Can a thief use Apple Pay on a stolen iPhone? Banks say each payment needs a face scan, fingerprint or passcode, but Apple's guidance notes two gaps.