The only reason that this story is getting traction till now is because it has Apple in it, and Apple name sells. Many of the analysts that were talking highly about the Apple Pay are the same that they are now in the skeptics camp. The lesson learned from the story is that fraudsters are smart and they will use the path of the least resistance. Why would they attack the Apple security if the provisioning process is flawed or had some loopholes Why attack encrypted data and TouchID if you can pick the exposed data in the clear in other parts of the transaction. The other lesson is that to develop a good solution, you need to look at the solution from end to end. The handover points and interfaces will be the most venerable areas and a full assessment is needed not piecemeal. Whoever will take the lead of providing this guidance to the industry will be perceived to be the expert and the champion