Security and Resilience: physical cards vs. Apple Pay

Gemini's answer is fine as far as it goes, but "which is more secure" isn't a complete question. Secure from what? Walk the threats and the answer flips depending on which one you mean.

Skimmers and merchant breaches: Apple Pay wins. The merchant never gets your card number, just a device stand-in plus a one-time code per tap, so nothing captured is reusable. But Gemini overstates the gap: a tapped chip card already uses one-time codes too, and in Europe chip-and-PIN is universal and magstripe is dead. The real edge is the Face ID gate and that nothing reusable is printed on the phone.

Someone with an NFC reader in a crowd: that's a plastic worry, not a phone one. Apple Pay won't pay without you approving it. A contactless card will, but it's capped (around €50 a tap, PIN forced after a few taps or ~€150 cumulative), so a thief gets lunch money.

Losing it: here Gemini gets it wrong. "They can't pay without your biometrics" ignores that the passcode is a fallback, which is exactly how the 2023 phone-theft ring worked, shoulder-surf the passcode, grab the phone, own the Apple ID and every card on it. Turn on Stolen Device Protection; that's the setting that fixes it. A stolen card, by contrast, is a phone call and a capped loss.

Your own money: under PSD2 your liability for unauthorised use is capped at €50 either way, zero once reported. So "more secure" mostly means less hassle for you and less loss for the bank, which is who really wants you on Apple Pay. Where it bites is debit, which most of Europe runs on: the money leaves your account first and you're the one waiting to get it back.

Being unable to pay: this is the one that actually happens to people, and plastic wins outright. Dead battery, cracked screen, a phone dropped in a canal in a city where you don't know anyone. And the phone is now wallet plus keys plus 2FA plus ID plus the thing you'd use to call for help, so losing it isn't a wallet-sized event any more. Nobody skims you in a typical year; everybody has had a dead phone. That's the threat I'd design around.