The app generates a single use credit card number/expiry date/security code to use for a purchase. Once you have used it, the combination is cancelled. It’s so that even if someone steals the card details from the website you’ve used it on (not sure if they work physically via your phone’s wallet and in any case I don’t believe that your phone shares the card details with the merchant) they are useless to the thief.