Hacker News Reader

Comment by Cu3PO42 | Hacker News Reader

> It rolls a new number every time I use it,

Are you positive about this?

When I used Apple Pay (in Germany) I always got the same card number. It was my understanding that the number is generated when you add a card to Wallet and is unique to your device, but not transaction.

EDIT: The Apple support site [1] claims the following:

> Full card numbers aren’t stored on the device or on Apple Pay servers. Instead, a unique Device Account Number is created, encrypted, and then stored in the Secure Element.

I believe this aligns with my understanding.

[1] https://support.apple.com/guide/security/credit-debit-prepai...

View on HN

The device "card" number doesn't change with each purchase but it does have an additional one-time unique crytpogram as well as a dynamic security code that is needed to use that device number.

I thought that you had a fixed number, but Apple generates some kind of unique code, which is sent to the terminal. I.e., the terminal doesn't see your actual number.

I've definitely had the last 4 digits printed out on a receipt. While it is conceivable that those were transmitted separately I find that somewhat unlikely.

I believe tokenization is a feature that is ultimately coming, but not quite there yet (and can also be supported by normal cards).

Disclaimer: I take interest in the payment-world, but am by no means an expert and have made the above claims only to the best of my knowledge.

EDIT: It appears the process of generating the device specific card number is already tokenization.

> After the validation, the card network acting as a TSP (Token Service Provider) creates a token (which is called a DAN or a Device Account Number in the context of Apple Pay) and a token key. This DAN is generated using tokenization and is not the actual card number.

[1] suggests that while some cryptography is done for each transaction, the token is the card number and still only unique to the device, not the transaction.

Said cryptography should be according to the EMV standard [2] and is also performed by a normal card (potentially minus the tokenization).

[1] https://www.freecodecamp.org/news/how-apple-pay-works-under-...

[2] https://en.m.wikipedia.org/wiki/EMV

> I've definitely had the last 4 digits printed out on a receipt. While it is conceivable that those were transmitted separately I find that somewhat unlikely.

I noticed this too. Some merchants print the last four of the device account number (DAN) and some print the last four of the actual primary account number (PAN).

I asked about it on /r/ApplePay [1]. /u/martialplum provided this explanation:

> Although the card number sent to the reader from in the transaction is the device account number, this gets de-tokenized along the way to your bank (either by the payment network or some third party) and the actual card number is the one used for authorization. Some issuers use the actual card number in the response they send back to the merchant (data element 2 in ISO 8583). Depending on how the card reader formats the receipt, it's not uncommon for merchant copies of the receipt to show the full device account number (expected), but show the last 4 of the actual card number for convenience when someone shows them the card on their device, which will show the same numbers.

The "ISO 8583" text in that was a link to this [2].

[1] https://www.reddit.com/r/ApplePay/comments/bnedl7/receipts_a...

[2] https://en.wikipedia.org/wiki/ISO_8583#Data_elements

There is a lot of deliberately confusing marketing. "Tokenization" simply means that a new PAN is generated once per device. This is a normal PAN registered with the payment scheme and your issuer. It has to be a normal PAN, otherwise it would never pass through all the exiting payment infrastructure.

What is generated per transaction is the EMV unpredictable number, but this is part of the EMV protocol and done for any EMV transaction. Think of this like the dynamically generated symmetric key for an SSL session.

Why do you say it's deliberately confusing?

Because we have a whole thread with dozens of comments full with people that don't understand what this means but seem to think it is a selling point for Apple.

> What is generated per transaction is the EMV unpredictable number, but this is part of the EMV protocol and done for any EMV transaction.

What about when magstripe emulation is in use, does Apple Pay support that in the US?

EMV is the antithesis of magstripe and the two have absolutely nothing to do with each other. Contactless EMV is NFC.

EMV transactions still use track data format from magstripe world to ensure backward compatibility.

Unfortunately the United States exists, so there has been a need for magstripe emulation over NFC. I don't know exactly how it works — I think it's some kind of hack on top of EMV — but it does exist.

Nope, Apple Pay is EMV only.

Only Samsung Pay does magstripe emulation.

Are you sure? Only Samsung (and LG apparently?) have the hardware feature where it tricks a magnetic stripe reader into thinking a card was swiped. However, the kind of magstripe emulation I meant is a feature of EMV where it can provide the same information as a magnetic stripe would, but over NFC, for compatibility with legacy (US) payment systems. Does Apple not support this latter system either? (It's apparently not supported for Apple Card, but Google isn't helping me for Apple Pay.)

You claim it's "Deliberately confusing"...

Which bit is confusing (or remotely deceptive)?

> When you make a purchase, Apple Pay uses a device-specific number and unique transaction code. So your card number is never stored on your device or on Apple servers, and when you pay, your card numbers are never shared by Apple with merchants.

Are you claiming this is untrue? Or deceptive?

What's actually happening, if I understand it correctly, is that when you setup Apple Pay you essentially get a _second_ card issued to you for that account that otherwise works just like a normal card but is only used by Apple Pay. It's still your card, still stored on the device, and still shared with merchants. If it wasn't you couldn't actually spend money with it.

Hopefully your bank has fraud controls on it to prevent it from being used outside of the way Apple Pay does (which requires your phone or a physical card so prevents theft) but that's not required and without it there is nothing stopping the card from being used like any other.

I believe OP means it generate a new payment token that's sent over for each purchase

That is not a unique feature of Apple Pay. It happens for any contactless 'card' payment.

Right but Apple, Android, Samsung, Walmart, NBCUniversal, TacoBellFritoLaySnappleGroup Pay are pretty much the first contactless payment platforms to really gather steam in the US.

Visa and MasterCard didn’t have the advantage of a phone platform that make contactless payment actually more convenient than magstripe so the value in rolling it out was pretty low.

Contactless is much more convenient than magstripe in nearly all situations where it's available - it's just that the US took forever to roll it out. By the time it reached a usable level of penetration, the phone platforms were ready to go.

Reply on news.ycombinator.com