Apple Pay is finally here
Apple Pay has finally landed in India. It went live at the end of September 2026, and for now it only works with Axis Bank’s Visa and Mastercard credit cards. No UPI, no RuPay.
If you pay for your chai by scanning a QR code, like most of us, you probably won’t switch anytime soon. But if you’re studying engineering, Apple Pay is worth a closer look anyway. Behind that quick tap sits a clever mix of hardware security, cryptography and distributed systems.
Three chips, three jobs
Three components inside your iPhone share the work.
The Secure Element is a separate, certified chip that stores your payment credential. It runs the Java Card platform and has passed EMVCo and Common Criteria security evaluations.
The Secure Enclave checks your face, fingerprint or passcode and decides whether the payment can go ahead.
The NFC controller runs the short-range radio link between the Secure Element and the shop’s card machine.
Why split things up like this? Isolation. Your card credential lives on its own chip, and the signal from your double-click goes straight to the Secure Enclave without passing through the main processor.
Your real card number stays off the phone
When you add a card to Apple Wallet, your 16-digit card number isn’t saved on the phone at all.
Instead, your bank creates a stand-in number called a Device Account Number, or DAN. Think of it as a nickname for your card that only your bank and the card network can trace back. It’s stored encrypted inside the Secure Element. Apple can’t decrypt it, and it never gets backed up to iCloud.
The bank can even lock this token so it won’t work on a magnetic stripe, over a phone call or on a website. The shopkeeper never sees your real card number.
This fits neatly with RBI’s rules. RBI has allowed device-based tokenisation since January 2019, and only card issuers and card networks may store actual card data.
What happens when you tap
You double-click the side button and glance at your phone. The Secure Enclave confirms it’s you and sends a signed approval to the Secure Element. The two chips talk over an encrypted channel, set up using Elliptic Curve Diffie-Hellman (ECDH) key agreement with keys installed at the factory.
Next, the Secure Element creates a payment cryptogram. This is a one-time code calculated from a transaction counter and a secret key. The token and the cryptogram travel over NFC to the card machine, then on through the card network to your bank, which checks the code before saying yes.
an in-store Apple Pay tap · six steps from Face ID to approval
Since the counter goes up with every payment, a code copied from one purchase can’t simply be reused for the next.
Why this isn’t UPI
Apple Pay rides on the old card rails: the shop’s terminal, the merchant’s bank, the card network, then your bank. It’s the same route your plastic credit card takes, just with a token in place of the real number. It also needs an NFC card machine, so you won’t be able to use it everywhere on day one.
UPI, built by NPCI, moves money straight from one bank account to another in real time. You usually scan a QR code, and one app can reach several bank accounts. Adding UPI to Apple Pay would need a separate approval from NPCI and a sponsor bank, so don’t expect it overnight.
What you can learn from it
If this got you curious, here are five topics worth digging into:
- Tokenization, and how a stand-in value can protect sensitive data end to end.
- Elliptic-curve cryptography and ECDH, the maths behind that chip-to-chip handshake.
- Secure hardware: secure elements, trusted execution and certifications like Common Criteria.
- NFC and EMV contactless, the radio link and the standards card machines speak.
- Payment system design: issuers, acquirers and networks, and how UPI does things differently.
PayU, Razorpay, Pine Labs and Paytm have already added Apple Pay to their payment gateways. Gateways like these, plus banks and fintech startups, need engineers who understand these layers. It doesn’t matter much whether you’re in CSE, ECE or mechanical. Security thinking travels well.
So the next time someone taps their iPhone at a Croma or a Chaayos, you’ll know what’s going on: a quiet, well-guarded conversation between three chips, a card network and a bank.
