Apple Pay and Rewards Network (Dining for Miles)
 

Although pieces of this were being discussed in another thread, I decided it might help to have a specific one just in relation to Rewards Network.

With Apple Pay being released in the US, the question arises about how well it works (or does not work) with various rewards based schemes. I am interested what happens when using Apple Pay at a Merchant that is in the Rewards Network. Rather than wait around I decided to run a little test.

Contrary to what Apple seems to say, Apple Pay appears to work at any merchant that has NFC available at their registers. In fact there is a handy little iPhone App called MasterCard Nearby that you can look up which merchants in a particular area offer NFC for payment. I loaded that, cross checked my MileagePlan Dining app, then looked for something inexpensive - boom, Jack In The Box.

The - Test
I placed 2 separate orders (don't worry they were inexpensive single item orders); one using ApplePay, the other swiping the card.

The Result
The ApplePay/NFC transaction was not picked up by Rewards Network. And as expected, the swiped card transaction was and I received my miles.

Note that when using Apple Pay, it basically assigns a unique ID to the credit card and ties it to the phone. So in this case the receipt for the Apple Pay transaction notes the card number as something like xxxxxxxxx1234. However the transaction with the swipe notes the actual physical card number xxxxxxxxx5678 (for example). The issue is that Rewards Network only has my physical card registered xxxxxxxxx5678. So the test is trying to determine if when using ApplePay will I miss out on my Rewards Network miles.

Isn't this the same as how EMV works? The merchant gets a one-time number for that and therefore wouldn't know your original card number either.

I have updated the original post with the test results and unfortunately the Apple Pay transaction was not picked up/visible for Rewards Network. The implication is that when using Apple Pay you are not likely to get miles (on Rewards Network).

The transaction at Jack in The Box (who is not an official Apple Pay merchant but does offer NFC payment at the location for my test) shows up on my statement the same for both transactions. However a different transaction at an official Apple Pay merchant (Panera Bread) shows up on the statement as "AplPay PANERA BREAD" - indicating that those transactions may be distinguished as such for other purposes. Apparently Apple is planning its own reward scheme of some kind for Apple Pay in the future - just a rumor at this point.

In addition, I also noticed that on the receipts for both Apple Pay transactions I have completed, the card number shown on the paper receipt is the same. That indicates there is a card number assigned behind the scenes and may be the same over time across all Apple Pay/NFC transactions.

Within Apple Pay (Passbook App actually) on my iPhone it shows a "Device Number" associated with the card. The full number is masked so it shows up like **** 12345 (for example). And the last 4 digits match with what shows up on the paper receipt when using Apple Pay. All this leads me to believe that if I could get the full "Device Number" I could very likely just register that with Rewards Network and get points/miles on Apple Pay transactions. However I am not sure if Apple or the card company (AMEX in this case) would be willing to give me that full Device Number. I am not seeing a way for me to expose it from the phone itself.

No. The actual card number is used for EMV transactions. It is not hard to read this off the chip.

Makes sense as only your issuing bank can decode the Device Unit Number to your credit card.

The merchant, processing network, or Visa/MC have no idea who the number belongs to. I'm assuming Dividend Dining ties in somehow with MC to pull transactions.

ApplePay 2.0 is supposed to include a rewards program so perhaps in the future this wouldn't be a issue.

Also as a side note ApplePay - it sends two numbers from the phone with each transaction - the Device Number and a one time token. The device number is the same with every transaction and the one time token is used by the bank to verify the transaction is valid.

From what I am seeing the "Device Number" is really nothing more than a separate credit card number that is tied the the main/physical card on the issuer end. I am not completely sure though. From Apples' documentation, it appears that the issuer is able to only allow transactions on that "card" number in conjunction with the one time token. More info from Apple here - http://support.apple.com/kb/HT6323?viewlocale=en_US

Yup - it's generated by your bank (and thus tied to it in their databases) so they are the only ones who knows what credit card number it's tied to. It's a random number so there is no way to decrypt it to figure out your original credit card number.

It's useless by itself unless it has the authenticated token along with it - which only the specific device the device number is tied to can generate. When you make a payment from your phone your device sends the device number and the one time use token to the merchant, who then forwards it on to the processor, who in turn forward it to the issuing bank to verify.

If you're using apple pay - the only way to get your credit card number is to either physically pry it out of your wallet or hack the bank.

