Mobile Payment

A mobile payment is a payment that is initiated, authorised or received using a mobile phone or another portable device such as a smartwatch. The term covers a wide range of arrangements: tapping a phone on a card terminal, scanning a merchant's code, paying inside an app, sending money to a friend's phone number, or moving a balance by text menu on a basic handset. What they share is that the phone replaces the plastic card, the cash or the bank branch as the means of giving the instruction.

Mobile payment is a description of the channel, not a single payment system. Behind the screen, the money moves over existing rails: card networks, bank transfer systems or the ledger of a wallet provider. The term is broader than mobile wallet, which is one kind of app used for the purpose, and is distinct from mobile banking, which is access to a bank account's full services from a phone.

• Contactless at a terminal. The phone carries a digital version of a payment card and communicates with the terminal by near-field communication. To the merchant it is a form of contactless payments, processed like a card.
• QR code payments. The customer scans the merchant's code, or the merchant scans a code shown on the customer's phone. A QR payment needs only a camera and a printed code, which makes it cheap for small traders.
• In-app and online payments. The customer pays inside a shopping, transport or food delivery app using a stored card or wallet, approving with a fingerprint or face scan.
• Transfers between people. Person-to-person apps send money to a phone number or alias, drawing on a bank account, card or stored balance.
• Mobile money. Mobile money services hold a balance tied to the phone number and work by text menus on any handset, with cash deposited and withdrawn through agents.
• Carrier billing. Small digital purchases are charged to the customer's phone bill or prepaid credit.

A related development puts the phone on the merchant's side: with tap to pay software, an ordinary smartphone accepts contactless cards without a separate terminal.

When a card is added to a phone wallet, the real card number is not stored on the device. Under network tokenization the card network issues a substitute number, a token, that is tied to that device. The token and the keys used with it are protected either in a secure element, a tamper-resistant chip in the phone, or by software on the phone backed by the wallet provider's servers.

At the terminal, the user unlocks the phone with biometric authentication or a passcode. The phone sends the token and a one-time cryptogram to the terminal, and the transaction travels to the acquirer and card network as usual. The network converts the token back to the real card number and forwards the request to the issuer, which approves or declines. The merchant never sees the true card number, and the cryptogram cannot be reused.

Not all mobile payments ride on cards. In India, the Unified Payments Interface lets any participating app move money instantly between bank accounts, using an alias or QR code to identify the payee. Brazil's Pix and similar instant payment systems elsewhere work on the same principle, and their growth has made phone-initiated bank transfers a mainstream way to pay merchants.

In China, Alipay and WeChat Pay built mobile payments around QR codes and balances held on their own platforms, funded from linked bank accounts. In much of sub-Saharan Africa, mobile money run by telecom operators fills the role, including for people with no bank account. In North America and Europe, card-based phone wallets dominate in shops, alongside bank-backed apps for transfers between people.

Mobile payments remove some risks of physical cards and add others. Tokenization and device authentication mean that a stolen phone is of little use to a thief and that data intercepted from one payment cannot be replayed, so fraud rates on payments made with an already-enrolled device are low. Because the user is verified on the device, many markets allow mobile contactless payments above the limit that applies to contactless cards.

The weak point is enrolment. A criminal who has stolen card details may try to add the card to their own phone, and if the issuer's verification at that step is poor, the fraudster obtains a fully working payment device. Other threats are malware, phishing for the codes used during enrolment, takeover of the phone number, and scams in which the genuine user is tricked into sending money, which is a particular problem for instant transfers that cannot be recalled.

The payment itself is governed by the rules of the underlying rail and by the law that applies to the provider holding the funds, whether a bank, a card issuer or an e-money institution. Wallet apps that merely pass card credentials are often treated as technical service providers, though regulators have begun to examine large technology firms' role more closely. Access to the phone's contactless hardware has been a competition question: following a European Commission investigation, Apple agreed in 2024 to open the iPhone's contactless function to rival wallets in the European Economic Area.