Bank of China's Wallet Rules: Eight Documents, One Footnote

Putting a Bank of China credit card into a phone wallet means accepting eight documents. HaiPay read all of them.

The Visa set and the Mastercard set are the same text. Across the two service agreements, 5,485 and 5,482 characters, the only differences are seven occurrences of the scheme's name. One footnote, in one consent form, is the single substantive difference in the whole set.

The footnote

In the form that permits the bank to hand a customer's personal information to others, the Visa version names Visa as the recipient. The Mastercard version names Mastercard NUCC, and adds a note: to ensure the information provided is stored inside China, the Mastercard mobile payment business has its systems built by Mastercard NUCC assisting Mastercard, and the data recipient is Mastercard NUCC.

Mastercard NUCC is the joint venture of Mastercard and NUCC, the Chinese clearing house. The People's Bank of China issued it a bank card clearing licence on 17 November 2023, allowing it to authorise members to issue and acquire Mastercard-branded renminbi cards in the country.

So the same act, loading a card into a wallet, sends the same fields to a different legal entity depending on which brand is printed on the card. With Visa the data goes to the scheme. With Mastercard it goes to a Chinese joint venture, and the form says why.

What actually leaves the bank

Four things: name, card number, expiry date and transaction information. They go to the scheme and to Apple Technology Services (Shanghai). That is the whole external list in the form.

A separate consent covers what the bank may process as sensitive personal information. It names document type and number; card number, expiry, CVV2, account type, account status and transaction information; and then device geolocation, device identifier, network IP address and MAC address.

The device block is the part a risk team will notice. Location, device fingerprinting data and network identifiers are consented for a purpose list that includes risk monitoring and management, dispute checking and statistical research.

The line about who pays

The agreement's pivotal sentence is in Article 2. If the mobile device is lost or stolen, the customer must report the device card lost by calling the credit card service line. The report takes effect once the formalities are complete, timed by the bank's own system record. The customer bears no loss from misuse after that moment, and the bank bears no loss from transactions before it.

There is no shared-liability band and no zero-liability promise. Liability turns on a phone call and a timestamp the bank keeps.

Around that line, the agreement is firm about what counts as the customer's own transaction. Anything completed with the card password, or with other verification methods agreed with the bank or a third party, is treated as done by the cardholder. So is anything done with the fingerprint or passcode stored on the device. The customer may not refuse to pay on the grounds that there was no receipt, that the signature is not theirs, or that no password was entered. Losses caused by leaked card numbers, phone numbers or SMS codes fall on the customer.

The bank keeps a matching right: where it detects impersonation, theft or counterfeit-card risk, it may suspend payment on the card.

Article 3 is headed errors and dispute resolution, and it allocates responsibility for the service not working. Apple Technology Services (Shanghai) is named for faults on its side, such as NFC failures. The scheme is named for its own, such as abnormal transaction routing. Force majeure brings partial or total relief. The article does not say who pays for a transaction the customer disputes.

The numbers in the agreement

Device card spending is capped at ¥100,000 per transaction and ¥300,000 a day, with foreign-currency equivalents set out for US dollars, euros, pounds and Australian dollars. The bank may adjust them.

One credit card can have up to five device cards across different devices, and one per product on any single device.

Enrolment checks the card number, expiry, CVV2, card status and the phone number on file, then sends the user into the bank's own app for identity verification. A card loaded through a third-party wallet must be activated within 24 hours or it lapses.

The bank may terminate the service on 45 days' public notice, and may amend the agreement by announcement, with continued use counting as acceptance.

What this is not

This article does not report on the accounts circulating on Chinese social media since 26 September about unauthorised transactions on Bank of China Mastercard cards. HaiPay found nothing about them on the bank's card announcements page, where the most recent item is dated 11 September and concerns a system upgrade. Nothing here describes or confirms any incident.

The documents are in Chinese and the translations are HaiPay's; where wording matters, the article follows the Chinese text. The 99.5% figure is a character-level comparison of the two extracted agreements, not a legal opinion. HaiPay did not contact Bank of China, Visa, Mastercard, Mastercard NUCC or Apple.

What to watch

Whether other Chinese issuers name the joint venture in their Mastercard wallet consents, which would make the split a market-wide feature rather than one bank's drafting.

Whether the device data block grows. It is already the widest category in the set.

And whether the report-and-timestamp rule holds when a dispute is about a token rather than a card. The agreement was written for a lost phone.