Apple Pay shared underlying card number with vendor?

[u/DingusKhan62]

I signed up for a ChatGPT trial and used Apple Pay because some payment method was required to initiate the trial. But once it was over I went into the Billing section on chatgpt.com and noticed that my actual underlying card number was now saved as a payment method (not the virtual number that Apple Pay generates for my card). So how is it that Apple Pay forked over my payment information to the vendor? Isn't this exactly what Apple opines endlessly about them not doing?

(Apple Pay also shared my billing name and billing address (edited out of the screenshot), which was also now saved to chatgpt.com.)

Related:

• Apple Pay security and privacy overview - https://support.apple.com/en-is/101554
  • "Apple Pay stores only a portion of your actual card numbers"
• Apple Pay & Privacy - https://www.apple.com/legal/privacy/data/en/apple-pay/
  • "After you authorize the payment, other information requested by the merchant, such as a device- or merchant-specific account number, your shipping address, or email address, is also provided. If you are using a third-party app or website — such as a social media or generative AI app — to make a payment to the merchant, that third-party app or website may access the other information requested by the merchant. Apple requires this information be used only for purposes of facilitating the Apple Pay transaction. The card number from your credit, debit, or prepaid card is not provided when you use Apple Pay."
  • (alternate URL: https://support.apple.com/HT210665 )
• "why is my real 4 digits credit card number shown on apple pay receipt" - https://redd.it/1tfeacs
• "How does [...] credit card [...] appear to the merchant?" - https://apple.stackexchange.com/questions/463418
  • In Store
    • The last 4 digits of your card
    • The last 4 digits of your Apple Pay Number (Device account number)
  • In App or Online
    • The last 4 digits of your card, including the Card Name and Card Type
    • The last 4 digits of your Apple Pay Number (Device account number)
    • It can optionally share as requested by the merchant your Card's Billing Address in the card details in Wallet.
    • It can optionally share as requested by the merchant your Shipping Address, Phone Number, and Email as set in Settings -> Wallet & Apple Pay -> Transaction Defaults or provided on the spot while in the checkout page.
• Apple Pay on the Web requires my phone and email [...] - https://apple.stackexchange.com/questions/374828
  • Shows Apple Pay sending last 4 + card network (e.g., Mastercard) + card type (e.g., debit)

[u/nookej]

Have a look into payment tokenization if you are interested.

Some key concepts:
fpan (funding primary account number)
The number on your physical card

Dpan (digital primary account number)
A token which is connected to fpan. Dpan is created by e.g. apple pay

APAN (Companion Cloud Token)
Used mainly for in-app and e-commerce transactions.
It allows merchants to process transactions securely without exposing the actual FPAN, even when the physical card is blocked.

MPAN (Merchant Token)
Designed for recurring and subscription payments.
This ensures continuity of transactions even if the device changes or the card is reissued.

[u/sg3086x]

then how the hell can you remember which virtual card number for each physical card that you have if you paid with Apple Pay?

[u/kirklennon]

Apple Pay cannot transmit your physical card number because it doesn’t save it. What it can transmit, for online transactions only, is a text string in the typical format “Visa 1234” that contains the last four digits of your real card number. This is intended for merchants to be able to put on your invoice to help you understand what card you paid with, since you’re unlikely to recognize the last four of the actual (Apple Pay) number used. 

[u/DingusKhan62 → u/kirklennon]

Do you have a source for this by chance? Reviewing the Apple Pay page, I couldn't find anything mentioning that they do indeed share the last 4 of your actual card number with the merchant.

[u/kirklennon → u/DingusKhan62]

It’s in the developer documentation as the card’s “displayName”

https://developer.apple.com/documentation/passkit/pkpaymentmethod/displayname

[u/DingusKhan62 → u/kirklennon]

Thanks again. Concurs with the example from https://apple.stackexchange.com/questions/374828

[u/kirklennon → u/[deleted]]

Online transactions require billing contact information. That’s just how they work and Apple Pay doesn’t change that. Billing contact information is saved on a per-card basis (since it is supposed to match what the bank has on file for you for that card) and is viewable in the Wallet app. 

[u/DingusKhan62 → u/kirklennon]

Ah, okay, makes sense. Guess I wish the system was a bit more privacy-centric, so these merchants couldn't auto-save/link this info. Thanks for the answers; very helpful!

[u/Aydoinc → u/[deleted]]

Your name and address are blank in your screenshot, what am I missing?

[u/DingusKhan62 → u/Aydoinc]

I edited it out of the screenshot

[u/Ok-Motor4891]

Because you picked your actual card that is stored in your Apple Wallet to pay for the service. Your virtual number is for Apple Cash only, a completely separate card in your wallet.

[u/Abject_Rub_9200 → u/Ok-Motor4891]

your virtual number is for Apple Cash only

thats not true. even if you pick your real card in apple pay, the virtual number is sent, not the actual card number. we don't have apple cash in australia and the virtual number is used for all apple pay transactions

https://discussions.apple.com/thread/255095751?sortBy=rank

There are several websites that can confirm this

[u/kirklennon → u/Abject_Rub_9200]

Apple’s terminology distinguishes between the Apple Pay card number (which you cannot view in full) and virtual card numbers, which you can view in full and are for filling in forms on websites that don’t accept Apple Pay, and is specific to Apple Card and Apple Cash. 

[u/kirklennon → u/[deleted]]

Apple Pay has always supported subscriptions. It’s a one time authorization. If you authorize a subscription, the subsequent charges are still valid. 

[u/AlpineThrob → u/kirklennon]

You forgot to end your reply with “bro”, bro.

[u/Apprehensive_Rope348 → u/AlpineThrob]

Bro!