Apple wallet Compromised

I’m happy to explain.

Your account numbers are stored on your iPhone or in your Wallet app. When you submit your card information in Apple Wallet it’s encrypted and sent to Apple Servers. All data and photo, if used, are deleted off your iPhone. Apple servers send the encrypted data to your bank and possibly the Payment Network Operator (Visa, Mastercard, etc.) and you and your data are verified. The bank encrypts the data again using their own encryption and sends it to the TSP (Token Service Provider) who decrypts the data and produces a dynamic token. The token is then encrypted and sent to Apple Servers. Apple servers then bind the token to the secure element in your iPhone.

The Secure Element has never been hacked. Not even in theory. It’s a SOC (System on a Chip) that is separate from the processor, memory and all other elements of the iPhone. It runs an entirely different OS and meets ISO standards approved by banks etc. Again, never been hacked.

The token contains a dynamic account number generator that creates a unique account number for every transaction with a merchant. The only thing each number has in common is the last 4 numbers, which you can see in the Card details in your Apple Wallet app.

The merchant does not receive your name, decrypted account number, expiration date or CVV2 number. If the merchant were hacked, there’s no useful data.

But who has the data? Your bank and you and also anyplace you inserted your chip or swiped your cards. All it takes is a skimmer in a transaction terminal or ATM.

So, please explain how a chip that’s never been hacked got hacked, encrypted data was taken, decrypted and matched to your expiration date and CVV2 number.