Tokenisation

Tokenisation replaces a cardholder's actual card number (Primary Account Number, PAN) with a unique digital token for payment transactions. When you add a credit or debit card to Apple Pay, Google Pay, or Samsung Pay, the device generates a Device Account Number (DAN, also called a token) that is stored on the device's Secure Element chip. The actual card number is never transmitted to the merchant.

How it works: When you tap to pay at a terminal, the device sends the token plus a dynamic cryptogram (a one-time code generated for that specific transaction). The payment network (Visa, Mastercard) matches the token to your real card number and processes the transaction. The merchant receives only the token and cryptogram, not your actual card number.

Fraud implications for consumers:

1. Even if a merchant's systems are breached, the stored token is useless to fraudsters because it is device-and-transaction specific. Your real card number cannot be recovered from a token.

2. Liability for tokenised payments: Under Visa and Mastercard network rules, tokenised payments (via Apple Pay, Google Pay) are treated as card-present transactions with full zero-liability network coverage. If a tokenised payment is somehow compromised, liability rules are at least as protective as physical card use.

3. Credit vs debit tokenised payments: The underlying liability rules remain those of the card type: a credit card token carries Reg Z protections; a debit card token carries Reg E protections. Tokenisation improves security but does not change the underlying dispute rights.

Samsung Pay uses a similar tokenisation mechanism but historically also used Magnetic Secure Transmission (MST) for older terminals that cannot read NFC (near-field communication). MST-based payments do not go through the same token path and are being phased out as NFC adoption increases.

Note: Some businesses (primarily small merchants) do not accept NFC/contactless payments. In those cases, tokenisation is unavailable, and physical card use (or chip+PIN for debit) is the only option.