You hold your card near the terminal, hear the beep, and walk away. The whole thing took under two seconds — no swiping, no inserting, no typing your card number anywhere.
It feels almost too easy, which is exactly why people ask: what actually happened in that second? And more importantly: is it safe? The answer involves short-range radio waves, a clever trick called tokenisation, and a one-time secret code that self-destructs after every single tap.
NFC: radio that only reaches a few centimetres
Tap-to-pay runs on NFC (Near Field Communication) — a short-range wireless standard that lets two devices talk when held very close together. Two key facts define it:
- It operates at 13.56 MHz over radio waves
- It only works within about 4 centimetres — you practically have to touch the terminal
That tiny range is deliberate, not a limitation. Because the signal cannot travel across a room, it is extremely hard to intercept from a distance — there is no "drive-by skimming" from across the shop. Your card or phone stays asleep until the terminal's radio field wakes up its chip, which is why you never get charged by accident walking past a reader.
NFC is one of several invisible wireless technologies in your pocket — like Bluetooth, it is a short-range radio, but it is designed for instant, ultra-close connections rather than ongoing links between devices.
Tokenisation: your card number never travels
Here is the most important thing to understand: your real card number is never transmitted during a tap.
When you add a card to Apple Pay, Google Pay, or Samsung Pay — or use a contactless card — your device does not store or send the primary account number (PAN), the 16-digit number on your card. Instead, a process called tokenisation replaces it:
- When you enrol the card, your bank's token service issues a unique payment token — a random substitute number tied to your device and card
- The real card number is locked away in the bank's secure vault; the token is all your device ever knows
- At the terminal, your device sends the token, never the real number
Each tap also generates a dynamic cryptogram — a one-time security code, similar to the CVV on the back of your card, except it changes with every single transaction. Even if someone captured the data from one tap, they could not reuse it for another purchase. The token means nothing without the matching cryptogram, and the cryptogram dies the moment it is used.
This is fundamentally different from a magnetic stripe swipe, where the same static data is read every time and can be copied by a skimmer. With tap-to-pay, every transaction is cryptographically unique.
The second-by-second journey of a tap
So what happens in that blink between the tap and the beep? Here is the full chain:
- You tap. The terminal emits an NFC radio field. Your card's chip powers up from the field (or your phone's NFC chip activates — which is why phones must be unlocked, usually with a fingerprint or face scan, and why you do not need an internet connection for the tap itself)
- The handshake. The terminal and your device confirm they are ready and agree on the payment details
- Token plus cryptogram. Your device generates the token and a fresh one-time cryptogram inside its secure chip — the secure element — where card data is protected from the rest of the phone
- Routing. The terminal sends the token to the payment processor, which forwards it to the card network (Visa, Mastercard, and others)
- Authorisation. The card network maps the token back to your real account, your issuing bank verifies the cryptogram and checks your balance, then approves or declines
- The beep. The decision races back through the network and your terminal flashes a checkmark
All of this — device to bank and back — completes in about one to two seconds.
Chip vs tap vs swipe: how they compare
| Method | Speed | What is transmitted | Security |
|---|---|---|---|
| Magnetic stripe swipe | Slow | The same static card data every time | Weakest — data can be copied and reused |
| Chip insert (EMV) | Slowest | Encrypted data, new code per transaction | Strong — very hard to clone |
| Tap-to-pay (NFC) | Fastest (~1–2 sec) | One-time token + one-time cryptogram | Strong — real card number never travels, code cannot be reused |
Tap-to-pay essentially matches chip-insert security while being dramatically faster. That is why it has become the default at checkouts worldwide.
Limits, PINs and your phone
Small tap payments are designed to skip the PIN — but the exact limit depends on where you are:
- In Pakistan, the State Bank has allowed banks to waive the PIN for card transactions, including contactless ones, of up to PKR 3,000; each bank sets its own exact limit within that ceiling
- Larger tap payments simply ask for your PIN as usual, just like an inserted chip
- Phone wallets often skip the limit — because you already proved it is you with a fingerprint or face scan (called consumer device cardholder verification), the terminal trusts the tap for larger amounts too
That per-transaction cap is also your built-in safety net: if someone grabbed your contactless card, they could only make small individual payments — and the moment you report the card, your bank blocks it and you are protected from liability for misuse of the facility.
For more on protecting your accounts generally, our cybersecurity basics guide covers the habits that matter most.
When tapping is actually the safer choice
It surprises people, but tapping is often safer than the alternatives:
- Safer than swiping — the stripe carries static data a skimmer can copy; a tap carries a one-time code that dies after use
- Safer than typing your number online — nothing you can retype or have stolen from a form is ever transmitted
- Safer than handing over your card — the card never leaves your hand, so nobody can photograph both sides of it
- No name or address travels — the tap carries only the token, the cryptogram and basic transaction details; your identity stays on your device
Contactless codes, like QR codes, are having a second life in payments — but where a QR code is something you scan, NFC is something your device negotiates, with cryptography baked into every exchange.
Takeaway checklist
- NFC works at 13.56 MHz and only within ~4 cm — the tiny range is a security feature, not a flaw
- Your real card number never leaves your device — tokenisation sends a substitute number instead
- Every tap uses a one-time cryptogram — captured data cannot be replayed for another purchase
- The full round trip takes about 1–2 seconds — terminal, processor, card network, issuing bank, and back
- No internet needed for the tap itself — your phone or card talks to the terminal directly over radio
- Unlock your phone with biometrics before tapping — that unlock often lets wallets approve amounts above the no-PIN card limit
- In Pakistan, banks may waive the PIN for contactless taps up to PKR 3,000 — above that, enter your PIN like a chip payment
- Tapping beats swiping on security — static stripe data can be cloned; one-time tokens cannot
