Apple
But Google isn't resting on its laurels, suggests a new analyst report from Barclays, and will be coming after Apple hard - with Samsung gearing up for its own assault on your wallet.
The key issue is the underlying technology behind these mobile payment services.
Apple's big innovation was to take the iPhone 6/6+ design and build in an "embedded secure element" - basically, a middleman that takes your credit card number and encrypts it so that the cash register never actually gets your real information. It's built straight into the phone and sits near the NFC antenna in the phone that does the actual transmission.
Since Apple was able to muster its corporate might to get the banks, the credit card companies, and the retail chains on board, that embedded secure element has the most support in stores and with banks.
Google, on the other hand, launched its original Google Wallet NFC mobile payment service for Android devices back in 2012. To make life easier for retailers, Google chose what we call "host card emulation," where software in the phone pretends to be a card, as opposed to the embedded hardware that Apple would later go with.
Google's approach is easier for phone makers and retailers alike to use, because it's all in easily updated software. But it's less secure, and importantly, it won't ever work with the kinds of contactless card readers common on public transit systems, like the San Francisco Bay Area's Clipper.
Since then, Google Wallet has added support for embedded security elements, like the kind built into every Samsung Galaxy phone since the S3. But it doesn't need one to work. Barclays also notes that using both embedded security elements and host card emulation could provide better security than either alone.
So the big question for Google, then, is whether it will follow Apple's lead and encourage more Android manufacturers to put in more of those embedded security elements - and whether the phone makers will follow through.
That's an especially big question in light of Google's acquisition of Softcard, a mobile payments platform that was originally owned jointly by Verizon, AT&T, and T-Mobile to compete with Apple and Google, but never went anywhere. All phones that had Softcard pre-installed will soon have Google Wallet instead, drastically increasing its reach. After all, there are more Android devices than Apple in the world.
Google may be starting from a disadvantage, but it's coming after Apple Pay hard. This is especially true as Google adds more devices with fingerprint sensors, used for authentication as with Apple TouchID, to its roster. We'll probably hear more about Google's ambitions for mobile payments at the I/O event this May.
The wild card here is Samsung Pay, launching this summer in the US and South Korea, which uses payment technology similar to Apple Pay. But thanks to Samsung's acquisition of LoopPay, it has something that neither other company has: The ability for a phone to pretend to be a simple magnetic-striped card. It's an add-on to the usual NFC chip, and is still contactless from the phone, but as far the cash register is concerned, you just swiped plastic.
Apple Pay is popular, sure, but it still requires specialized hardware that not every business can afford. But even the shady liquor store on the corner should be able to take a Samsung Pay swipe.
And that's not to mention that banks may start offering their own mobile payment services that bypass those altogether, especially on Android where there's no restriction on using it.
The mobile payment wars are only getting started. As more people get more devices that can use Apple Pay, Google Wallet, and Samsung Pay, these types of payments are only going to take off.