然后我就开始研究，检查了一下我的 Apple ID。我看了下基本只有我的 iPad、个人 Mac、Apple Watch、iPhone 添加了 Apple Card，这三个设备今天一直在我手里。然后我的 Apple ID 还是由三个 YubiKey 作为两步认证，这三个 Yubikey 也都在我手里，最近也没有异常登录。我后来还是改了 Apple ID 密码，登出了其他所有设备。其他设备在重新登录时还需要用 YubiKey。
再去看卡号，发现 5XXX 这个卡号正是我手里 iPhone 的 Apple Pay 的四位尾号，完整的卡号我都不知道是多少。这个也不是 Virtual Card number 的尾号。经检查，发现 iPad、Mac、Apple Watch 的 Apple Pay 尾号也都是不一样的，符合预期。此时我立刻在 iPhone 上删除了 Apple Card，然后重新添加了 Apple Card，发现新添加的 Apple Card 的 Apple Pay 尾号也变成了全新的了。高盛客服也说现在 5XXX 这张卡已经关了。这个线索，意味着这个交易理论上是在我手里的 iPhone 上发生的。
卡号被盗：不太可能，这个交易的 5XXX 尾号是我 iPhone 中的 Apple Pay 卡号，除非 Apple Pay 有漏洞，不然不会有除了 Apple 和高盛外的人知道这个卡的完整卡号。我都无法知道这张卡的完整卡号
有 POS 机贴着我 iPhone 把钱刷走了：难度较大。我收到通知的时候我正在看 Youtube，至少肯定不是那个时候被刷走的。不排除是很久以前有这种事情发生（我是没印象），然后扣款推迟到了现在，不过这个需要刷的时候不经意扫成功了 Face ID，因此我觉得这个可能性较低。如果是 Apple Watch 上的 Apple Pay 尾号这种可能性还大一点，因为不需要 Face ID。
Apple Pay 被复制：不太可能。Apple Pay 线下付款只能是 NFC，我不觉得技术上能被复制。Apple Pay 线上付款最起码也用了一些加密协议，我也觉得技术上也不能复制。
After your card is approved, your bank, your bank’s authorized service provider, or your card issuer creates a device-specific Device Account Number, encrypts it, and sends it along with other data (such as the key used to generate dynamic security codes that are unique to each transaction) to Apple. The Device Account Number can’t be decrypted by Apple but is stored in the Secure Element — an industry-standard, certified chip designed to store your payment information safely — on your device. Unlike with usual credit or debit card numbers, the card issuer can prevent its use on a magnetic stripe card, over the phone, or on websites. The Device Account Number in the Secure Element is isolated from iOS, watchOS, macOS, and visionOS, is never stored on Apple servers, and is never backed up to iCloud.
是否阻止这个卡号在 Apple Pay 外的场景使用取决于 Card issuer（in this case 高盛）
不过如果 Apple Card 都能出 Apple Pay 的乌龙那属实有点搞笑了
不过还有一段：
When you use Apple Pay in stores
After you authenticate your transaction, the Secure Element provides your Device Account Number and a transaction-specific dynamic security code to the store’s point of sale terminal along with additional information needed to complete the transaction. Again, neither Apple nor your device sends your actual payment card number. Before they approve the payment, your bank, card issuer, or payment network can verify your payment information by checking the dynamic security code to make sure that it’s unique and tied to your device.
When you use Apple Pay within apps or on the web
To securely transmit your payment information when you pay in apps or on the web, Apple Pay receives your encrypted transaction and re-encrypts it with a developer-specific key before the transaction information is sent to the developer or payment processor. This key helps ensure that only the app or the website that you’re purchasing from can access your encrypted payment information. Websites must verify their domain every time they offer Apple Pay as a payment option. Like with in-store payments, Apple sends your Device Account Number to the app or website along with the transaction-specific dynamic security code. Neither Apple nor your device sends your actual payment card number to the app.
所以商家侧是可以知道 device-specific Device Account Number 的。那这样的话 Apple Pay 存在被盗刷的可能的？
