Contactless Payments

Contactless payments are in-person payments made by holding a card, phone, watch or other device close to a payment terminal, which reads the payment credential by short-range radio instead of through a chip slot or a magnetic stripe. They are used for everyday purchases in shops, cafés, vending machines and, increasingly, public transport ticket gates.

Card contactless payments run on the same rails as chip payments: the terminal talks to an EMV chip through an antenna, using near field communication (NFC), and the transaction travels through the acquirer and card networks as a normal card present (CP) sale. The term is sometimes stretched to cover QR code payments, which also avoid touching anything but work quite differently. EMVCo writes the contactless specifications; spending limits are set by card schemes, issuers and, in Europe, regulation.

Paying contactless is like using a building pass to open an office door. You hold the card near the reader for a moment, the reader recognises it and the door clicks open; you never have to put the card in a slot or type anything for small amounts.

Behind that quick tap, the card and the reader still have a short private conversation. The card proves it is genuine by producing a one-off code that only works for that purchase, so a nearby eavesdropper gains little. For bigger amounts the system asks for an extra check, such as a PIN or a fingerprint on a phone.

1. The merchant enters the amount and the terminal switches on its radio field.
2. The customer holds the card or device within a few centimetres of the reader.
3. The terminal and the chip select a payment application and exchange data, and the chip generates a cryptogram (a one-time code bound to the amount and transaction).
4. The terminal decides how the customer must be verified: no check for small amounts, a PIN above a limit, or on-device verification for phones and watches.
5. The terminal sends an authorization request to the card issuer, which checks the cryptogram, the account and its risk rules, then approves or declines.

Phone and watch wallets add a layer. Instead of the real primary account number (PAN), the device stores a token issued through network tokenization, and the user unlocks it with a fingerprint, face scan or passcode. That unlock counts as cardholder verification, which is why many issuers allow larger phone payments without a PIN.

Most countries cap how much can be paid by contactless card without a PIN:

• European Union. Under the regulatory technical standards on strong customer authentication (SCA) (Commission Delegated Regulation (EU) 2018/389, Article 11), a contactless card payment can skip SCA only if it is no more than €50 and either the total since the last SCA is no more than €150 or there have been no more than five such payments in a row. Issuers may set lower limits.
• United Kingdom. The single-payment limit rose from £45 to £100 from 15 October 2021, after HM Treasury and the FCA amended the rules; a cumulative limit still triggers a PIN check from time to time.
• Elsewhere. Limits are set by schemes and issuers within local rules, and differ widely between countries.

Phone and watch payments verified on the device are generally not bound by the card limits, since the biometric or passcode check already satisfies SCA.

Contactless card payments use the same chip cryptography as inserted chip payments, so data read from a card cannot be used to create a working clone. Lost or stolen cards remain the main risk, which is what the cumulative limits address. Wallet payments are harder to misuse because the token is locked to the device and needs the owner's unlock. Card data skimmed from the radio interface does not include the card verification value (CVV) printed on the back, which limits its value for online fraud. Remaining concerns include fraud at terminals that accept magnetic stripe fallback and social engineering aimed at getting victims to add their card to a criminal's phone wallet. See payment fraud and fraud prevention.

Transit operators have adopted "open-loop" contactless ticketing, where riders tap an ordinary bank card or phone at the gate instead of buying a separate ticket. Transport for London was an early large-scale example, accepting contactless bank cards on buses from 2012 and on the Underground from 2014, and many cities have followed. These systems often authorise a small amount at the gate and calculate the day's fare later, which differs from a normal shop payment.

Contactless acceptance has also changed how small merchants accept cards. Phones that read contactless cards directly, described under mobile point of sale (mPOS), let a trader take payments with no separate terminal. Contactless now competes with QR-based systems such as India's Unified Payments Interface (UPI) and Brazil's PIX, which reach merchants without card terminals at all.

• EMVCo
• Commission Delegated Regulation (EU) 2018/389
• UK Finance