Live model · Apple Pay
How Apple Pay Actually Works
When you add a card, your bank creates a stand-in number for your phone, the Device Account Number, kept in its Secure Element with a key. Each tap signs the amount, a counter and the terminal's random number into a one-time cryptogram. The store gets only the token and the cryptogram; your card number never reaches it.
One tap, four parties
- CH1 the counter
- CH2 the terminal's random number
- CH3 your card number
How to read the stage
Four parties, and what each one holds. Your phone has the token and the key; the store gets the token and an 8-byte cryptogram, 4C5568F714300A7A, for a $4.50 coffee on the phone's 42nd tap. The network checks those bytes with its own copy of the key, sees the counter moved past 41, and only then swaps the token for your card number to ask your bank. The table fills in who saw what.
A number that only works from your phone
Apple says the Device Account Number is created by your card's issuer, stored in the Secure Element, and never kept on Apple Pay servers or backed up to iCloud. Payment tokens are restricted to one device, merchant or kind of payment, so a stolen one is worth far less than a card number. Try The token leaks online: typed into a website, it fails, because it never comes with a cryptogram there.
Why a cryptogram works once
Apple's guide says the cryptogram is a one-time code computed from a transaction counter and a key, and the counter goes up with every payment. So the same coffee bought five times gets five unrelated cryptograms below, and a recorded tap sent again is refused: its cryptogram is genuine, but its counter, 43, is behind the 46 the network last saw.
The same coffee, five mornings in a row
What the model leaves out
Real cryptograms use a block-cipher MAC with keys derived per card and per transaction, over fields each network chooses; the model uses HMAC-SHA-256 over four fields and one key. Which party checks the cryptogram and swaps the token back varies: the network's token service, the issuer, or both. Card numbers here are test numbers, and online Apple Pay adds an anti-replay value from Apple's servers.
Questions
- Does the store get my card number with Apple Pay?
- No. Apple's platform security guide says neither Apple nor your device shares full card numbers with merchants. The store receives the Device Account Number and a one-time security code, and full card numbers aren't stored on your device or on Apple Pay servers either.
- Is Apple Pay safer than tapping my card?
- Both use a one-time cryptogram at the terminal, so neither can simply be replayed. The difference is the number: a breach at a store that took Apple Pay leaks tokens, which only work from your phone, rather than your card number. EMVCo, which writes the tokenization standard, says a compromised token does far less damage than an exposed card number.
- Why does Apple Pay need Face ID or a passcode?
- Apple's guide says a payment can be made only after the Secure Element receives authorization from the Secure Enclave, which requires you to authenticate with biometrics, your passcode, or a double-click on an unlocked Apple Watch. The key never leaves the Secure Element.
- How does Apple Pay work in apps and on websites?
- There's no terminal to make up a random number, so the app asks Apple Pay servers for an anti-replay value instead, and it goes into the cryptogram. Apple then re-encrypts the payment with a key for that merchant before passing it on, according to its security guide.