Cybersecurity and Payment Gateways in Micromobility: Google Pay, Apple Pay and GDPR Compliance

Direct answer: the secure way to process micromobility payments is to never touch the card: the initial charge goes through Stripe (with Apple Pay, Google Pay and 3D Secure/SCA), the card is tokenised, and subsequent charges — extra hours, deposits, penalties, unpaid amounts — execute automatically on that token as merchant-initiated transactions. The platform stores only minimal operating data, aligned with GDPR.

The charge map of a real operation

A fleet doesn't charge "a rental": it charges an ecosystem of different amounts. This is how the Stripe gateway built into Fleet OS processes them:

Why tokenisation changes the risk profile

When the user pays for the first time, Stripe returns a token: an irreversible reference to the card that only works with your account.

• Your platform never sees the PAN (card number): there's nothing to steal in your database.
• PCI DSS compliance sits with Stripe (Level 1 certified, the highest).
• A leaked token is useless outside your Stripe account.

This is the standard a CISO or DPO expects to find — and the reason "we store encrypted cards in our database" is the wrong answer in any due diligence.

SCA, PSD2 and the off-session nuance

European PSD2 regulation requires strong customer authentication (SCA) — typically 3D Secure — on the initial payment. The key business question: how do I charge a penalty hours later, without the user present?

The technical answer: MIT (Merchant Initiated Transactions). On the first payment, the user accepts the terms and authorises future service-derived charges. Subsequent charges execute on the token without new authentication, within the PSD2 framework. Stripe handles it natively; the operator only defines amounts and rules.

Apple Pay and Google Pay: security that also converts

Wallets aren't just convenience:

• Biometric authentication (Face ID / fingerprint) on every payment: stronger than a typed CVC.
• Single-use cryptograms: not even Stripe sees the real card.
• Conversion: in a street-side mobile checkout, removing card typing measurably reduces abandonment — critical when the user is standing next to the bike.

GDPR: the separation of responsibilities

• Platform (data processor): email, phone, usage history — hosted in the EU, encrypted in transit and at rest.
• Stripe (certified payment processor): all card data.
• Operator (data controller): defines purposes and retains control; exercises data subject rights from the panel.

This is the same separation corporate compliance teams require in private campus mobility projects.

Due diligence checklist for decision-makers

• Does the platform store PANs? (The answer must be no — tokens only)
• SCA/3DS active on the initial payment and MIT documented for later charges?
• Holds available for deposits instead of real charges?
• Automatic charges with attached evidence (GPS, photos) for disputes?
• Operating data hosted in the EU and user erasure available?

Conclusion

In payments, the right architecture is boring: Stripe tokenises, regulation is met by default and the hard charges (extras, unpaid amounts) collect themselves without friction or disputes. If you're evaluating platforms, test this checklist against the 2026 fleet management software comparison and quantify the impact of automatic charging in the ROI analysis.

Frequently asked questions

How do you charge an extra hour or a penalty without the user present?

On the first payment, the card is tokenised in Stripe with the user's consent (off-session charging). When the system detects extra hours, an out-of-zone return or an unpaid amount, it executes the charge automatically on that token, with the amount and concept defined in the accepted terms.

Is a security deposit mandatory?

No, and best practice is to avoid real charges: use a hold (pre-authorisation) that blocks the amount on the card and is released automatically when the bike is returned in good condition. The user sees no money leave their account and the operator stays covered.

What does PSD2/SCA require for these charges?

Strong customer authentication (SCA with 3D Secure) applies on the initial payment. Subsequent off-session charges (extra hours, penalties) are covered as merchant-initiated transactions (MIT) on the tokenised card — a flow Stripe manages natively.

What personal data does the platform store versus Stripe?

The platform stores minimal operating data (email, phone, rental history) hosted in the EU. Payment data (PAN, expiry, CVC) lives exclusively in Stripe, PCI DSS Level 1 certified; the platform only references an irreversible token.