When you pay with a modern chip card, the terminal will read the 16 digit primary account number (PAN) on the card, which is stored in the chip.

During this kind of transaction, the payment is verified at the terminal either manually via a signature or more likely via entering a 4 digit PIN number, the terminal will check the PIN is correct compared to the data on the card chip, and if it matches the payment is sent to be authorised or rejected by the bank and if you have enough funds it goes through.

Part of the modern chip card standard (EMV) includes the ability to make contactless transactions. If you hold your card near a compatible reader, it will send the PAN information via a technology called NFC (near-field communication), this sends the same data as you would if you inserted the card. There is usually a limit for this kind of transaction, this may be a maximum amount, or require a pin after a few contactless transactions for security reasons.

With Apple Pay things are similar, except it doesn’t sent your actual PAN, and you don’t need a PIN. Instead this uses something called tokenisation, where rather than sending your real data, it generates a unique single use number specific to that device and transaction.

With Apple Pay when you register each card on the device, this creates a link to your card issuer and generates a new number called a device account number (DAN) which is unique to the phone or watch you added the card to and stored securely on the device, the bank also gets a decryption token they can use to securely check that your information matches. Note: This number is not the same as the number visible on the card.

When an Apple Pay transaction happens the device verifies your identity via Touch or Face ID, and sends your DAN, the card expiry date, and a unique transaction number (dynamic card verification value) just for that payment. The dynamic number which is unique to each transaction serves a similar but more secure purpose as the PIN and 3 digit CVV code on the back of a credit card to prove the transaction is being made by the card holder, or in this case device holder.

All this information substitutes for your real PAN number, and is checked in real-time by a token service provider at the bank of the store you’re buying from.

This bank then sends the information on to Visa, Mastercard or AMEX etc. where they will decrypt the information using a key they received which was created when you registered the card on your device, they use this key in order to get your actual card number, then the transaction request is then sent to your actual bank/card issuer to approve/reject the payment.

Assuming you have the funds, it goes through and you get to marvel at the fact this all happens in in under 3 seconds.

Edit: spelling