> The merchant only gets the "6+4" digits of the card, the DPAN is sent over the network to the tokenization service, which translates the DPAN to the CPAN and sends the transaction to the issuing bank for authentication and payment.

> The lack of being able to get the "real" CPAN is why some US merchants still refuse Apple/Google/Samsung Pay, specifically because they lose the ability to track customers.

Looking at you, HEB