Here are the steps of provisioning a card for addition to Apple Wallet and Apple Pay.
- Check Card Eligibility — card issuer checks that card exists and is an active account in good standing.
- Decision Making process — card issuer forwards information to Token Service Provider (TSP) which may be the Payment Network Operator (Visa, Mastercard etc.) or a third party provider such as MeaWallet
- Using information provided by Apple and issuer, risk assessment is one of 4 paths.
A) Green path — approved without any additional verification
B) Yellow path — the requires additional verification and verification of consumer information
C) Orange path — this is unique to Apple Pay and represent high potential for fraud and requires a call to a call center
D) Red path — this is a decline. Information presented indicated significant risk.
Red path authentication has several rules.
- As a part of Apple’s requirements when provisioning via ApplePay, issuers are required to ensure that provisioning attempts are declined when authentication attempts using CVV2 have exceeded five within 24 hours. After this limit has been reached, provisioning will be declined for 24 hours and then rejected via red flow. This rule applies to all wallet providers and all networks.
- Any device score of 1 must be Red path
- When certain risk codes appear together, the issuer must decline. These codes include Apple ID too new, Apple ID too new relative to how new request for provisioning, recent changes to account data, suspicious transactions, no activity in a period of time, suspended card from another account added to Apple Pay, device was recently in >lost mode<, too many attempts within 24 hours, too may attempts within 72 hours, too many cards provisioned within a period of time, no issues (too many characters or special characters), provisioning attempt in wrong location, issues with phone number provided.
“To help identify and prevent fraud, information about how you use your device, including the approximate number of phone calls or emails you send and receive, will be used to compute a device trust score when you attempt a purchase. The submissions are designed so Apple cannot learn the real values on your device. The scores are stored for a fixed time on our servers.“ Legal - App Store & Privacy - Apple
This results in scores being specific to a device, not an individual. Cards can be added to other devices, but the specific device (your iPhone) presents significant risk. Other anonymous information may also be factored into the device score. Apple does not reveal how long the information will remain a risk or how long the information is stored on Apple servers. Estimates from data points indicate at least 30 days.
Your case is unusual in several respects. Most banks are not as forthcoming in regard to information about your account. Your banker representing that several weeks may need to pass. This falls inline with the possible 30 days that devices scores may be held.