News for hackers. Stuff that matters.
Re:Apple Pay on pace to account for 10% of global card trans... by bret791 on Tuesday February 11, 2020 @10:38PM (#22305508)
Mostly there, you get a tokenized PAN (DPAN) for every card enrollment. Remove, and re-add a card to your digital wallet and you'll get a new DPAN.

The unpredictable number is an (of a few) inputs into the generation of the CVV3, which is also based on a dynamic key from the issuer. Key rotation is on the order of weeks to months (depending on issuer). This is the "unique number" per transaction (part of tag 57 https://emvlab.org/emvtags/show/t57/ )

DPAN is only good for card-present transactions, provided CVV3, transaction counters, etc.

Re:Apple Pay on pace to account for 10% of global card trans... by CKN23-ARIN on Tuesday February 11, 2020 @11:01PM (#22305627)
> Remove, and re-add a card to your digital wallet and you'll get a new DPAN.

Has anyone made a habit of rotating DPANs on a regular basis like this? Does Apple or your bank get irritated at some point?

Re:Apple Pay on pace to account for 10% of global card trans... by avianlyric on Wednesday February 12, 2020 @04:26AM (#22307304)
I would avoid doing this. Mastercard guidance (and I assume Visa is the same) is to treat this behaviour as fraudulent.

I once had a very long call trying to explain to a very upset Mastercard person why this behaviour wasn’t an issue. I don’t think they understood.

Re:Apple Pay on pace to account for 10% of global card trans... by fouc on Wednesday February 12, 2020 @05:16AM (#22307571)
Mastercard client/user or Mastercard support/staff?
Re:Apple Pay on pace to account for 10% of global card trans... by avianlyric on Wednesday February 12, 2020 @11:52AM (#22310393)
Mastercard staff member responsible for Apply Pay best practices.
Re:Apple Pay on pace to account for 10% of global card trans... by jackjeff on Wednesday February 12, 2020 @01:34AM (#22306436)
I do. Every update of watchOS since version 6 seems to break activity syncing between my watch and phone. So I end up having to restore from backup every time, and thus reset ApplePay.

So far my banks have not complained.

Re:Apple Pay on pace to account for 10% of global card trans... by SiNTEx on Wednesday February 12, 2020 @01:12AM (#22306306)
Only possible problem I can think of is that you would trigger some of the fraud rules on Apple’s, network’s or issuer’s side as all theses parties have the ability to trigger yellow or red flows during the token provisioning. You would then probably have to call your issuer for assistance every time you want to provision new card to your device.
Re:Apple Pay on pace to account for 10% of global card trans... by winter_blue on Wednesday February 12, 2020 @02:27AM (#22306695)
I involuntarily do this (annually), when getting a new iPhone every year. My iOS Wallet app resets, and I'm forced re-add all my cards (although it does remember what cards where added previously). Never thought too much about it.
Re:Apple Pay on pace to account for 10% of global card trans... by robk on Wednesday February 12, 2020 @01:28AM (#22306408)
Why would you do this?
Re:Apple Pay on pace to account for 10% of global card trans... by CKN23-ARIN on Wednesday February 12, 2020 @01:43AM (#22306469)
So that retailers won't be able to use DPAN to uniquely identify me across transactions.
Re:Apple Pay on pace to account for 10% of global card trans... by divbzero on Wednesday February 12, 2020 @02:07AM (#22306580)
On the flip side, the ability to look up your past purchases can enable returns without receipts.

The other week a store clerk failed to look up my purchase when using my physical credit card, but succeeded when using the same credit card via Apple Pay. I would have been out of luck if I had rotated my Apple Pay number.

Re:Apple Pay on pace to account for 10% of global card trans... by javajosh on Wednesday February 12, 2020 @07:43AM (#22308351)
Or perhaps your device could store previous identifiers and offer those to the vendor to lookup in their system? Assuming the vendor isn't doing something shady like building an association table between identifiers, this would preserve your privacy and let you change your identifier as much as you like.
Re:Apple Pay on pace to account for 10% of global card trans... by nielsbot on Wednesday February 12, 2020 @03:22AM (#22306952)
I think there's also a button in settings to get a new card number?
Re:Apple Pay on pace to account for 10% of global card trans... by mehrdada on Saturday February 15, 2020 @12:17AM (#22333429)
That's an Apple Card thing I believe, not Apple Pay--and it rotates a different card number than the one in your physical Apple Card or device-specific card number. It's the one you're supposed to use on legacy online stores and rotating it is similar to ShopSafe, etc.