G2244

Although pieces of this were being discussed in another thread, I decided it might help to have a specific one just in relation to Rewards Network.

With Apple Pay being released in the US, the question arises about how well it works (or does not work) with various rewards based schemes. I am interested what happens when using Apple Pay at a Merchant that is in the Rewards Network. Rather than wait around I decided to run a little test.

Contrary to what Apple seems to say, Apple Pay appears to work at any merchant that has NFC available at their registers. In fact there is a handy little iPhone App called MasterCard Nearby that you can look up which merchants in a particular area offer NFC for payment. I loaded that, cross checked my MileagePlan Dining app, then looked for something inexpensive - boom, Jack In The Box.

The - Test
I placed 2 separate orders (don't worry they were inexpensive single item orders); one using ApplePay, the other swiping the card.

The Result
The ApplePay/NFC transaction was not picked up by Rewards Network. And as expected, the swiped card transaction was and I received my miles.

Note that when using Apple Pay, it basically assigns a unique ID to the credit card and ties it to the phone. So in this case the receipt for the Apple Pay transaction notes the card number as something like xxxxxxxxx1234. However the transaction with the swipe notes the actual physical card number xxxxxxxxx5678 (for example). The issue is that Rewards Network only has my physical card registered xxxxxxxxx5678. So the test is trying to determine if when using ApplePay will I miss out on my Rewards Network miles.

julianm

Isn't this the same as how EMV works? The merchant gets a one-time number for that and therefore wouldn't know your original card number either.

G2244

I have updated the original post with the test results and unfortunately the Apple Pay transaction was not picked up/visible for Rewards Network. The implication is that when using Apple Pay you are not likely to get miles (on Rewards Network).

The transaction at Jack in The Box (who is not an official Apple Pay merchant but does offer NFC payment at the location for my test) shows up on my statement the same for both transactions. However a different transaction at an official Apple Pay merchant (Panera Bread) shows up on the statement as "AplPay PANERA BREAD" - indicating that those transactions may be distinguished as such for other purposes. Apparently Apple is planning its own reward scheme of some kind for Apple Pay in the future - just a rumor at this point.

In addition, I also noticed that on the receipts for both Apple Pay transactions I have completed, the card number shown on the paper receipt is the same. That indicates there is a card number assigned behind the scenes and may be the same over time across all Apple Pay/NFC transactions.

Within Apple Pay (Passbook App actually) on my iPhone it shows a "Device Number" associated with the card. The full number is masked so it shows up like **** 12345 (for example). And the last 4 digits match with what shows up on the paper receipt when using Apple Pay. All this leads me to believe that if I could get the full "Device Number" I could very likely just register that with Rewards Network and get points/miles on Apple Pay transactions. However I am not sure if Apple or the card company (AMEX in this case) would be willing to give me that full Device Number. I am not seeing a way for me to expose it from the phone itself.

D582

No. The actual card number is used for EMV transactions. It is not hard to read this off the chip.

GoodOmens

Makes sense as only your issuing bank can decode the Device Unit Number to your credit card.

The merchant, processing network, or Visa/MC have no idea who the number belongs to. I'm assuming Dividend Dining ties in somehow with MC to pull transactions.

ApplePay 2.0 is supposed to include a rewards program so perhaps in the future this wouldn't be a issue.

Also as a side note ApplePay - it sends two numbers from the phone with each transaction - the Device Number and a one time token. The device number is the same with every transaction and the one time token is used by the bank to verify the transaction is valid.

G2244

From what I am seeing the "Device Number" is really nothing more than a separate credit card number that is tied the the main/physical card on the issuer end. I am not completely sure though. From Apples' documentation, it appears that the issuer is able to only allow transactions on that "card" number in conjunction with the one time token. More info from Apple here - http://support.apple.com/kb/HT6323?viewlocale=en_US

GoodOmens

Yup - it's generated by your bank (and thus tied to it in their databases) so they are the only ones who knows what credit card number it's tied to. It's a random number so there is no way to decrypt it to figure out your original credit card number.

It's useless by itself unless it has the authenticated token along with it - which only the specific device the device number is tied to can generate. When you make a payment from your phone your device sends the device number and the one time use token to the merchant, who then forwards it on to the processor, who in turn forward it to the issuing bank to verify.

If you're using apple pay - the only way to get your credit card number is to either physically pry it out of your wallet or hack the bank.

julianm

Really! Huh. I thought the increased security with EMV was in part through not giving merchants original card number. I guess the dynamic auth number is read *in addition to* original number?

Didn't realize the original number obfuscation was a new thing to Apple Pay over EMV. Neat.

patrick.barnes

The number never changes (until it expires) and nothing neat is happening.

I can read my generated card numbers off my iPhone 6, including expiry dates. They work like normal numbers (I tested them).

patrick.barnes

No it isn't. This is false (in the case of Apple Pay).

t325

Alright, so two questions here:

1. How do you read the numbers off your iPhone 6?
2. So if a merchant gets hacked and they manage to steal generated iPhone 6 card numbers, they can still use them? So what makes ApplePay so much more secure?

julianm

I'm guessing Patrick used an NFC reader?

Maybe the intention is that if your phone is stolen, you can remotely disable the generated-for-iPhone CC number without having to cancel your original credit card, so it feels less like your phone being stolen is the end of everything. I had assumed the generated-for-iPhone CC number would only be usable via Apple Pay, but Patrick makes it sound like it just works as a normal CC number.

I wonder if a merchant is hacked and Apple Pay CC numbers are compromised if the generated-for-iPhone CC numbers will automatically get cancelled and regenerated for people.

But that'd make exchanges/returns difficult. hrm.

G2244

After chatting with Apple Support, the "Device ID" is clearly something that the card issuer generates. So, I contacted AMEX and eventually got to their "Digital Service" support center (800.297.7500). I got a pretty knowledgeable rep and explained that what I needed was the full Device ID number so I could register it with Rewards Network. After several escalations, in the end they said there was no way they were able/willing to release the number. They are not allowed to give it over the phone, were unwilling to use a Secure Message, and of course email would be insecure as well. They weren't willing to come completely clean that the Device ID was basically just another card number. They claimed over and over that even if it were a card number it would never work without the Apple Pay token used in conjunction with it. If I had the ability to see the number it would be interesting to do an online transaction (non Apple Pay) using the Device ID card number and see if it goes through.

In the end I guess it may provide some small sense of security that they are unwilling to give the Device ID out to anyone. However, earlier posts that it is visible using standard NFC terminal make me wonder if it is just a false sense of security.

royiguren

Interesting! Thank you for sharing the information.

D582

I'm not referring to Apple Pay though - I'm referring to plain vanilla EMV contact transaction. A bank could use tokenisation as well with this, but nobody has really implemented this yet.