If you have ever stood at a customer service desk trying to return a pair of shoes you bought with your phone you probably noticed something strange. The cashier looks at your receipt and asks for the last four digits of your card. You pull out your physical Visa or Mastercard but the numbers do not match. You look at your phone, and the numbers there do not match either. It feels like a glitch in the matrix. You paid for the item, but the store seems to think a different card was used. This is the beauty and the complexity of the mobile payment "ghost card." In our last discussion, we looked at how Apple Pay and Google Pay hide your real card during the purchase. Now it is time to look at the reverse journey. How does a merchant send money back to a card they never actually saw in the first place? The Receipt Identity Crisis When you use a digital wallet the merchant is technically blind. They do not have your name and they definitely do not have your 16-digit credit card number. Instead, they have a Device Account Number or a Token. Device Account Number Token When the store prints your receipt, they print the last four digits of that virtual alias. This is why your physical card number is useless at the return counter. To the store, that physical card is a total stranger. To get your money back, you have to provide the "return address" that was used during the original transaction. On an iPhone, you can find this by opening your Wallet and tapping the Card Number section. There, you will see the Apple Pay Number which is the only identity the merchant knows. Card Number Apple Pay Number The Reverse Token Path The refund process is essentially a mirror of the payment process. Instead of your phone telling the bank to give the merchant money the merchant tells the bank to give you money. Here is how the data flows in reverse: The merchant identifies the original transaction using the Transaction ID or the DAN.They initiate a "Credit" or "Refund" request.This request goes to the payment processor but instead of a real card it uses the Token.The payment network (like Visa or Mastercard) sees that token and looks it up in their secure vault.The vault maps the token back to your real account.The bank receives the signal and drops the funds back into your balance. The merchant identifies the original transaction using the Transaction ID or the DAN. Transaction ID DAN They initiate a "Credit" or "Refund" request. This request goes to the payment processor but instead of a real card it uses the Token. Token The payment network (like Visa or Mastercard) sees that token and looks it up in their secure vault. The vault maps the token back to your real account. real account The bank receives the signal and drops the funds back into your balance. The merchant still never learns who you are. They are simply "replying" to a digital envelope that only the bank and the card network can open. Why You Sometimes Have to Tap Again You might wonder why some stores require you to tap your phone a second time to get a refund while others can just "send it back" automatically. This usually comes down to how the merchant handles their internal security. Many retailers want to verify that the person getting the refund is the same person who made the purchase. By asking you to tap your phone again, they are forcing your device to generate a fresh cryptographic signature. cryptographic signature This proves that you still have possession of the Secure Enclave (on iPhone) or the authenticated Google account. It prevents someone from stealing a discarded receipt and trying to "return" an item to their own card. It is a second layer of defense that keeps the ghost card system honest. The Latency of the Ghost Because there are so many layers of "translation" between the merchant token and your real bank account, refunds often take longer than the original payment. While a payment is authorized in milliseconds, a refund has to travel through the merchant processor and the card network vault before it finally reaches your bank. This is why you often see a three to ten-day waiting period. The ghost card has to find its way home through a series of secure tunnels. three to ten-day Privacy Stays Intact The coolest part of this entire system is that the privacy loop never breaks. Whether you are spending money or getting it back, your real financial identity is never exposed to the person behind the counter. You are protected by a digital bodyguard that handles the introductions and the goodbyes without ever giving away your secret.

Walkthroughs, tutorials, guides, and tips. This story will teach you how to do something new or how to do something better.

This story contains new, firsthand information uncovered by the writer.

The writer is smart, but don't just like, take their word for it. #DoYourOwnResearch before making any investment decisions or decisions regarding your health or security. (Do not regard any of this content as professional investment advice, or health advice)

The Mystery of the Ghost Refund: How Apple and Google Send Money Back to a Card They Never Saw

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

Building An Automated Video Silence Removal App

02/03/2018: Biggest Stories in the Cryptosphere

04/05/2018: Biggest Stories in the Cryptosphere

103 Stories To Learn About Banking

The Noonification: Contagion (10/7/2022)

12/07/2018: Biggest Stories in the Cryptosphere

Building An Automated Video Silence Removal App

02/03/2018: Biggest Stories in the Cryptosphere

04/05/2018: Biggest Stories in the Cryptosphere

103 Stories To Learn About Banking

The Noonification: Contagion (10/7/2022)

12/07/2018: Biggest Stories in the Cryptosphere

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps