Most people set up Apple Pay because it is quicker than digging out a wallet. Fair enough. What is less well known is that it is also safer than the plastic card it replaces, and the reason is simple enough to explain at the checkout.
When you tap your phone, the shop never receives your real card number.
What the shop actually gets
When you add a card to the Wallet app, your bank creates a separate number just for that device. Apple calls it a Device Account Number. It lives in a dedicated security chip inside your iPhone or Apple Watch, walled off from the rest of the phone. Apple says it is never stored on Apple's servers and never backed up to iCloud.
When you pay, your phone hands the terminal that device number along with a one-time security code that works for that single transaction. Your real card number is not sent.
Think of it like a cloakroom ticket. The shop is handed a ticket, and only your bank can match the ticket to the coat. If someone steals a box of ticket stubs from the shop, they do not get any coats.
Why that matters
A breach at the shop does not expose your card. Retailers get hacked. When they do, the card numbers they hold are the prize. If you paid by phone, what they hold is a stand-in number that is tied to your device and needs a fresh one-time code for every payment.
Nobody handles your card. There is nothing to photograph, skim or copy down, and no number on show.
A lost phone is safer than a lost card. A lost card can be tapped by whoever finds it until you notice and cancel it. A lost phone needs your face, fingerprint or passcode before it will pay for anything, and you can suspend Apple Pay remotely through Find My without cancelling the card itself.
It works online too. When a website or app offers an Apple Pay button, you can pay without typing your card number into yet another site that will store it.
Not just Apple
Google Wallet and Samsung Wallet on Android phones work on the same principle, swapping your real card number for a stand-in when you tap. The setup looks a little different but the protection is the same idea.
And if you have seen Apple Card mentioned online, that is a separate credit card Apple offers in the United States. It is not available in Australia. Apple Pay is the part that works here, with cards from the major Australian banks.
What it does not protect you from
This is the part worth reading twice.
It does not stop you being talked into a payment. If a fake shop or a scammer convinces you to pay, Apple Pay will send the money exactly as asked. It protects your card number, not your judgement.
It does not stop someone who knows your passcode. Anyone who can unlock your phone can pay with it. Use a passcode longer than four digits and do not share it.
It can be turned against you with one phone call. When a card is added to a phone, the bank sends the cardholder a verification code. A common scam is a caller pretending to be your bank who asks you to read that code out. What they are doing is adding your card to their phone. Your bank will never ring and ask for a code it has just sent you. If someone does, hang up and call the number on the back of your card.
Setting it up
Open the Wallet app on your iPhone, tap the plus button, and follow the prompts from your bank. It takes a couple of minutes. On most recent iPhones you then pay by double clicking the side button, glancing at the screen, and holding the phone near the terminal.
If you think a card or account has already been compromised, work through what to do in the next hour first.
Would you rather have someone set it up with you, along with the rest of your phone's security settings? Our trusted local technicians come to your home or office across Australia. Book a HelloTech technician and we will get it sorted in one visit.
