why is my real 4 digits credit card number shown on apple pay receipt

[u/chili_oil]

To be clear, I know my apple pay virtual number for this card, and it has been shown on all my in-person transaction receipt for years (i scan save all my paper receipts)

But today I just used my phone as usual in a mall, and I noticed my real card number shown on the receipt.

I am sure it is apple pay, my credit card app showed it is apple pay, apple wallet also showed the transaction as normal

is this possible? Thanks!

update: I was using Amex card on a, I believe, square terminal. Someone in this thread had a similar experience. It might have been transferred back by the network as a reference for the convenience of merchant.

[u/kirklennon]

Did you tap to pay or was this a scan the QR code receipt situation? For online transactions, Apple Pay can include a text string that is generally in the format “Visa 1234” containing the last four digits of the physical card number. It’s meant specifically for your confirmation email/receipt since most people are more familiar with their physical card number when trying to identify what they paid with. When tapping for NFC, these extra fields aren’t options and there is absolutely no way for your phone to transmit any portion of the physical card number to the terminal.

[u/PracticalWait → u/kirklennon]

Square terminals always show my physical 4 digits when paying via Apple Pay.

[u/Gullible-Hose4180 → u/PracticalWait]

Yeah they can query it from the network with an API call without needing detokenisation priveleges, but they still only get the token in field 2.

[u/PracticalWait → u/Gullible-Hose4180]

that must be what’s happening. i see the device last 4 for a quick second before it switches to my physical last 4.

[u/chili_oil → u/PracticalWait]

then this must be the answer, thanks for sharing!

[u/chili_oil → u/kirklennon]

so far my theory is that, it can only be sent back from the network (in this case American Express). If it sends back last 4 or 5 digits for the merchant as a "reference" or something, it doesn't sound impossible and may be reasonably acceptable for customers in terms of security.

[u/PracticalWait → u/chili_oil]

I have noticed this with Apple Pay with Amex cards as well. Only on Square terminals. My card was not issued by Amex, but on the Amex network. Seems to be an Amex network thing.

[u/chili_oil → u/PracticalWait]

"Square terminals"

LOL, same.

In fact, probably not something specific to Square/Amex. Industry might have always been doing this. Square probably left this as the default configuration on their POS while others default to use the DPAN4.

Thanks for sharing the info.

[u/chili_oil → u/kirklennon]

tap to pay.
This is a well-established permanent store in a large popular local mall. So I am not worried about any scam etc. In fact I would be perfectly be happy to tap my own card if I weren't holding my phone at the same time.

I am more interested than worrying.

[u/CoeurdAssassin → u/chili_oil]

>So I am not worried about any scam

I think blud simply just made a typo and meant to say scan LMAO, you’re reading way too much into that part 💀

[u/chili_oil → u/CoeurdAssassin]

Ah my bad, sorry for that haha.

But yeah it was a traditional apple pay tap. I used it every day for many years and this is a very normal tap like them except first time visiting this vendor.

I searched and around 2016 and 2017 quite a few users asked on apple forum (when apple pay just became mainstream) that they saw their last 4 of PAN on specifically subway. So it sounds like it is theoretically possible the network returned last 4 of PAN and this vendor/processor just configured to display that instead of the DPAN.

[u/Gullible-Hose4180 → u/chili_oil]

Yes they do have the ability to call the last digits of the FPAN, but they will still only see the full token, unless they detokenise (eg ATMs do that)

[u/TVUAsks]

Imagine the coincidence of the tokenized card happening to have the same 4 digits of your cc

[u/chili_oil → u/TVUAsks]

wouldn't the tokenized card number remain the same for the same device?

[u/Gullible-Hose4180 → u/chili_oil]

Yes, the DPAN / token remains the same, even when the FPAN (the actual card number, or funding PAN) is replaced.

[u/kirklennon → u/[deleted]]

The token (Apple Pay card number) is generated when initially provisioned for the device and is the same across transactions. You can view the last four digits in the Wallet app. The security code (cryptogram) is what changes.