You’re at a restaurant, the check arrives and you hold your card (or phone) up to the terminal. Beep, contactless payment done in two seconds, and you’re free to go back to trash-talking the “reimagined” carbonara.
But how does a piece of plastic with no battery move money from your account to the restaurant’s? It’s physics again, just like when Shazam recognizes a song in 3 seconds. Along the way you’ll see what a clothes iron has to do with it, and whether your card or phone is safer.
A contactless payment works over NFC. The terminal creates a magnetic field that powers up the chip in your card. The chip computes a code that’s valid for one payment only, and your bank checks it. With a phone, a stand-in number travels instead of your real one.
Why can a magnetic stripe be copied but a chip can’t?
Take any card and look at it with curious eyes. You’ll find two things, the magnetic stripe (the black strip on the back) and the chip (the little gold square). They’re two completely different technologies, and one of them dates back to the early 1960s. Guess which one.
The stripe is like a business card. It holds the card number, the expiration date and a few technical codes, always the same and in plain text. Read it once and you can copy it. That’s the world of skimming, tiny devices hidden in ATMs, gas pumps or card terminals that copy your card data.
You might not know this, but the magnetic stripe exists thanks to a clothes iron. In the early 1960s, IBM engineer Forrest Parry couldn’t get the stripe to stick to the plastic. His wife, who was ironing at the time, suggested he use the iron to melt it onto the card. It worked.
The chip, on the other hand, is a tiny computer, born with the EMV standard (Europay, Mastercard, Visa). It keeps secret keys that, by design, usually can’t be pulled out. Every time you pay, it computes a cryptogram, a digital signature of that payment that your bank can check in real time.
Think of it as the difference between your house key and the code your bank texts you. The first can be copied at any hardware store, the second expires as soon as you use it. Okay, but in a contactless payment nobody touches the chip. So what turns it on?
How does a card with no battery make a contactless payment?
There’s no battery in your card. The trick is a thin wire running all the way around the edge, the antenna, connected to the chip. Hold the card up to the light and you can see it.
When you bring the card close, the terminal creates a magnetic field that keeps changing, at 13.56 MHz. And when a changing magnetic field passes through a coil of wire, a current appears inside it. That’s electromagnetic induction, which Faraday published almost two centuries ago.
That current is enough to power up the chip. The chip computes its cryptogram and answers by modulating that same field, tweaking it in a way the terminal can read. No batteries, no contacts.
That’s why a contactless payment only works up close. The signal fades fast with distance, and it usually works best within 4 centimeters, about an inch and a half. It’s a limit of physics, but it’s also a safeguard.
Ever wondered how long people have been paying without contact? Since before smartphones, and not with a card. In 1997 Mobil launched Speedpass, a key fob for paying at the pump, which later worked at around 10,000 gas stations.
Now the terminal has the cryptogram. So where does it send it?
What happens after the beep, from the terminal to your bank?
This is where the contactless payment leaves the restaurant and takes a little trip. The terminal sends the request to the merchant’s bank, the one that provided the terminal. That bank passes it to the card network, Visa or Mastercard, which sends it on to your bank. Your bank checks the cryptogram and your balance, then the answer travels all the way back.
All in a couple of seconds, at a huge scale. Visa alone handled 329 billion transactions in a year, more than 10,000 a second on average.
You’re part of it more than you think. In 2024, 291 billion euros were paid by contactless in Italy alone. Spread across its 58.9 million residents, that’s almost €5,000 per person, babies included.
Yet in those two seconds your money doesn’t move. Your bank just holds the amount, taking it out of your available balance. The real transfer comes later, when the merchant settles up and the funds are sent, sometimes a few days later. The beep only means your bank said yes.
So much for the card. When your phone takes its place, though, the terminal gets something very different.
What changes when you make a contactless payment with your phone?
From the outside it looks just like a contactless payment with a card. You hold the phone close and you’re done, because the technology is still NFC. The differences are on the inside.
First, you have to prove it’s you, with your face, your fingerprint or your passcode. It’s the same idea as multi-factor authentication, the second check that stops someone who stole your password.
Then comes the most surprising part. Your phone doesn’t send your card number. When you add the card, your bank creates a stand-in number that only works on that phone, the Device Account Number. The merchant only gets that and a dynamic code, never your actual card number.
On an iPhone, that number lives in a separate chip, the Secure Element, and NFC talks to it directly. Google Pay uses HCE instead, emulating the card in software. But it also sends the merchant a virtual number.
One explanation I came up with is that Google has to run on all kinds of Android phones. Not all of them have that chip. Apple controls all of its devices, the same edge it has on Macs, where it controls both hardware and software. And sure enough, putting a secure chip in every phone was expensive and needed complex partnerships.
What if I told you Google Pay works even without internet? It does, but only for a limited number of payments. Your phone keeps a stash of one-time codes, and once they run out it needs to go online again.
So, in the end, what should you pull out at the register?
Card or phone, which contactless payment is safer?
Let’s try ranking them, starting from the least secure.
- Last place, the magnetic stripe. The data never changes and travels in plain text. Copy it once and you have everything you need to clone the card.
- In the middle, chip and contactless. Whether you insert the card or tap it, there’s always a one-time cryptogram. Between the two there’s no real difference in security.
- First place, the phone. On top of the cryptogram, it adds the stand-in number and your face or fingerprint. Even if someone steals it, it almost never pays without being unlocked.
There’s also a less visible advantage. On an iPhone, your approval reaches the Secure Element without going through the processor that runs your apps. So apps, even ones infected by a virus that copies itself between programs, are kept out of the loop.
That said, if you’ll allow me a little provocation… no technology beats good old cash.
No data to encrypt, no servers, no interception. The most secure method of all has been around for centuries, and it’s right there in our pocket.
Frequently asked questions about contactless payment
Is contactless payment safe?
Yes, a contactless payment is much safer than the magnetic stripe. Every time you pay, the chip creates a one-time code, so anyone who intercepts it can’t reuse it. The weak spot is different. Whoever finds your card can make small purchases without a PIN until you block it.
What’s the limit for a contactless payment without a PIN?
It depends on the country. In Italy, for example, a card asks for a PIN above €50. After a few payments in a row, it can ask for one anyway. With a phone you can go over €50, since you already approve every payment with your face, fingerprint or passcode.
Can someone steal money by holding a terminal near my pocket?
It’s very hard. The reader has to be within a few centimeters, and big amounts need a PIN. Plus, every terminal is tied to a merchant with its own bank account. A phone almost always needs to be unlocked too, which makes it even harder.
So, what about that carbonara?
Back to the restaurant. In those two seconds of contactless payment, the terminal powered up your card with a magnetic field. Then it got a one-time code and asked your bank for permission. Your money, meanwhile, stayed right where it was.
Next time the check arrives, try paying with your phone. The restaurant will get a number that isn’t your card number.
And if you’re wondering how many other doors you leave open without noticing, read who has too much access.
If you’d like to get the next articles too, sign up for the newsletter. I only write when I have something worth sharing.
Byeee.
