Near field communication (NFC) is a short-range wireless standard that lets two devices exchange data within about four centimetres of each other. A reader generates a 13.56 MHz magnetic field, and a card or phone inside it draws power by induction and replies by modulating the signal. Defined in ISO/IEC 18092 and, for contactless cards, ISO/IEC 14443, it carries payment messages using the same EMV logic as chip, with a one-time cryptogram per transaction. Phones hold a device-specific network token rather than the card number. Under PSD2, single taps up to €50 are SCA-exempt until cumulative spend reaches €150 or five consecutive taps. Taps carry card-present pricing and fraud rates.
How NFC works at the radio level
NFC grew out of RFID and is defined in ISO/IEC 18092 and, for contactless cards, ISO/IEC 14443. It supports data rates of 106, 212 and 424 kbit/s, which is plenty for a payment message of a few hundred bytes.
There are two modes:
- Passive: the card has no battery. The reader's field powers the chip, which answers by load modulation. Every contactless bank card works this way.
- Active: both devices generate their own field, as when two phones exchange data.
The short range is deliberate. Reading a card from across a room would need much larger antennas and power, and the few-centimetre distance makes unnoticed reads difficult. The NFC Forum, founded in 2004 by Nokia, Philips and Sony, maintains the interoperability specifications.
What is NFC payment
An NFC payment is a contactless payment made by tapping a card, phone or wearable on a terminal. Behind the tap runs the same EMV logic as a chip insert: the card or phone produces a one-time cryptogram from the amount, date, a terminal random number and a transaction counter. A copied message cannot be reused because the next transaction needs a new cryptogram.
Cards vs phones
A contactless card holds the real card number on its chip. A phone wallet holds a device-specific network token instead, stored either in a secure element chip (Apple Pay's approach since 2014) or protected in software through Host Card Emulation, which Android added in 2013. The phone also verifies the cardholder by fingerprint, face or passcode, which counts as a consumer device cardholder verification method and often lifts contactless value limits.
Apple opened the iPhone's NFC chip to third-party payment apps, starting in the EEA in 2024, which allows banks to offer their own tap-to-pay wallets.
Limits and SCA rules
Most countries cap card taps without a PIN. Under PSD2 rules on strong customer authentication, a single contactless transaction up to €50 is exempt, but after cumulative spend of €150 or five consecutive taps the card must ask for a PIN. The UK set its own contactless limit at £100 in 2021.
Why merchants and acquirers care
NFC taps take a few seconds, cutting queue times compared with chip and PIN. They are card-present, so they carry card-present pricing and fraud rates. Merchants still using terminals without NFC lose customers who carry only a phone, and SoftPOS apps now turn any NFC-enabled Android phone or iPhone into an acceptance device.