8 ms·

> It rolls a new number every time I use it, Are you positive about this? When I used Apple Pay (in Germany) I always got the same card number. It was my unde

> It rolls a new number every time I use it, Are you positive about this? When I used Apple Pay (in Germany) I always got the same card number. It was my understanding that the number is generated when you add a card to Wallet and is unique to your device, but not transaction. EDIT: The Apple support site [1] claims the following: > Full card numbers aren’t stored on the device or on Apple Pay servers. Instead, a unique Device Account Number is created, encrypted, and then stored in the Secure Element. I believe this aligns with my understanding. [1] https://support.apple.com/guide/security/credit-debit-prepaid-card-provisioning-sec0f005981a/web https://support.apple.com/guide/security/credit-debit-prepai...

jbtule 7y ago
The device "card" number doesn't change with each purchase but it does have an additional one-time unique crytpogram as well as a dynamic security code that is needed to use that device number.
sevencolors 7y ago
I believe OP means it generate a new payment token that's sent over for each purchase
- madeofpalk 7y ago
  That is not a unique feature of Apple Pay. It happens for any contactless 'card' payment.
  - Spivak 7y ago
    Right but Apple, Android, Samsung, Walmart, NBCUniversal, TacoBellFritoLaySnappleGroup Pay are pretty much the first contactless payment platforms to really gather steam in the US. Visa and MasterCard didn’t have the advantage of a phone platform that make contactless payment actually more convenient than magstripe so the value in rolling it out was pretty low.
    - fphhotchips 7y ago
      Contactless is much more convenient than magstripe in nearly all situations where it's available - it's just that the US took forever to roll it out. By the time it reached a usable level of penetration, the phone platforms were ready to go.
notJim 7y ago
I thought that you had a fixed number, but Apple generates some kind of unique code, which is sent to the terminal. I.e., the terminal doesn't see your actual number.
- Cu3PO42 7y ago
  I've definitely had the last 4 digits printed out on a receipt. While it is conceivable that those were transmitted separately I find that somewhat unlikely. I believe tokenization is a feature that is ultimately coming, but not quite there yet (and can also be supported by normal cards). Disclaimer: I take interest in the payment-world, but am by no means an expert and have made the above claims only to the best of my knowledge. EDIT: It appears the process of generating the device specific card number is already tokenization. > After the validation, the card network acting as a TSP (Token Service Provider) creates a token (which is called a DAN or a Device Account Number in the context of Apple Pay) and a token key. This DAN is generated using tokenization and is not the actual card number. [1] suggests that while some cryptography is done for each transaction, the token is the card number and still only unique to the device, not the transaction. Said cryptography should be according to the EMV standard [2] and is also performed by a normal card (potentially minus the tokenization). [1] https://www.freecodecamp.org/news/how-apple-pay-works-under-the-hood-8c3978238324/ https://www.freecodecamp.org/news/how-apple-pay-works-under-... [2] https://en.m.wikipedia.org/wiki/EMV https://en.m.wikipedia.org/wiki/EMV
  - tzs 7y ago
    > I've definitely had the last 4 digits printed out on a receipt. While it is conceivable that those were transmitted separately I find that somewhat unlikely. I noticed this too. Some merchants print the last four of the device account number (DAN) and some print the last four of the actual primary account number (PAN). I asked about it on /r/ApplePay [1]. /u/martialplum provided this explanation: > Although the card number sent to the reader from in the transaction is the device account number, this gets de-tokenized along the way to your bank (either by the payment network or some third party) and the actual card number is the one used for authorization. Some issuers use the actual card number in the response they send back to the merchant (data element 2 in ISO 8583). Depending on how the card reader formats the receipt, it's not uncommon for merchant copies of the receipt to show the full device account number (expected), but show the last 4 of the actual card number for convenience when someone shows them the card on their device, which will show the same numbers. The "ISO 8583" text in that was a link to this [2]. [1] https://www.reddit.com/r/ApplePay/comments/bnedl7/receipts_at_some_merchants_show_last_4_of_actual/ https://www.reddit.com/r/ApplePay/comments/bnedl7/receipts_a... [2] https://en.wikipedia.org/wiki/ISO_8583#Data_elements https://en.wikipedia.org/wiki/ISO_8583#Data_elements

jbtule 7y ago

The device "card" number doesn't change with each purchase but it does have an additional one-time unique crytpogram as well as a dynamic security code that is needed to use that device number.