Really! Huh. I thought the increased security with EMV was in part through not giving merchants original card number. I guess the dynamic auth number is read *in addition to* original number?

Didn't realize the original number obfuscation was a new thing to Apple Pay over EMV. Neat.

The number never changes (until it expires) and nothing neat is happening.

I can read my generated card numbers off my iPhone 6, including expiry dates. They work like normal numbers (I tested them).

No it isn't. This is false (in the case of Apple Pay).

Alright, so two questions here:

1. How do you read the numbers off your iPhone 6?
2. So if a merchant gets hacked and they manage to steal generated iPhone 6 card numbers, they can still use them? So what makes ApplePay so much more secure?

I'm guessing Patrick used an NFC reader?

Maybe the intention is that if your phone is stolen, you can remotely disable the generated-for-iPhone CC number without having to cancel your original credit card, so it feels less like your phone being stolen is the end of everything. I had assumed the generated-for-iPhone CC number would only be usable via Apple Pay, but Patrick makes it sound like it just works as a normal CC number.

I wonder if a merchant is hacked and Apple Pay CC numbers are compromised if the generated-for-iPhone CC numbers will automatically get cancelled and regenerated for people.

But that'd make exchanges/returns difficult. hrm.

After chatting with Apple Support, the "Device ID" is clearly something that the card issuer generates. So, I contacted AMEX and eventually got to their "Digital Service" support center (800.297.7500). I got a pretty knowledgeable rep and explained that what I needed was the full Device ID number so I could register it with Rewards Network. After several escalations, in the end they said there was no way they were able/willing to release the number. They are not allowed to give it over the phone, were unwilling to use a Secure Message, and of course email would be insecure as well. They weren't willing to come completely clean that the Device ID was basically just another card number. They claimed over and over that even if it were a card number it would never work without the Apple Pay token used in conjunction with it. If I had the ability to see the number it would be interesting to do an online transaction (non Apple Pay) using the Device ID card number and see if it goes through.

In the end I guess it may provide some small sense of security that they are unwilling to give the Device ID out to anyone. However, earlier posts that it is visible using standard NFC terminal make me wonder if it is just a false sense of security.

Interesting! Thank you for sharing the information.

I'm not referring to Apple Pay though - I'm referring to plain vanilla EMV contact transaction. A bank could use tokenisation as well with this, but nobody has really implemented this yet.

If you are able to, you should try to make a purchase with the number online or as a manual entry on a credit card terminal - I'd be interested to see what happens.

What if you put in a missing transaction record to the Dining Rewards Network? Will they be able to research it? Has anyone contacted them about using Apple Pay for payment and receiving rewards?

I posted the following in the Amex forum, which I think is somewhat related to this thread:

http://www.flyertalk.com/forum/ameri...got-offer.html

Was this an offer through Amex? It would make sense if it was as they would know what Apple Pay # is associated with your main credit card #.

Dividend Dining does not.

How Apple Pay Really Works makes it sound like the device account number would not be authorized for payment without the one-time-generated crypto security code.

I have not contacted Rewards Network yet. I am fairly certain that it would result in nothing but a waste of time. Even explaining the situation to AMEX (who supports the system) took quite a while. The Rewards Network system is very likely just not compatible with Apple Pay. Maybe if I get really bored...

EDIT: The other issue for me that would complicate things is that I did 2 transactions back to back for the same amount. They would be extra confused by that.

Yes, the offer was through Amex, the kind that you see announced on their website or via tweets and you register for them.

The interesting part is that the terms of the offer indicated that payment through electronic wallets might not qualify, yet this one at least did.

I don't think we need to explain anything. They know exactly how their system works and will have heard of Apple Pay. Just ask them if restaurant transactions made with registered cards through Apple Pay will be tracked and credited, and if not how you can register your Apple Pay device.

I sent an email to Rewards Network regarding Apple Pay and here was their response (bolding and red font added by me):

My reply was worded differently:

Interesting on their differing replies. In any case it certainly sounds like they are taking a "not our problem" approach to the matter of Apple Pay not working with their program.

If Apple Pay or similar services becomes successful it will be very much their problem because it will undermine this portion of their business model. (They are primarily in the business of lending money to restaurants, this is a way to drive business. There are other ways.) I would not expect them to say much more until they have negotiated a solution, but to begin they may just want to see if there is a measurable falloff.

