IT lexicon › Security › Push provisioning

Push provisioning

Security På svenska → Updated: 2026-10-31

When the bank's own app drops the card into the phone wallet, instead of the customer typing in the card number.

The classic way to add a card to Apple Pay or Google Pay is to photograph it or key in the digits. The issuer then has to confirm it is really the cardholder, typically with a one-time SMS code, because otherwise a stolen card number turns into a stolen phone wallet. The industry calls that the yellow path. Green means approved on the spot, red means declined.

With push provisioning the flow starts in the banking app, where the customer is already logged in. The app hands encrypted card data to the wallet, which requests a network token from the token service. The login doubles as identity verification, so no code is needed. Apple calls it In-App Provisioning and grants it only to issuers it has specifically approved. A freshly issued card can now be on the phone before the plastic has even been posted.

← Back to the lexicon