Your phone taps the terminal. Your card number stays home.

Wallet tokenization isn't an Apple invention. It's the EMVCo Payment Tokenisation specification, the same rulebook behind network tokens everywhere. The cast: the Token Service Provider (usually Visa VTS / Mastercard MDES) mints and vaults tokens; the Token Requestor (Apple Pay, Google Pay, a merchant, a PSP) gets a registered Token Requestor ID (TRID); every token carries domain restrictions — this token works only from this device, or only at this merchant, or only for e-commerce. Domain restriction is the quietly brilliant part: a Netflix card-on-file token stolen in a breach can't buy anything anywhere else. When you debug why a wallet transaction declined somewhere a card works, token domain controls are suspect number one.

A wallet tap already carries a cryptogram proving device possession and biometric unlock — so does it also need 3DS? Mostly no: under PSD2, a wallet payment with biometric confirmation generally satisfies SCA through delegated authentication (the phone did the two factors: possession + inherence), so in-app and in-store wallet payments usually skip the 3DS challenge entirely. E-commerce wallet buttons ride the same logic — which is why Apple Pay checkout converts better than typed cards in Europe: the SCA friction is pre-paid at Face ID time. For risk teams, wallet transactions arrive with device-level authentication signals cards never had; treat 'wallet vs typed PAN' as a first-class feature in your fraud models.

For a decade, iPhone NFC payments meant Apple Pay — the secure element was Apple's alone, and the ~0.15%-style issuer toll was the rent. EU competition enforcement changed that: Apple's commitments (2024) require free HCE access to the NFC antenna in the EEA, letting banks and wallets tap-to-pay without Apple Pay, choosable as default. The Digital Markets Act keeps the pressure on. Watch what it tests: whether Apple Pay's position was convenience (users stay anyway) or gatekeeping (banks route around the toll). Early European bank wallets are the experiment running live. For issuers everywhere else, the EEA is the free preview of a post-toll world.

A wallet transaction is still a card transaction underneath — chargeback rights and reason codes apply unchanged. What shifts is where fraud can enter. The tap itself is nearly unforgeable (cryptogram + biometric), so wallet fraud concentrated upstream in provisioning: steal card details, add them to your phone, pass the issuer's ID&V, and every subsequent 'secure' tap is the fraudster's. That made issuer provisioning controls (in-app verification instead of SMS OTP) the real battlefield — details in tokenization's field notes. Liability follows the auth data: an issuer that approved provisioning on weak ID&V owns the mess it created, and network rules have tightened accordingly.

Pass-through wallets earn tolls; the other two species earn differently. Staged wallets (PayPal-style) fund from a card once, then move money on their own internal ledger — earning the merchant fee while paying card economics only on the funding leg, and increasingly steering users toward ACH/bank funding to fatten the spread. Stored-value super-apps (Alipay, Paytm, GrabPay) hold balances — which makes them regulated money holders (e-money/PPI licenses, safeguarding rules, sometimes reserve requirements at the central bank) and turns float into a revenue line where permitted. The regulatory gradient is the story: the closer a wallet gets to holding your money, the closer it gets to being a bank — with the compliance bill to match (see the fintech-illusion note in what money is).