‘Apple does not store credit card information for Apple Pay’
It seems that Apple does not store the credit card information used for the payment service Apple Pay itself. Instead, the company would just pass the data on to the credit card company, which then communicates with Apple via tokens.
The Unofficial Apple Weblog found that out by looking at Apple Pay’s technical specs and talking to some unnamed individuals who contributed to its development. The site states that Apple Pay users’ credit card information is not stored with Apple itself; when a new user registers, the credit card information entered is forwarded to the company that issued the credit card.
If the credit card company determines that the data is correct, a 16-number token is sent back to Apple, which uses it as a kind of ‘dummy’ credit card. The last four digits are derived from the original credit card, but the rest of the digits are randomly generated. This token is then securely stored on the iPhone on which Apple Pay is used. Because the token is largely randomly generated, a hacker who penetrates Apple’s servers cannot trace the numbers back to credit card information.
In a transaction via Apple Pay, the token stored on the iPhone is sent to the retailer, who in turn forwards it to the credit card company where the original credit card information is retrieved. It then asks for authorization of the transaction from the bank that issued the credit card, after which it communicates its approval to the merchant. In this way, no credit card details are sent between different parties, which prevents, among other things, a man-in-the-middle attack.
Apple has taken a number of security measures for Apple Pay. For example, in addition to a token, a three-digit CVC number is also generated. This security number, which is usually on the back of a credit card, is generated using a cryptographic algorithm that dynamically generates the cipher based on the previously generated token.
In addition, a one-time cryptogram is generated for each transaction based on data about the device used and the transaction in question. This cryptogram is intended to ensure that a payment can only be made on a device that is actually linked with Apple Pay.
After Apple announced its mobile payment service Apple Pay, there was a discussion about handing over credit card information. So it seems that the company has made it unnecessary to store credit card information, although no official statements have yet been made.