Nope. That's deliberately confusing Apple marketing. You get one PAN per device. The new "number" is just the EMV unpredictable number. You get that with any EMV card.
https://emvlab.org/emvtags/show/t9F37/
> and not care about skimming.
Because the PAN is only valid for online authorized EMV transactions.
The unpredictable number is an (of a few) inputs into the generation of the CVV3, which is also based on a dynamic key from the issuer. Key rotation is on the order of weeks to months (depending on issuer). This is the "unique number" per transaction (part of tag 57 https://emvlab.org/emvtags/show/t57/ )
DPAN is only good for card-present transactions, provided CVV3, transaction counters, etc.
Has anyone made a habit of rotating DPANs on a regular basis like this? Does Apple or your bank get irritated at some point?
I once had a very long call trying to explain to a very upset Mastercard person why this behaviour wasn’t an issue. I don’t think they understood.
So far my banks have not complained.
The other week a store clerk failed to look up my purchase when using my physical credit card, but succeeded when using the same credit card via Apple Pay. I would have been out of luck if I had rotated my Apple Pay number.
They are using an industry standard protocol that is 25 years old.
However a seemingly trivial but important difference with Apple Pay is that it doesn't use your physical card number—instead it uses a different card number randomly assigned to your device. The payment networks can therefore recognise Apple Pay-assigned numbers and know to demand full Apple Pay authentication when they are used.
This reduces the scope for downgrade attacks.
I do wonder if the security gain is significant enough to make Apple Pay integration a gross-positive for all parties. Apple appears to charge a ~0.1-0.2% fee per transaction made via Apple Pay [0], so it might be reasonable that the security adds enough value in its own right to make sense from a fraud/insurance perspective.
Might also be the fact that possibly being "Top of wallet" on Apple Pay (Which users might use anyway, irrespective of if their normal card is supported) provides enough value to take a small hit in fees.
[0] https://appleinsider.com/articles/16/02/22/apple-halved-tran...
But to be fair, after trying to do payments in various other ways, Google eventually built their Android payments platform to be an almost perfect 1:1 recreation of Apple Pay.
(And this is a recurring theme with Android. I'm not saying Google aren't within their rights to build things however they wish, but it is remarkable how often Google make loud smug noises about how they've done things differently to Apple—only for those points of differentiation to quietly disappear a few years later. Say what you will about Apple, a company that makes plenty of horrible mistakes, but it's remarkable how often they do get things exactly right the first time.)
There are varying reports of people seeing unfamiliar (i.e. device) numbers and their card number on receipts. I've no knowledge about exactly why there's no consistency, but my suspicion is that Apple Pay sends these four digits as metadata during the contactless transaction. Older contactless terminals would ignore it and naively print four digits of the account number, whereas newer terminals might recognise that metadata and print that on the receipt instead.
It's also possible that the physical card's last four digits are being sent back to the terminal by the network.
I'm somewhat uninitiated, and I definitely got the wrong impression. So thanks for your clear-up.
Maybe because people know the word "token" and don't know what a "PAN" is. Apple has built a trillion-dollar company by speaking at the level of its customers, not technobabble.
Some place I could not use Apple Pay with was involved in a breach, and so my bank notified me that I was getting a new card, and to start using it as soon as it came in the mail.
At about the same time as I got the email notice that this was happening, I got a notification on my iPhone that the card had been updating in Apple Pay to the new one. No action was required on my part.
I have no idea how they did that. I know there is a credit card updater service provided by at least Visa, MC, Discover, and AmEx that allows merchants with those cards on-file to ask for updates. We use that where I work, but the interface to it involves posting a file that contains one record per card we want updated in a fixed field format straight out of the punched char days (but wider than punched card). Then, typically in two or three days, a similar file comes back with update records for some of those cards. More updates trickle in that way over the next few days. And some never get a response.
Anyone know what it takes to get access to the kind of updates Apple is getting, where apparently the banks push the updates and they are very timely? Is this something only very high volume entities can get?
Are you positive about this?
When I used Apple Pay (in Germany) I always got the same card number. It was my understanding that the number is generated when you add a card to Wallet and is unique to your device, but not transaction.
EDIT: The Apple support site [1] claims the following:
> Full card numbers aren’t stored on the device or on Apple Pay servers. Instead, a unique Device Account Number is created, encrypted, and then stored in the Secure Element.
I believe this aligns with my understanding.
[1] https://support.apple.com/guide/security/credit-debit-prepai...
What is generated per transaction is the EMV unpredictable number, but this is part of the EMV protocol and done for any EMV transaction. Think of this like the dynamically generated symmetric key for an SSL session.
What about when magstripe emulation is in use, does Apple Pay support that in the US?
Only Samsung Pay does magstripe emulation.
Which bit is confusing (or remotely deceptive)?
> When you make a purchase, Apple Pay uses a device-specific number and unique transaction code. So your card number is never stored on your device or on Apple servers, and when you pay, your card numbers are never shared by Apple with merchants.
Are you claiming this is untrue? Or deceptive?
Hopefully your bank has fraud controls on it to prevent it from being used outside of the way Apple Pay does (which requires your phone or a physical card so prevents theft) but that's not required and without it there is nothing stopping the card from being used like any other.
I believe tokenization is a feature that is ultimately coming, but not quite there yet (and can also be supported by normal cards).
