[Apple Pay] "Tokenization removes the actual credit card number and replaces it with a randomly generated number. That number, or token, can be configured to expire after one purchase or made specific to a certain transaction, making it a useless target for hackers or fraudsters.

But what's more, tokenization removes a huge storage burden from merchants, since they never see a person's actual credit card information and it never enters their POS system or online payment portal.

Now, Apple didn't invent tokenization. But by taking the tokenization route, the Cupertino powerhouse could be looking to ride the security wave all the way to payment success, especially considering the rising number of merchant data breaches and instances of stolen credit card information that continue to hit the payment and retail industries."

If you think about it, until chip-and-pin is required in the US, there's not really more security for card-present transactions in the US. Anything they read from the card when they swipe and use to validate the transaction could be intercepted, saved, and written to another card.

So it's all arbitrary. Sometimes they ask for your zip code, so they get a better rate. Sometimes (often) they ask for the csc online, so they get a better rate. I guess the statistics work out, but from a technical security point of view, it all seems not really secure.

One difference between these parameters and those provisioned to a physical ICC on a new debit/credit card, is that the card number (PAN) is not used; instead a payment token is used (it looks like a PAN - it has the same number of digits, etc). This allows Apple Pay transactions to run on the same infrastructure as chip+pin/signature transactions.