Used Apple Pay but receipt shows actual card no.

[DiscoSushi]

I used Apple Pay to pay for a purchase on the Walgreens website in desktop Safari and yet the email receipt I received from Walgreens displays the last four digits of my actual card number.

I checked my settings on my Walgreens account to see if somehow I had previously entered my actual card number as a payment method directly on the website, but I had not.

How or why did this happen? This doesn't seem like expected behavior. How did they get my actual card number if I did not enter it?

 

[chscag]

Your card number is stored in the Wallet app on your phone when you did the setup for Apple Pay. That will supposedly change with the new Apple Credit Card. You can read about that in these forums.

 

[tmiw]

Your card number is stored in the Wallet app on your phone when you did the setup for Apple Pay. That will supposedly change with the new Apple Credit Card. You can read about that in these forums.

I'm fairly sure that's not the case. However, some banks and payment processors do support a thing where they'll send the last four digits of the actual card number to the merchant for printing on receipts. That might have been what OP observed.

 

[chscag]

I'm fairly sure that's not the case. However, some banks and payment processors do support a thing where they'll send the last four digits of the actual card number to the merchant for printing on receipts. That might have been what OP observed.

That's true that banks and payment processors will send only the last 4 digits to be displayed for a receipt, but that does not negate the fact that the entire credit card number is stored in the Apple Wallet. The OP was concerned about how they got hold of the credit card numbers since that doesn't show up when using Apple Pay. The new Apple credit card does not have numbers.

 

[jetsam]

Your card number is stored in the Wallet app on your phone when you did the setup for Apple Pay. That will supposedly change with the new Apple Credit Card. You can read about that in these forums.

Apple says:

...your card number is never stored on your device or on Apple servers, and when you pay, your card numbers are never shared by Apple with merchants.

https://www.apple.com/apple-pay/

 

[chscag]

That's true, but again.. initially you must enter the full credit card numbers into Apple Pay in order to set it up. I have read that it's safe but personally do not trust it.

 

[Ledgem]

That's true, but again.. initially you must enter the full credit card numbers into Apple Pay in order to set it up. I have read that it's safe but personally do not trust it.

Apple Pay is supposed to act as something of an intermediary between your credit card and the vendor. It's supposed to generate a code of sorts for the transaction with the merchant; the merchant isn't supposed to see the credit card. Apple Pay needs to know the credit card number, of course, to handle the other end of the transaction.

When I look at my own Wallet application, my credit cards do contain the last four digits. I'd imagine this is more for us as customers than representing that the entire credit card number is stored on the device and actively being used. I can easily imagine how someone might have two credit cards that had similar graphics, and unless the four digits were listed, you wouldn't be able to tell them apart.

I haven't paid enough attention to my receipts to know whether the last four digits are shown. Reading over what Apple says, the full credit card number is never provided to the merchant, but the device ID is provided, along with some additional information needed to complete the transaction. They don't specify what that is, but I could imagine that the last four digits of the card number might be needed. Or perhaps it's again by design, so that people who keep track of things by receipts can know which credit card they used for which transaction.

I'd also prefer if absolutely no credit card information were provided to the merchant when I use Apple Pay, but this is still far more secure than entering your full card information.

 

[chscag]

I'd also prefer if absolutely no credit card information were provided to the merchant when I use Apple Pay, but this is still far more secure than entering your full card information.

That's my feeling also. The Apple credit card should be available sometime in August. My understanding of how it works is that no credit numbers are transmitted and that the card itself does not have a number.

 

[chrfr]

I used Apple Pay to pay for a purchase on the Walgreens website in desktop Safari and yet the email receipt I received from Walgreens displays the last four digits of my actual card number.

I checked my settings on my Walgreens account to see if somehow I had previously entered my actual card number as a payment method directly on the website, but I had not.

How or why did this happen? This doesn't seem like expected behavior. How did they get my actual card number if I did not enter it?

It could just be a coincidence that the last 4 digits of your Apple Pay "card" (Device Account Number) are the same as your actual card, with other digits being different. You should be able to look in the wallet app to see what your Device Account Number shows, but Apple Pay does not use the actual card number for transactions.
From the Apple Pay security overview document:

After you authenticate your transaction, the Secure Element provides your Device Account Number and a transaction-specific dynamic security code to the store’s point of sale terminal along with additional information needed to complete the transaction. Again, neither Apple nor your device sends your actual payment card number. Before they approve the payment, your bank, card issuer, or payment network can verify your payment information by checking the dynamic security code to make sure that it’s unique and tied to your device.

The Apple Pay security overview is here: https://support.apple.com/HT203027

 

[lartola]

It could just be a coincidence that the last 4 digits of your Apple Pay "card" (Device Account Number) are the same as your actual card, with other digits being different. You should be able to look in the wallet app to see what your Device Account Number shows, but Apple Pay does not use the actual card number for transactions.
From the Apple Pay security overview document:


The Apple Pay security overview is here: https://support.apple.com/HT203027

DiscoSushi is right. I've had exactly the same experience using Western Union's app to transfer money. Apparently for online purchases on websites or in apps, the last four digits of the actual card are indeed sent to the merchant, though it may be the case that only those last four digits that are being sent as a reference and not all of the card information. I don't see that happen when I make purchases at brick and mortar locations.
[doublepost=1565647957][/doublepost]

I'm fairly sure that's not the case. However, some banks and payment processors do support a thing where they'll send the last four digits of the actual card number to the merchant for printing on receipts. That might have been what OP observed.

Apparently that's what they do on all online purchases made using Apple Pay. I've had the exactly same experience as OP when I transfer money using Western Union's app and pay with Apple Pay. And not just once. I do it once a month and my last four digits of the physical card have shown up every single time I have done it.
[doublepost=1565648216][/doublepost]

I'd also prefer if absolutely no credit card information were provided to the merchant when I use Apple Pay, but this is still far more secure than entering your full card information.

Well on in-person transactions at physical stores, absolutely no actual credit card information is transmitted to the merchants POS system. It's just on online purchases that the last four digits of the actual card appear to be sent to the merchant. I can confirm this because I have had the same experience as OP, where only the merchant was different.