sevencolors 7y ago

I believe OP means it generate a new payment token that's sent over for each purchase

madeofpalk 7y ago
That is not a unique feature of Apple Pay. It happens for any contactless 'card' payment.
- Spivak 7y ago
  Right but Apple, Android, Samsung, Walmart, NBCUniversal, TacoBellFritoLaySnappleGroup Pay are pretty much the first contactless payment platforms to really gather steam in the US. Visa and MasterCard didn’t have the advantage of a phone platform that make contactless payment actually more convenient than magstripe so the value in rolling it out was pretty low.
  - fphhotchips 7y ago
    Contactless is much more convenient than magstripe in nearly all situations where it's available - it's just that the US took forever to roll it out. By the time it reached a usable level of penetration, the phone platforms were ready to go.

notJim 7y ago

I thought that you had a fixed number, but Apple generates some kind of unique code, which is sent to the terminal. I.e., the terminal doesn't see your actual number.

Cu3PO42 7y ago
I've definitely had the last 4 digits printed out on a receipt. While it is conceivable that those were transmitted separately I find that somewhat unlikely. I believe tokenization is a feature that is ultimately coming, but not quite there yet (and can also be supported by normal cards). Disclaimer: I take interest in the payment-world, but am by no means an expert and have made the above claims only to the best of my knowledge. EDIT: It appears the process of generating the device specific card number is already tokenization. > After the validation, the card network acting as a TSP (Token Service Provider) creates a token (which is called a DAN or a Device Account Number in the context of Apple Pay) and a token key. This DAN is generated using tokenization and is not the actual card number. [1] suggests that while some cryptography is done for each transaction, the token is the card number and still only unique to the device, not the transaction. Said cryptography should be according to the EMV standard [2] and is also performed by a normal card (potentially minus the tokenization). [1] https://www.freecodecamp.org/news/how-apple-pay-works-under-the-hood-8c3978238324/ https://www.freecodecamp.org/news/how-apple-pay-works-under-... [2] https://en.m.wikipedia.org/wiki/EMV https://en.m.wikipedia.org/wiki/EMV
- tzs 7y ago
  > I've definitely had the last 4 digits printed out on a receipt. While it is conceivable that those were transmitted separately I find that somewhat unlikely. I noticed this too. Some merchants print the last four of the device account number (DAN) and some print the last four of the actual primary account number (PAN). I asked about it on /r/ApplePay [1]. /u/martialplum provided this explanation: > Although the card number sent to the reader from in the transaction is the device account number, this gets de-tokenized along the way to your bank (either by the payment network or some third party) and the actual card number is the one used for authorization. Some issuers use the actual card number in the response they send back to the merchant (data element 2 in ISO 8583). Depending on how the card reader formats the receipt, it's not uncommon for merchant copies of the receipt to show the full device account number (expected), but show the last 4 of the actual card number for convenience when someone shows them the card on their device, which will show the same numbers. The "ISO 8583" text in that was a link to this [2]. [1] https://www.reddit.com/r/ApplePay/comments/bnedl7/receipts_at_some_merchants_show_last_4_of_actual/ https://www.reddit.com/r/ApplePay/comments/bnedl7/receipts_a... [2] https://en.wikipedia.org/wiki/ISO_8583#Data_elements https://en.wikipedia.org/wiki/ISO_8583#Data_elements