Contactless payment uses near-field communication (NFC) at 13.56 MHz to exchange data over a 4 cm range. The card or phone presents a tokenized credential and a one-time EMV cryptogram; the terminal verifies the cryptogram with the issuer in real time. The transaction is as secure as a chip-inserted payment and substantially faster.
The radio standard, cryptographic primitives, and CVM logic behind contactless tap-to-pay.
Process flow
- 1Wake fieldTerminal generates 13.56 MHz field.
- 2Power & handshakeCard or device powers up, exchanges capabilities.
- 3Token + cryptogramCredential returns tokenized PAN and EMV cryptogram.
- 4AuthorizationAcquirer forwards to issuer for real-time verification.
The NFC layer
Contactless terminals and credentials communicate via NFC, an extension of RFID operating at 13.56 MHz. Range is intentionally limited to ~4 cm to prevent ambient eavesdropping. The card or device is powered by the terminal's field - no battery needed for plastic cards.
EMV contactless cryptogram
On tap, the credential signs a transaction-specific cryptogram using a key derived from issuer-shared material. The terminal includes this cryptogram in the authorization request. The issuer verifies it, defeating replay attacks even if the message were intercepted.
Cardholder verification
For low-value transactions (under jurisdiction-specific limits), no CVM is required. Above the limit, the terminal prompts for a PIN, signature, or, in the case of a mobile wallet, on-device biometric. Biometric CVM is treated as a strong verification method by issuers, often raising or removing the no-CVM limit.
Mobile wallet differences
Mobile wallets present a device-bound network token (not the PAN) and require biometric or PIN unlock to release the credential to the secure element. The cryptogram protocol is the same as a plastic contactless card.
Frequently asked
Is contactless less secure than chip-and-PIN?+
No. The cryptogram protocol is the same; mobile wallets add device-bound biometric verification on top.
Can someone steal my card by walking past me?+
Practically no. NFC range is ~4 cm, and even a captured message is single-use because of the cryptogram.
Why is there a tap-to-pay limit?+
Limits balance friction against risk. Above the limit, a CVM (PIN or biometric) is required.
Sources & References
- NFC Forum - NFC Specifications
- EMVCo - EMV Specifications
- Visa - How Contactless Works
- Mastercard - Tokenization
External references are cited for context and discovery. CashlessTechnology.com is not affiliated with the listed organizations unless explicitly stated.