Contactless Card

A contactless card is a credit, debit or prepaid card that can make a payment when held within a few centimetres of a reader. The card contains a chip connected to a thin wire antenna laminated inside the plastic. When it comes near a terminal, the terminal's radio field powers the chip, and the two exchange the data needed for the payment in a fraction of a second. Cards with this capability carry a symbol of four curved lines.

Almost all contactless cards are dual-interface, meaning that the same EMV chip can be used either by inserting the card or by tapping it. The technology is the card-based form of contactless payments, a category that also includes phones and watches. Paying this way is commonly called tap to pay.

Contactless cards use short-range radio communication based on the ISO/IEC 14443 standard for proximity cards, the same family of technology as near-field communication. The card has no battery. The terminal emits a field at a fixed radio frequency, the antenna in the card draws power from it, and the chip wakes and responds. The effective range is deliberately short, typically up to about four centimetres.

The payment application on the chip follows contactless specifications built on the EMV standard, which are managed by EMVCo. For each transaction the chip produces a unique cryptogram using keys that never leave the card, and the issuer checks that cryptogram during authorization. Because the value changes every time, data captured from one tap cannot be replayed to make another payment, which is the main security advantage over the magnetic stripe.

A tap by itself proves that the card is present but not that the person holding it is the owner. Schemes and regulators therefore set a contactless transaction limit, the amount up to which no further check is needed. Above it, the terminal applies a cardholder verification method, normally a PIN, or asks for the card to be inserted.

Limits vary by country and have risen over time, with many raised during 2020 to reduce contact with keypads. In the European Union, the rules on strong customer authentication exempt contactless payments up to 50 euros, provided that the cardholder is asked for a PIN once the cumulative value since the last check reaches 150 euros or after five consecutive taps. The United Kingdom raised its limit to 100 pounds in October 2021, and since March 2026 its regulator has allowed card issuers to set limits themselves, though most kept 100 pounds at first. In the United States, contactless transactions on credit cards generally need no PIN at any amount, subject to the merchant's and issuer's own rules.

Some issuers let customers set a lower limit or switch off contactless entirely through card controls.

Contactless cards were introduced by the international card schemes in the mid-2000s, initially for small purchases where speed mattered, such as coffee shops and convenience stores. Uptake depended on merchants replacing terminals, and it came first in countries that were already moving to chip cards, including the United Kingdom, Australia, Canada and much of Europe. The United States adopted the technology later, after its migration to chip cards in the second half of the 2010s.

Public transport gave contactless a strong push. Transport for London began accepting bank cards directly at ticket gates on buses in 2012 and across the Underground and rail network in 2014, so that passengers no longer needed a separate fare card. Many cities have since adopted the same open-loop approach, in which the fare is calculated after travel and charged to the card.

Three risks are commonly raised.

• Lost or stolen cards. A thief can make purchases below the limit until the card is blocked. The cumulative counters described above cap the loss, and cardholders are generally not liable for unauthorized transactions once reported.
• Eavesdropping and skimming. A reader brought close to a card can obtain the card number and expiry date, but not the cardholder's PIN or the security code printed on the back, and it cannot generate valid cryptograms for later use. Fraud of this kind has been rare in practice compared with other forms of card skimming.
• Relay attacks. Researchers have shown that the conversation between a card and a terminal can be relayed over a distance using two devices. Newer specifications add timing checks intended to detect this.

A contactless card can be read by any payment terminal with a contactless reader, by unattended devices such as vending machines and parking meters, and by ordinary smartphones running SoftPOS software, which lets a merchant accept taps without dedicated hardware. Where a terminal is offline, the chip can in some configurations approve low-value payments by itself, within risk limits set by the issuer.

An NFC payment from a phone uses the same terminal interface as a contactless card but differs in two respects. The phone presents a token in place of the real card number, and the holder is verified on the device by fingerprint, face or passcode, so the transaction counts as authenticated and is usually not subject to the contactless limit. Cards remain important as the fallback when a phone is unavailable and as the credential from which wallet tokens are created.

• EMVCo: EMV Contactless Chip