How Apple Pay actually works, and which part Pakistan has to approve

Most explanations of Apple Pay are written by people selling something. Here is the mechanism, plainly, and then the parts that require a Pakistani institution to agree to something.

Adding a card

When you add a card to Apple Wallet, your actual card number — the PAN — is sent to the card scheme and your issuing bank, not stored by Apple. The bank runs an identity check (often an SMS code or an in-app confirmation) and, if satisfied, issues a Device Account Number: a separate number that is tied to that specific phone.

That token is what lives in the Secure Element on your device. The real card number is not on the phone at all.

Paying

At the terminal, the phone transmits the Device Account Number plus a one-time cryptogram — a value computed for that transaction only. The terminal sees what looks like a contactless card tap. The acquirer routes it. The scheme maps the token back to the real PAN. The issuer authorises against the real account.

Two consequences worth understanding:

• The merchant never receives your card number, so a merchant breach cannot leak it.
• The cryptogram is single-use, so a captured transaction cannot be replayed.

This is why tokenised transactions carry materially lower fraud than card-not-present ones, and it is the strongest argument a bank has for paying Apple's fee.

Where Pakistan has to say yes

Four places, and they are the real timeline.

1. The issuer must support tokenisation. The bank has to run token provisioning, the verification step, and the token lifecycle — suspending tokens when a card is replaced, killing them when a phone is lost. That is per-bank engineering work, and it is almost certainly what the reported testing at HBL, Standard Chartered, Bank Alfalah and UBL consists of.

2. The scheme must run a token service for that market. Visa and Mastercard already do this globally. For PayPak, a domestic scheme, a token service either exists or has to be built, and 1LINK operates it. The iOS 27 strings suggest work has been done; they do not tell us that a PayPak token service is live.

3. The regulator must be comfortable. The State Bank of Pakistan sets the rules on what counts as customer authentication, what data can leave the country, and how contactless limits work. Apple Pay's normal argument — that biometric device authentication should permit higher contactless ceilings than a plain tap — is a decision for the regulator and the scheme, not for Apple.

4. Someone has to handle the cryptogram on the acquiring side. This is the quiet one, and it is why EBANX's September 2026 announcement that it has brought Apple Pay decryption in-house while entering Pakistan is more interesting than it sounds. For in-app and web Apple Pay, the payload has to be decrypted by a party with the right keys before it can be processed. Someone in the chain has to do that, competently, for the Pakistani market.

What this means for the timeline

None of these steps is exotic. All of them are slow, because each involves a different institution with different incentives, and several of them cannot start until the commercial terms are agreed.

Which is the reason the gap between "code found in a beta" and "working at the till" is measured in quarters rather than weeks — in India it was measured in years — and why the honest answer to when remains: nobody outside those negotiations knows.

Sources

• Countries and regions that support Apple Pay — Apple Support
• Raast: Pakistan's Instant Payment System — State Bank of Pakistan
• PayPak — 1LINK
• Electronic payments reach 3.7b transactions — The Express Tribune
• Apple Pay launch in India: cards at launch, UPI the big question — Business Standard

Published by FounderDuels. Corrections: [email protected]