accept Android Pay yet.
Starbucks does not accept Apple Pay or Android Pay but does accept mobile payments through its Starbucks app, which you can load up via Apple Wallet.
At Solano Cellars, a Berkeley wine shop, a clerk said he had ordered an NFC reader, as many customers ask to pay with their phones.
Costco doesn't take mobile payments, but a checker said she heard her store might start early next year.
Pastime, Cliff's local hardware store, doesn't take mobile payments.
iScream, a Berkeley ice cream shop, doesn't handle either payment method. That didn't diminish how good its ice cream is.
Despite Bank of America being one of the banks that supports mobile payments, the teller at the local branch told Cliff he couldn't use the B of A debit card on his phone to withdraw money from his account.
Harvest & Rowe, a casual restaurant near our office, does not accept mobile payments.
CVS pharmacy doesn't support either mobile payment app.
Target doesn't accept either mobile app either.
The post office doesn't accept either app. But the holiday stamps this year are especially nice.
Chipotle doesn't work for either app. We've been reading about the restaurant's possible adoption of mobile payments for a year, so we were surprised to find out it doesn't yet.
At the Cerrito Theatre, the ticket seller apologized for taking only "old-school credit cards and cash" and didn't know of plans to start accepting mobile payments.
The Gap does not accept either app. We heard a nearby Gap was running a mobile payment trial, but when we showed up, the store just accepted cash or credit cards.
Berkeley's beloved Zachary's Chicago Pizza does not handle mobile payments for its stuffed pizza pies.
Neither does Kensington's Benchmark Pizzeria, which makes equally good but much thinner pies.
Cliff didn't see an NFC reader at his local Safeway and asked if he could pay with his phone. The clerk thought he was offering to barter his Android device for his bag of groceries.
What's the payout?
We are still in the early days of mobile payments -- Apple Pay arrived a year ago and Android Pay came out this fall. A recent study shows mobile payment usage growing, but the numbers are small. With Apple Pay, for example, just 16.6 percent of iPhone 6 users have tried the payment app. Another study shows Android Pay usage is even less, at least on supported Samsung devices.
Apple Pay and Android Pay are each a snap to use. There just aren't enough places to use them. For a while at least, we will still need to carry our cards.
Joshua Rotter also contributed to this article.