Near field communication (NFC) is a short-range wireless technology that lets two devices exchange small amounts of data when they are held a few centimetres apart. It works at a radio frequency of 13.56 MHz, and one side (a reader) can power the other (a card or tag) through its radio field, so a payment card needs no battery. NFC is the technology behind contactless payments by card, phone and watch, as well as transit cards, building passes, electronic passports and smart labels.
NFC grew out of earlier radio-frequency identification (RFID) and contactless smart card standards, chiefly ISO/IEC 14443 for proximity cards and ISO/IEC 18092 for device-to-device communication. The NFC Forum, an industry association founded in 2004, publishes specifications and certification programmes so that phones and readers from different makers work together. In payments, EMVCo defines how the card application runs over that radio link.
NFC in plain terms
NFC is like two people whispering when they stand right next to each other. Because the conversation only works at a very short distance, both sides have to be deliberately brought together, which is why you "tap" a card or phone rather than waving it from across the room.
The reader is also a bit like a torch that powers a solar calculator. When the card enters the reader's field, the energy in that field wakes up the card's tiny chip just long enough for it to answer. Pull the card away and it goes back to sleep.
How NFC works
An NFC reader creates a magnetic field at 13.56 MHz through a coil antenna. A passive card or tag that comes close draws power from that field by induction and replies by subtly changing the load on the field. Data rates are modest (106, 212 or 424 kbit/s) because transactions involve only a few hundred bytes. The useful range is short, typically a few centimetres; NFC Forum test specifications use distances of a few millimetres to a few centimetres. That short range is a design choice that reduces accidental reads and makes the user's tap an act of consent.
NFC devices operate in three modes:
- Card emulation. A phone or watch behaves like a contactless card, which is how a phone-based digital wallet pays at a payment terminal or other point of sale (POS).
- Reader/writer. The device reads or writes a card or tag, which is how a phone can act as a terminal in mobile point of sale (mPOS) or read a passport chip during identity verification (IDV).
- Peer-to-peer. Two powered devices exchange data, a mode based on ISO/IEC 18092 that is now little used for payments.
NFC in payments
For a card payment, NFC is only the transport. The security comes from the EMV chip application running over it: the card produces a one-time cryptogram for each transaction, which the card issuer checks, so copied data cannot be replayed. Phones add network tokenization, storing a device-specific token instead of the real card number, and require a fingerprint, face scan or passcode to release it.
Phones protect payment credentials in one of two ways. A secure element is a tamper-resistant chip inside the device that stores keys and runs the payment application, the approach Apple has used for Apple Pay. Host card emulation (HCE), introduced in Android 4.4 in 2013, lets an app emulate a card in software, with credentials protected by tokens and frequent refresh from the cloud. Apple long kept the iPhone's NFC payment function to its own wallet; from iOS 18.1 in late 2024 it began letting approved third-party apps use the NFC and secure element for in-store payments in several countries, after pressure from the European Commission under EU competition and digital-markets rules.
Security considerations
The short range limits but does not eliminate risks. Researchers have shown "relay" attacks, in which two devices forward the radio conversation over a longer link, and eavesdropping is possible with specialised antennas at slightly longer distances. In card payments these attacks are contained by transaction cryptograms, contactless spending limits, the issuer's fraud detection and, for phones, on-device biometric authentication. Card data read over NFC omits the card verification value (CVV), so it is of limited use for online fraud. Users can protect themselves by reporting lost cards at once and by never adding cards to a wallet at a stranger's request, a known social engineering pattern.
Other uses of NFC
- Transit. Closed-loop transit cards, which work like closed payment networks (such as FeliCa-based cards in Japan), and open-loop tapping with bank cards both run over NFC.
- Access and identity. Office badges, hotel keys and the chips in electronic passports use the same family of standards.
- Tags and labels. Cheap NFC stickers on posters or products open a web page or app when tapped, much like a QR code but without a camera.