LEARNING HUB / NFC & CONTACTLESS PAYMENTS

How tap to pay works

The card reader antenna supplies energy to the card and supports contactless communication. The payment system then requests authorisation.

View card construction

Card reader = the electronic equipment that communicates with a payment card, usually inside a payment terminal. No real payments or card data are used here.

A FAMILIAR TAP AT THE CHECKOUT

A bank card held over the contactless reading area of a shop terminal displaying £12.00.

Check the amount. Hold your card near the card reader.

HOW THE TAP WORKS / HOW IT CAN BE ABUSED

Card construction

A contactless card contains an antenna and a payment chip.

A contactless payment card contains an electronic chip and an embedded loop of conductive material called an antenna. Protective plastic layers enclose both components.

The visible metal contacts connect the chip to a compatible card reader when the card is inserted. Contactless payments instead use the embedded antenna. The card has no battery; the card reader supplies energy through its changing magnetic field.

Component functions

The plastic layers protect the chip and antenna. The antenna receives energy and supports the contactless exchange. The chip processes payment instructions.

Exploded card showing the plastic layers, hidden antenna and connected chip. — The contactless antenna and payment chip are embedded inside the card’s protective layers. The exposed contact pads support inserted-card operation.

Card reader antenna

The card reader generates a changing magnetic field.

An electronic circuit in the payment terminal supplies alternating current to the card reader antenna. This current generates a changing magnetic field around the copper coil.

The terminal supplies the electrical energy. A compatible payment card positioned close to the card reader antenna receives some of that energy and uses it to power its chip.

Magnetic field

The card reader antenna sits beneath the terminal’s contactless area. The curved lines are a simplified representation of the magnetic field, not separate beams of energy.

Inductive coupling

The card reader supplies energy. The card receives it.

The lower copper coil is the card reader antenna. Alternating current in this coil generates a changing magnetic field around the card reader.

The upper copper coil is the antenna inside the payment card. Changing magnetic flux passing through the area enclosed by that antenna induces a voltage. The card converts the received energy into power for its chip. This process is called inductive coupling.

Card position and alignment

Distance, antenna alignment and nearby materials affect inductive coupling. The antennas do not touch, but the card must receive enough energy to power its chip.

Card antenna above the card reader antenna. Teal arcs originate at the card reader antenna and pass through the card antenna loop, illustrating inductive coupling. — The card reader antenna generates the magnetic field; part of its changing flux induces voltage in the card antenna. Teal arcs are a simplified illustration of the region of coupling, not complete magnetic field lines.

Power conversion

The card converts received energy into power for its chip.

The card antenna supplies an alternating voltage to the chip. A rectifier converts this into a one-direction electrical supply. A voltage regulator keeps the supply at a suitable level for the chip.

With sufficient power, the chip processes commands and transmits responses to the card reader. Insufficient coupling stops the chip from operating, but its stored information remains intact.

Power conversion stages

Rectification converts the alternating input into a one-direction supply. Regulation stabilises the voltage. The chip uses the regulated supply. The waveform comparison shows simplified input and output voltages.

Alternating voltage converted into a steady supply through rectification and regulation. — The diagram illustrates rectification and voltage regulation as functional stages. The waveforms are simplified and do not depict the exact internal chip layout.

Card reader-to-card communication

The card reader transmits information by modulating its signal.

In this NFC-A example, the card reader transmits information by briefly interrupting its 13.56 MHz carrier at precisely controlled intervals. The card detects those interruptions and decodes the transmitted data. Changing a signal to convey information is called modulation.

At 106 kilobits per second, NFC-A communication from the card reader to the card uses 100% amplitude-shift keying and modified Miller encoding. The position of each carrier interruption helps encode the digital bits. Other contactless communication methods use different rules.

Signal timing

The top trace depicts the modulated carrier, the middle trace its amplitude envelope, and the bottom trace the digital bits. The highlighted interval occupies the same time position in all three representations.

NFC-A modulated carrier showing a request transmitted by the card reader to the card. — NFC-A signalling from card reader to card at 106 kbit/s. Carrier cycles, pauses and timing widths are schematic rather than to scale.

Card response to card reader

The card transmits its reply through load modulation.

The card chip controls an electronic switch connected to the card antenna. The switch changes the electrical load presented by the card, affecting the signal measured at the card reader antenna.

These controlled changes carry the card’s response. The process is called load modulation. In this NFC-A example, the response includes subcarrier signalling. The card uses the existing field from the card reader rather than generating a separate, independently powered carrier.

