What happens when a card is added to Apple Pay or Google Pay?
When a customer adds a card to their Apple Pay or Google Pay wallet, a new digital card number - called a DPAN (Device Primary Account Number) - is generated. This number is different from the cardholder’s actual card number.
Is the DPAN the same across devices?
No. Each time a card is added to a new device, a unique DPAN is generated. If the card is removed and added again, a new DPAN is issued. The DPAN is a unique digital version of the card for that specific device.
Is DPAN the only type of card token?
No. Card schemes also support a Merchant Primary Account Number (MPAN) - a token tied to a specific merchant rather than a specific device. Unlike a DPAN, which changes every time a card is added to a new device or wallet, an MPAN stays the same for a customer's card across purchases made with the same merchant.
Do merchants receive the real card number during a transaction?
No. Merchants only receive the DPAN during a transaction. The real card number is never shared with the merchant.
How can merchants identify which card was used?
To help with this, Apple and Google send the last four digits and the expiry date of the real card number along with the DPAN. These show up in the API as:
-
last4: Last four digits of the real card number (when available)
What happens if the same card is on different devices?
Since each DPAN is treated as a separate card number, the fingerprint (used to identify a card) is based on the DPAN. This means the same physical card on two different devices will have different fingerprints and appear as two distinct cards in your system.