Not Apple Pay per se, but does Google Wallet send the same card number that's on the Google Wallet debit card? If so, couldn't one get the debit card and sign that up for iDine, etc. and get the rewards that way? You'd have to preload money into your Wallet account but at 2.7% for preloading with a credit card you'd still be ahead if you're at the 5x level.

So I actually scanned my phone recently with cardpeek and definitely got a different card number than the debit card. However, I don't think that card number changes, so it should be possible to register it on iDine and get your rewards. I haven't been able to find a place that's on iDine that supports contactless to test yet though. (And your mileage definitely varies on Apple Pay.)

Since my last post in this thread I switched from Android to the iPhone 6 and have been using Apple Pay at various places. A while ago I scanned my iPhone, got the full Device Account Numbers for my Rewards Network cards and added them to MileagePlus Dining. I totally forgot I had done this until today when I got an email from them asking to rate a place where I used Apple Pay.

So yeah, if you're willing to jump through some hoops Apple Pay will indeed work with the airline dining programs. When I get home I can post some instructions on getting the full DANs for those interested. ^

Would appreciate it very much.

Here you go. Hopefully this helps!

Disclaimer: Like with any other aspect of churning/points earning, this carries risks (known and unknown). I'm not responsible for any adverse action Rewards Network, your FF program or your card issuer may take as a result of following these instructions.

* * *

Part 1: Reading your card number

1. Purchase a USB RFID/NFC reader from Amazon or your favorite store (the one I'm using is
   http://www.amazon.com/OMNIKEY-5321-Smart-Card-Reader/dp/B00737J1H6
   this
   but it appears to be discontinued; other similar ones should work). Install the drivers for it for your operating system.
2. Download a program called cardpeek and install it on your computer. Plug your card reader in and then start the application.
3. It should look something like this; choose the card reader you have plugged in. Say Yes if it asks to download updates.
4. Choose Analyzer->EMV and place the phone over the reader. For Apple Pay you'll need to authenticate with your finger/thumbprint before it will transmit any card info. For the Android solutions it should be enough to unlock your phone's display, but you may have to enter a PIN depending on your settings.
5. If cardpeek asks to send GET PROCESSING OPTIONS, choose Yes.
6. Once it's done scanning, a whole bunch of data will come up. You want to look for something called "Track 2 Equivalent Data". The first 16 digits of it (15 if American Express) is the card number that you're going to add in Part 2 below. The last four digits of that should be equivalent to the Device Account Number shown in Passbook if you use Apple Pay.

Part 2: Adding to Rewards Network

1. Log into your preferred Rewards Network site.
2. Click on the Account Information tab if you're not directed there and then click on "Add a card".
3. Choose the card type and then enter the number you found in Part 1 above.
   
   WARNING for non-Apple Pay users: the card type you selected to use is likely not going to be the same as what's transmitted. This is especially important for Google Wallet users, as it uses a virtual MasterCard even if you have a Visa/AmEx/Discover card added on your phone. General rule of thumb is to check the first digit of the transmitted card number: 4 is generally Visa, 5 is MasterCard, 3 is American Express and 6 is Discover.
   
   
4. Agree to the terms and conditions and push Save. You're all set.

Things to keep in mind

Not everywhere in the US can take NFC right now, not even close. However, this is definitely improving over time.

Also, the numbers transmitted are not guaranteed to stay the same for a significant period of time. I think Google Wallet's changes occasionally but I don't know how often. Apple Pay's should stay the same unless you restore/wipe your phone or otherwise delete and re-add your cards to it, or if you have to report your physical card/phone as lost or stolen. You may want to repeat Part 1 again occasionally and compare the last four digits to what's on the Rewards Network site to make sure nothing changed; RN will not automatically update them.

Thank you, that's a big help. I ordered a reader and have downloaded cardpeek. Will try it out.

Which reader did you order if you don't mind me asking?

I got this dual interface one from . Still waiting for it to be delivered, so can't comment on how well it works.

is this still what has to be done to get Apple Pay to play with rewards dining? Sounds beyond complicated :-/

Actually, you should be able to add your physical card as normal now and it'll pick up any Apple Pay transactions as well.

This is working for me, whether I use the physical card or Apple Pay, I get the dining credits.

I have mostly gotten credit. For a couple with United through ApplePay, I have received the email you get shortly after dining, but the actual miles never posted. Haven't been able to spot a pattern (such as watch card vs. phone card). I also feel like the increasing use of third party platforms like toast to support kiosks and QR code order-at-your-table has made things a little sketchier.