What the phone sends at the till
What does a shop’s terminal receive when you pay by phone? With Apple Pay, according to Apple’s privacy and security page, it gets a Device Account Number and a dynamic security code unique to that transaction, along with the other data a payment needs. “Neither Apple nor your device sends your actual payment card number,” the page says.
That number is created by your bank, its service provider or the card issuer once the card is approved for the wallet. It is encrypted and sent to Apple. Apple cannot decrypt it. The number then sits in the Secure Element, a certified chip in the phone. Apple’s security guide adds that the number is never kept on its servers or backed up to iCloud, and an Apple Watch gets Device Account Numbers of its own.
Why a stolen device number buys little
The card issuer or payment network can stop a Device Account Number from working on a magnetic stripe card, over the phone or on websites, Apple says in its card provisioning page, published December 19, 2024. Each payment also carries the one-time code, which your bank, the issuer or the network can check before approving it.
Apps and websites work differently. Apple’s servers receive the encrypted payment and re-encrypt it with a key belonging to that merchant or developer, so only the intended business can read it. The guide adds that devices on iOS 16 or later can use Apple Pay merchant tokens, and that the payment sheet now handles subscriptions, recurring bills and installment payments.
Google Pay is not always tokenized
The common assumption is that every phone-wallet payment carries a token. Google’s Pay API reference, last updated November 12, 2026, shows otherwise. A merchant chooses which of two authentication methods it accepts, and only one of them returns a token.
| Method in Google’s API | Which cards | What the merchant receives |
|---|---|---|
| PAN_ONLY | Cards stored on file with the user’s Google Account | The card number with its expiry month and year |
| CRYPTOGRAM_3DS | Cards stored as Android device tokens | A 3-D Secure cryptogram generated on the device |
A note in the same entry states that the JCB and Discover networks do not support CRYPTOGRAM_3DS, so Google Pay cannot hand a merchant a device token for those cards. Google also tells merchants that its validation and fraud checks “aren’t intended to replace” their own risk management.
Lost phones and crypto cards
Erasing a device, whether through Erase All Content and Settings, Find My or a restore, tells the Secure Element to mark every card as terminated, Apple’s guide on making cards unusable explains. Suspending or removing a card in the wallet has the issuer or network block that device number, even while the phone is offline.
The same tokens now carry crypto spending. Wallet provider MetaMask says on its card page that its card can be tapped through Apple Pay or Google Pay to pay with tokens such as USDC and USDT. The phone holds a device number for the card account, and the crypto card program converts the tokens into ordinary money when you pay.
If you take payments, check whether your checkout accepts PAN_ONLY, because those payments carry a real card number into your systems.