8

Apple claims that one time token is created. What is the purpose of that token? What happens with that token?

As far as I know when I pay with my physical debit card the information passed the POS device cannot be reused. Or am I wrong? So what kind of extra security Apple Pay provides? It looks more like a privacy feature than a security future in Apple Pay.

Note: Assume that my physical card has no text on it and has no magnetic band.

1
  • 2
    It's not actually one-time. It's a device-specific token. The same token is used for all transactions from that device. Commented Nov 22, 2025 at 13:36

1 Answer 1

11

In an ideal world, there isn't a meaningful difference. There's a few small technical differences in the actual data, but they don't change anything. In reality, merchant's point-of-sale systems can be hacked (Target 2013 and Home Depot 2014 are the two best-known examples), and the card data stolen as it goes through the merchant's system.

The chip in a chip card ensures that the specific details of a given transaction can't be repeated, but it doesn't do anything to protect the card number from someone looking at it in the data and typing it into a website. The three/four digit CVV code that gets printed on the back of the card is there specifically because it won't be available to someone who gets the card number (aka PAN / Primary Account Number) that way, but not all merchants validate that. (There are ways to encrypt the data at the moment it's being read from the card or phone so that it's not visible to the merchant, but that's a separate topic.)

The advantage to the "token" that gets stored on your phone is that your bank knows that it is a token (the technical term is DPAN for Device PAN). Any attempt to use it that doesn't come from a phone can be rejected as clearly fraudulent, and there's no way to load an existing DPAN onto a phone, so if the number gets stolen it can't actually be used by anyone.

And in the other direction, if your phone gets stolen, it's easier to deactivate a DPAN than to replace your main card number.

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.