It is not possible for ApplePay's (in-app or physical POS) mobile wallet to even have the real PAN. An EMVCo based token is provisioned into the secure element and that is all the phone sees. So, i am not sure how they claim that they got to see the real PAN data. I am assuming that they are getting confused because they probably witnessed the real cardholder Name and Expiration date. Now, that is possible. It depends on the Token Service Provider's implementation. They may most probably choose to use the real cardholder name and the same expiration date (mm/yy). In fact, the token's last 4 digits could also be the same as the real card's last 4 digits so that merchant accounting/chargebacks are easier to process.

The more complex part is to understand the one-time key, dynamic CVV etc that happens during the physical POS transaction. Take a look at http://www.gmarwaha.com/blog/2014/09/24/apple-pay-an-attempt-to-demystify/ and http://clover-developers.blogspot.com/2014/09/apple-pay.html for some more details.