Illustration limits

The waveforms depict two detectable signal conditions. Actual NFC-A card-to-card reader communication includes subcarrier modulation and timing details that are omitted from this simplified diagram.

Card antenna switch changes the load; the card reader detects corresponding signal variations. — The card changes its antenna load and the card reader detects the resulting variation. The traces do not reproduce the full NFC-A subcarrier waveform.

Transaction authentication

The chip generates a security code for the payment.

The payment chip processes transaction information using a protected secret stored inside the chip. This calculation produces a transaction security code called a cryptogram.

The payment system uses the cryptogram during verification. Copying readable information, such as the card number or expiry date, does not reveal the protected secret needed to generate valid new EMV chip cryptograms. However, cryptographic security does not prevent social engineering or the live relay of a genuine card’s responses.

Cryptographic protection

Transaction information and a protected chip secret are used to calculate payment proof. The secret is not transmitted to the card reader. A captured cryptogram is not equivalent to obtaining the protected secret.

Simplified cryptographic calculation using transaction context and a secret key to produce payment proof. — The payment chip calculates transaction-specific cryptographic evidence without transmitting its protected secret.

Payment authorisation

The issuing bank returns an authorisation decision.

For an online authorisation, the payment terminal sends a transaction request through the merchant’s payment provider or acquirer and the card network to the bank that issued the card. The bank’s decision returns through those intermediaries to the terminal.

NFC provides only the short-range connection between the card or phone and the payment terminal. Other networks carry the authorisation request. Authorisation communicates the decision on the transaction; clearing and settlement are separate processes.

Authorisation paths

Solid arrows represent the payment request towards the issuing bank. Dashed arrows represent the decision returning through the card network and acquiring infrastructure. The card does not communicate directly with the bank over NFC.

Two-lane online card payment authorisation diagram. The top row shows request from card to terminal, provider, card network and issuing bank. The bottom row shows the response returning from issuing bank through card network and provider to the terminal. — Online authorisation proceeds through the acquiring infrastructure and card network to the issuing bank; the response returns through these intermediaries. Clearing and settlement are separate.

Mobile wallet security

Apple Pay uses a substitute card number and a security code.

For a standard in-store Apple Pay purchase, the device authenticates the user. The Secure Element provides a device-specific substitute payment number, called a Device Account Number, and a separate transaction-specific security code. The underlying card number is not provided to the merchant.

Tokenisation limits exposure of the underlying card number. A dynamic cryptogram supports authentication of the transaction. Facial and fingerprint biometric data stay on the device rather than being sent to the merchant. Apple Pay Express Mode follows different authentication rules.

Different security functions

The substitute payment number identifies the device’s payment credential. The transaction cryptogram provides dynamic authentication data. Normal device biometric checks authorise local access; biometric data is not sent to the card reader.

Apple Pay example showing device authentication, a payment token and a separate transaction proof sent to a terminal. — Standard in-store Apple Pay payments use a device-specific payment number and a transaction-specific security code. Express Mode follows different device-authentication rules.

WHEN THE SAME TECHNOLOGY IS MISUSED

Three ways the tap can be abused.

Contactless payment attacks target added card reader hardware, weak credential checks or human trust. Each figure identifies the mechanism and its security limitations.

Orange dashed lines: attacker-controlled path · Teal: local NFC or protected mechanism

Tampered tap point

An unauthorised card reader at the tap point.

An additional, unauthorised NFC card reader positioned over or in front of a payment terminal can communicate with a card presented for payment. The added equipment occupies the area where the customer expects to interact with the merchant’s card reader.

The extra card reader can collect data made readable by the card. It does not obtain the chip’s protected payment secret or automatically produce a functional EMV payment clone. PCI SSC documents this equipment arrangement; this figure does not establish how frequently the attack occurs.

Terminal inspection and limits

Unexpected attachments or altered terminals require investigation. Merchants should inspect their payment terminals against equipment records and report suspected tampering to their payment provider. Visual inspection alone cannot detect every alteration.

Contactless payment terminal with an additional unauthorised card reader mounted above the genuine contactless area. — The added card reader collects only information made accessible during the contactless exchange. This does not include the payment chip’s protected secret.

Nearby card reader

Reading card data does not copy protected functions.

A compatible NFC card reader positioned near a card can access information the card permits it to read. A working short-range connection is required; proximity within the same room does not establish an NFC exchange.

