How is that wrong? That is exactly how it works. The merchant stores a token in the database that only they can use . If they then need to issue a refund later, they use that token that they have stored, and not your card number, to issue the refund. That token is only usable by them and no one else. If someone where to breach their database, they would get this token and not your card number.

Yes your card number is still on chip. Yes your card number is sent to the bank when it first authorizes the transaction. However, your card number is never stored in a database that belongs to that merchant or the payment provider they use. I never said the card number wasn't on the chip. The question was how do chips prevent fraud, this is the number one way they do it.

Think about the data breaches that occurred at Target or Home Depot a while back. If all cards used were chip cards, all the hackers would have were a bunch of useless, randomly generated numbers, not actual credit card numbers.

Google credit card tokenization. There are a plethora of results that detail this process.