A question regarding this - I’ve discovered that using “Express Mode” [0] does allow the transit organization to connect your real credit card to what I assumed was the tokenized DPAN. How is that possible?
Specifically: there’s a transit org (I’ve tried to reach them about this issue, to no avail) that lets you enter your (real, CPAN) credit card number on their public web site and get back your “own” (if it happens to be your card…) transit history i.e. the times when you tapped your iPhone/Android on their NFC/tap enabled turnstiles.
So, they /do/ seem to have a way to either get the CPAN when the card is tapped, or maybe they can tokenize the CPAN in the same way as the phone and then compare the tokens…?
I thought that could not be possible but it 100% works. To me it’s a huge security problem. But again, I have not heard back from them at all.
Specifically: there’s a transit org (I’ve tried to reach them about this issue, to no avail) that lets you enter your (real, CPAN) credit card number on their public web site and get back your “own” (if it happens to be your card…) transit history i.e. the times when you tapped your iPhone/Android on their NFC/tap enabled turnstiles.
So, they /do/ seem to have a way to either get the CPAN when the card is tapped, or maybe they can tokenize the CPAN in the same way as the phone and then compare the tokens…?
I thought that could not be possible but it 100% works. To me it’s a huge security problem. But again, I have not heard back from them at all.
Do you understand how they do it? Thanks
[0] https://support.apple.com/en-us/HT212171