EMV bank cards protect the secrets required for new chip cryptograms. Some weak access-control systems instead accept a copyable, fixed badge identifier as sufficient proof of identity. Systems that cryptographically authenticate the badge provide stronger protection.

Access badge authentication

An access-control system that trusts only a static identifier is vulnerable to impersonation using a copied identifier. Stronger systems require cryptographic proof. Bank cards and door-entry badges do not share one universal security model.

Nearby NFC card reader communicating with a bank card and a weakly authenticated access badge as separate examples. — A copied badge identifier only impersonates a credential when the access system accepts that identifier without stronger authentication.

Live relay fraud

A live NFC relay uses the genuine card at another location.

In the documented NGate attacks, criminals deceived victims into installing a malicious Android app and placing their physical bank cards against their phones. The app relayed the card’s NFC responses over the internet to an attacker-controlled device at an ATM.

The original card remained with the victim and participated in a live exchange. The app also collected card PINs in the documented campaigns. This is a live relay attack, not the creation of an independent EMV chip clone; the attack depends on the genuine card and a suitable transaction process.

Fraudulent bank-verification instructions

The documented scheme used a malicious app, the genuine card and the victim’s PIN. Bank customers should reject unsolicited requests to install a verification app, enter a card PIN or place a physical card against a phone. Report such requests to the bank through an independently verified channel.

Documented NGate NFC relay. On the victim side a malicious app and physical card are shown, including separate PIN collection. An orange internet relay bridges to an attacker phone presenting live responses to an ATM. — NGate exploited a malicious Android app, the genuine payment card, live internet relay and PIN collection. The attack did not independently reproduce the payment chip.

CHOOSING HOW TO PAY / UK CONSUMER PROTECTION

Understand the protections behind your payment method.

Credit and debit cards have overlapping protections, but they do not work in exactly the same way. Using a credit card also creates a debt that must be managed.

DEBIT CARD Purchases usually draw funds from your current account. Eligible chargeback disputes and unauthorised-payment rules apply.

CREDIT CARD Purchases use a credit account. Eligible chargebacks and unauthorised-payment protections apply, with additional Section 75 rights for qualifying purchases.

SECTION 75 Normally applies when an eligible item or qualifying set has a cash price above £100 and no more than £30,000, for supplier breach of contract or misrepresentation.

Do not confuse three different routes: unauthorised-payment protection applies to both card types under the relevant rules; chargeback follows card-scheme conditions; Section 75 is an additional legal right for eligible credit-funded purchases.

Section 75 generally tests the cash price of each item, not a basket total. Three separate £50 items do not qualify merely because the basket is £150; paying only a deposit on a qualifying £500 item by credit card can still bring the purchase within scope, provided the other legal conditions are met.

Credit is not automatically the better choice. You must repay what you borrow, and purchase interest or charges depend on the agreement and your repayment behaviour. Paying the full statement balance by its due date generally avoids ordinary purchase interest when the card’s interest-free conditions are met.

Further guidance: FCA: fraudulent payments · Financial Ombudsman: Section 75 · Financial Ombudsman: eligibility examples · MoneyHelper: card protections and chargeback

TAKE IT BACK TO THE CHECKOUT

Pause. Check. Protect.

01 / PAUSE Check the amount and merchant before approving. Do not install a bank “security” app or tap a card on your phone because an unsolicited caller tells you to.

02 / CHECK Inspect suspicious terminal attachments and confirm the result. If something seems wrong, verify the transaction through your banking app or statement.

03 / PROTECT Enable transaction notifications if supported. Freeze lost cards promptly and report payments you do not recognise using an independently verified bank contact.

← Back to Learning Hub

Sources and what the illustrations simplify

These are original educational diagrams, not calibrated field models or recorded signals. Circuit layout, NFC waveforms and timing are simplified. Figure 8 depicts an online authorisation, not final settlement.

Figure 3 uses open teal arcs to illustrate a portion of the changing field created by the card reader antenna. The drawing is a simplified indication of coupling, not complete magnetic field lines; real magnetic field lines form closed loops. Figure 6 omits the detailed subcarrier waveform.

Figure 5 depicts NFC-A card reader-to-card signalling at 106 kbit/s with 100% ASK and modified Miller coding. Carrier cycles and pause widths are not to scale. Figure 4 diagrams functional blocks, not the chip’s exact layout. Payment details and card authentication vary with scheme and transaction type.