Wallets on your phone

Mobile wallets replace physical plastic by storing hardware-secured cryptographic tokens. Understand how this process shields your identity and what consumer safeguards apply.

How tokenization actually works

When you digitize your credit or debit card into Apple Pay, Google Wallet, or Samsung Pay, the wallet provider does not store your real 16-digit Primary Account Number (PAN) on the device or its cloud servers.

Instead, your card issuer creates a distinct Device Account Number (token) via the payment network's Token Service Provider (TSP). This token is embedded inside a tamper-resistant hardware element in your handset (such as the Secure Element or StrongBox keymaster).

Biometric approval vs. Card PIN

Physical contactless cards typically mandate a PIN entry after a specific cumulative threshold (e.g. £100 or 150 EUR under European Strong Customer Authentication standards). Because digital wallets verify your presence via Face ID, fingerprint, or device passcode prior to transmission, these transaction limits are frequently elevated or removed altogether.

This creates frictionless convenience at transit gates and grocery registers, but places the entire security burden upon your phone's screen lock credentials. Never share your primary mobile device passcode with acquaintances if your payment cards are loaded.

Do you preserve chargeback protection?

A common myth is that paying via an Apple or Google wallet converts your payment into an unprotected peer-to-peer transfer. In reality, because the wallet is simply a cryptographic pass-through for your underlying debit or credit card, you retain all standard Visa, Mastercard, or American Express chargeback privileges.

If you experience non-delivery or fraud on a phone-wallet transaction, your claim proceeds through your issuing bank in the identical manner as a physical plastic transaction.

What to do if your smartphone is misplaced

1. Use remote management tools (such as Apple Find My or Google Find My Device) to lock or remotely wipe the handset.
2. Put the device into Lost Mode, which instantly suspends the device token at the network token registry without requiring you to cancel your underlying physical plastic card.
3. Call your issuing bank to advise them to deactivate the specific mobile token linked to that handset.