A phone used to pay at a terminal never transmits the number printed on the card. What it sends is a substitute value that is useless almost everywhere else.
Tokenisation replaces the card number
When a card is added to a wallet, the network issues a device-specific token that stands in for the account number. The token is stored on the phone; the real number is not.
The token maps back to the underlying account only inside the network's systems. A merchant, and anyone intercepting the transaction, sees the substitute.
Because the mapping is held centrally, the same physical card can carry different tokens on a phone, a watch and a laptop, each independently revocable.
The key material sits outside the operating system
Alongside the token, the device holds a cryptographic key used to sign transactions. That key lives in dedicated hardware isolated from the main processor and its software.
Applications cannot read it, and neither can the operating system. They can only ask the secure hardware to perform an operation, and only after the user authenticates.
This is why compromising a phone's software does not straightforwardly yield the payment credential. The attacker would need the key itself, which never leaves the enclave.
Each transaction carries a single-use cryptogram
For every payment, the secure hardware generates a cryptogram over the transaction details using the stored key. The issuer verifies it before approving.
The value is unique to that transaction, so capturing it yields nothing reusable. Replaying it against a different amount or terminal fails verification.
This dynamic element is the substantive difference from a magnetic stripe, where the same static data was sufficient to authorise any subsequent charge.
Losing the phone is a smaller problem than losing the card
A stolen card can be used by anyone holding it. A stolen phone requires the thief to defeat the biometric or passcode before the wallet will sign anything.
The token can also be deactivated remotely without cancelling the underlying card, so the account keeps working on other devices while the lost one is cut off.
The practical result is that the wallet failure mode is narrower and more recoverable than the plastic it replaces, provided the device lock is actually set.
Reissued cards do not always require re-enrolment
When a bank reissues a card after expiry or fraud, the network can update the mapping behind the existing token rather than forcing the customer to add the card again.
The wallet keeps working because it was never storing the number that changed. Only the central mapping needed adjusting.
The same mechanism supports recurring payments stored with merchants, which is why some subscriptions survive a card replacement while others break immediately.