VIEW THIS AS

Auto mode follows the Route Engine until you choose a viewpoint.

YOU ARE HERE

ROUTE CHECK

CONNECTED TO

WHAT NEXT

Use the canonical route for this room, or HELP if you are unsure.

How Contactless Payments Work | NFC, Tokens, Cards and Mobile Wallet Security

Contactless payments let a compatible card, phone or wearable communicate with a payment terminal over a very short distance, commonly using near-field communication, or NFC. The terminal then sends payment information through the financial network for authorisation.

The key distinction is between the radio tap and the financial transaction. NFC exchanges data locally; the merchant’s processor, payment network and issuing bank handle authorisation and settlement. Mobile wallets may use tokenisation, but security details differ by scheme and device.

Quick summary: the reader detects a card or device; NFC exchanges payment information; cryptographic controls may authenticate the transaction; the issuer approves or declines; and the merchant receives the result.

How a tap begins

A contactless terminal generates a short-range electromagnetic field. A compatible card or device responds using an agreed protocol.

Short range reduces some accidental interactions but does not guarantee that every transaction is safe. Always check the merchant and amount.

NFC versus Bluetooth

NFC is designed for very short-range interactions, while Bluetooth supports different device connections over generally longer distances.

A phone may have both technologies, but ordinary tap-to-pay does not work by pairing with the terminal as if it were headphones.

What happens after the tap

The terminal sends payment data through the merchant’s acquiring service and the payment network. The issuer evaluates the request and returns an approval or decline.

Authorisation and final settlement are different stages. A pending transaction can appear before the final posting.

What tokenisation means

Some mobile wallets replace the original card number with a payment token associated with the device or payment context.

Tokenisation reduces exposure of the underlying card details in some circumstances but does not eliminate fraud or account compromise.

Why cryptographic checks matter

Modern contactless schemes can use transaction-specific cryptographic data to help verify that payment information was generated through a legitimate process.

Exact mechanisms differ. Security relies on the full payment system, not merely on transmitting a static card number.

Phone authentication

Mobile wallets may require device unlocking, biometric verification or other checks before a payment, depending on the platform and transaction.

Biometric recognition often unlocks access to a stored credential. It is not equivalent to sending your fingerprint to the merchant.

Physical cards and mobile wallets

A contactless card uses a chip and antenna. A phone wallet uses supported hardware and software to present payment credentials.

Both can be convenient, but their authentication, token and lost-device controls vary. Check issuer and wallet guidance.

Why a payment fails

A terminal may not support the card, a phone may be locked, the account may be restricted or another verification method may be required.

If the terminal reports failure but the app shows a pending charge, verify the transaction before immediately paying again.

What happens during an outage

The ordinary authorisation route can be unavailable when payment infrastructure or connectivity fails. Some systems support limited offline behaviour under specific rules.

A successful radio exchange does not prove the financial transaction was completed. Look for merchant confirmation.

Security habits

Protect the device with a secure lock, enable payment alerts where available and use official wallet applications.

Report lost cards or devices promptly using verified issuer channels. Never approve an unexpected payment because a caller claims it is a security test.

Contactless versus QR payments

QR payments commonly use a camera to decode payment-related information. NFC payments use short-range radio and a compatible terminal.

Both are cashless but use different technical paths. Check the merchant and amount before approval.

A Singapore shopping example

A shopper taps a phone at a supermarket terminal. The wallet supplies a supported credential, the terminal routes the request and the issuer approves it.

The terminal displays success. If the banking app and terminal disagree, ask the merchant to verify the transaction before repeating the payment.

Frequently asked questions

Does NFC require internet on the phone? Some wallets can perform certain transactions without active phone data, but provisioning and system rules vary. Is a mobile wallet always safer than a card? Protection depends on implementation.

Does tapping transfer money instantly? Authorisation and settlement are separate. What if my phone is stolen? Use official lost-device and issuer controls.

The mental model

Follow the route: card or phone → NFC terminal → acquirer → payment network → issuer → merchant response.

The tap is only the first handoff. Trustworthy payments depend on compatible technology, secure account controls and checking the transaction.

Sources and further reading

EMVCo Contactless

EMVCo Payment Tokenisation

eduKateSG QR Codes