Disclaimer: I take interest in the payment-world, but am by no means an expert and have made the above claims only to the best of my knowledge.
EDIT: It appears the process of generating the device specific card number is already tokenization.
> After the validation, the card network acting as a TSP (Token Service Provider) creates a token (which is called a DAN or a Device Account Number in the context of Apple Pay) and a token key. This DAN is generated using tokenization and is not the actual card number.
[1] suggests that while some cryptography is done for each transaction, the token is the card number and still only unique to the device, not the transaction.
Said cryptography should be according to the EMV standard [2] and is also performed by a normal card (potentially minus the tokenization).
[1] https://www.freecodecamp.org/news/how-apple-pay-works-under-...
I noticed this too. Some merchants print the last four of the device account number (DAN) and some print the last four of the actual primary account number (PAN).
I asked about it on /r/ApplePay [1]. /u/martialplum provided this explanation:
> Although the card number sent to the reader from in the transaction is the device account number, this gets de-tokenized along the way to your bank (either by the payment network or some third party) and the actual card number is the one used for authorization. Some issuers use the actual card number in the response they send back to the merchant (data element 2 in ISO 8583). Depending on how the card reader formats the receipt, it's not uncommon for merchant copies of the receipt to show the full device account number (expected), but show the last 4 of the actual card number for convenience when someone shows them the card on their device, which will show the same numbers.
The "ISO 8583" text in that was a link to this [2].
[1] https://www.reddit.com/r/ApplePay/comments/bnedl7/receipts_a...
Visa and MasterCard didn’t have the advantage of a phone platform that make contactless payment actually more convenient than magstripe so the value in rolling it out was pretty low.
First you need to join the Apple Developer Program. Why? I'm not developing an app.
To join the Apple developer program you need an Apple device that will do two factor auth. So I go buy an iPhone 6 with a cracked screen solely for this purpose.
Then you need Apple to approve your DUNS number. I am one of the minority who already had one, so I didn't have to go through the whole process with Dun & Bradstreet to get one, but Apple would not accept it for several weeks until suddenly they did, with no change to the number or other company info.
And then, you need to schedule a phone interview! This is the point I'm at right now, so I can't tell you how many more hurdles there are to clear. I haven't had luck yet with the Apple "click here and your phone will ring any moment with a call from us" button on their website. Phone never rings.
And I haven't even got to the part where I pay $100 before accepting any payments, which Stripe and PayPal sure don't require.
You have to endure a lot of friction to eliminate payment friction for your customers.
Signing a signature is basically obsolete - in fact I can't remember the last time I did. Restaurants usually have a wireless terminal they bring over.
It's strange how regional those types of things are though. I am always surprised traveling in the US when I'm asked to sign (even with chip or contactless, which makes zero sense).
I don't think I've signed anything for 10+ years tbh, but the UK went pretty heavily for chip and pin early one. But honestly it's a coinflip whether I remember my pin these days.
If you use ApplePay on an older terminal, which does implement the more secure protocol, it falls back to the same protocol as used by contactless cards and is subject to the £30 limit.
The EMV part requires the merchant device to be online or the process won't happen and the phone part requires user authentication; you'd have to break both at the same time to abuse it. Probably still possible, but much harder than stealing a card and using it until you hit the limit or get flagged.
Probably also why EMV contactless without PIN and EMV contactless with PIN have different limits (amount of transactions and transaction amounts).
However, with Apple (okay, now Garmin) Pay, I never have to sign.
When it finally arrived in the mail (a week after request, literally hours before my flight), it turns out it's not even a Chip-and-PIN PIN, it's for cash advances. I still did a lot of signing reciepts and waiting for poor underpaid M&S cashiers to sort things out.
This is literally the first time I've heard a use case that would actually make me care about contactless versus a swipe/insert. Grabbing my phone off the RAM mount would be considerably easier pulling my gloves off and trying to fish out my wallet.
In the past, I've always been incredibly apathetic toward the "convenience" factor of contactless, but that's a real -- if niche -- win.
It's all stuff which I never cared much about but definitely enjoy when it works right. It doesn't hurt that with the Apple Card I get 2% cash back when I use the phone.
https://applepaydemo.apple.com
Unfortunately, their docs are explicit about discount codes, "Do not ask the user to perform any other tasks before presenting the payment request. For example, if the user needs to enter a discount code, you must ask for the code before they press the Apple Pay button."
https://developer.apple.com/library/archive/ApplePay_Guide/C...
I don't know what happened to it. My guess is that since most gas stations are small businesses, they didn't want to pay to upgrade all of their pumps.
That's because those sales show up as being in the "online shopping" category for my credit card despite actually taking place in store, and I've got a card with very good cash back rewards for online shopping.
I had forgotten that was a thing. I'll have to remember to reach for the phone the the next time I'm ordering something off of a second- or third-choice website.
in the US, it's faster than chip-and-pin cards by a LOT. It rolls a new number every time I use it, so i can pay at sketchy gas stations at 2 AM and not care about skimming. More and more gas stations are upgrading their pump POS pads so i can refuel my bike without digging under my armour for my wallet.
On websites, my only quibble is that it's often very hard or not possible to enter discount codes or other special checkout options like "pick up in store" when using the apple pay button(s); when I don't have any codes, I dearly appreciate not having to make an account for that merchant and i'm significantly more likely to spend money at websites that support it.