In reply to inthebiz.

"Apple claims that tokens are unique per transaction."

Actually they do not. The security code is per-transaction, but the same token (for each card/phone) is reused for all transactions. I think this is the single biggest and most common misconception. I blame some sloppy wording on the original press release.