Smart Card

A smart card is a pocket-sized card, usually plastic, with an embedded integrated-circuit chip that can store data and, in most designs, process it. The chip in a payment card, a mobile phone SIM, an electronic passport, a transit pass or a corporate access badge is a smart card chip. What makes the card "smart" is that it can keep secrets, such as a cryptographic key, and prove who it is without revealing them, which a printed number or a magnetic stripe cannot.

Smart cards talk to a reader either through gold contact pads on the card's face or by radio, or both. The contact interface is standardised in the ISO/IEC 7816 series, and contactless "proximity" cards in ISO/IEC 14443. In payments, the EMV chip specification maintained by EMVCo builds on ISO/IEC 7816, and it is the reason most card payments worldwide are now made with chip rather than stripe.

A magnetic stripe is like a name tag: anyone who reads it can copy it and make another. A smart card is more like a trusted clerk sealed inside the card. When a shop asks "are you genuine?", the clerk does a quick calculation with a secret that never leaves the card and hands back an answer that only the real card could produce, and that is different every time.

Because the secret stays inside the chip, copying what the card says during one purchase is not enough to make a working clone. That is the basic trick behind chip payment cards, phone SIMs and electronic passports alike.

• Memory cards. Simple chips that store data, sometimes with basic write protection, used for prepaid phone cards and some loyalty and access cards.
• Microprocessor cards. Chips with a processor, operating system, memory and often a cryptographic co-processor, able to run several applications and perform public-key operations; payment, SIM and ID cards are of this type.
• Contact cards. The reader touches the chip's contact plate, as when a card is inserted into a payment terminal.
• Contactless cards. An antenna in the card draws power from the reader's field at 13.56 MHz and exchanges data over a few centimetres; contactless payments and phone-based NFC use this approach.
• Dual-interface cards. One chip reachable through both contacts and antenna, now standard for payment cards in most markets.

The same secure chip, called a secure element, is also built into phones, wearables and hardware wallets, where it protects payment credentials and private keys in the same way.

German engineers Jürgen Dethloff and Helmut Gröttrup filed patents for an identification card carrying an integrated circuit in the late 1960s, and in 1974 the French inventor Roland Moreno patented a secured memory card. France became the early adopter: the French telecoms administration (later France Télécom) introduced chip-based payphone cards in 1983, and French banks then moved their bank cards to chip with a PIN, completing the switch in the early 1990s. The ISO/IEC 7816 standards for contact cards were first published in the late 1980s.

Several waves followed. GSM mobile networks adopted the SIM card in the early 1990s. Europay, Mastercard and Visa developed the EMV specification during the 1990s to replace magnetic stripes with chips, and EMVCo was formed to manage it. Hong Kong's Octopus card, launched on 1 September 1997 using Sony's FeliCa chip, became an early large-scale contactless stored-value card for transit and small purchases, and many city transit systems followed. Governments adopted chips for electronic passports, national ID cards and health cards.

• Payments. Credit, debit and prepaid cards use EMV chips to authenticate the card and generate a one-time cryptogram for each transaction. EMVCo reported that at the end of 2025 more than 15.6 billion EMV chip cards were in circulation and more than 97% of card-present transactions worldwide used EMV chip technology.
• Telecoms. The SIM, and its embedded successor the eSIM, stores the subscriber identity and keys that let a phone join a mobile network; SIM swapping attacks target the operator's processes rather than the chip itself.
• Identity. Passports, national ID cards, driving licences and government employee badges carry chips holding signed personal data and, often, biometric templates, which supports digital identity schemes.
• Transit and closed-loop money. Transit cards and campus or event cards are often closed-loop stored-value products, though many transit systems now also accept open-loop bank cards.
• Access and authentication. Smart cards and USB tokens hold certificates for logging in to computers and signing documents with a digital signature, a common second factor in two-factor authentication.

A smart card's strength comes from keeping keys inside tamper-resistant hardware. Before issue, each card goes through card personalization, which loads its unique keys and data under tightly controlled conditions as part of card issuance. In use, the card can perform authentication with a challenge and response, so a copied record is useless without the key. This is why the move to chip sharply reduced counterfeit card fraud at the point of sale, and why fraud shifted to card-not-present channels and to skimming of the magnetic stripe where it is still read.

Smart cards are not invulnerable. Laboratory attacks can try to extract keys by measuring power use or timing, or by injecting faults, so high-assurance chips are evaluated under schemes such as Common Criteria and must resist those techniques. Weak points also lie outside the chip: fallback to the magnetic stripe, poorly protected terminals, and social engineering of the people who manage the cards.

• EMVCo — EMV Contact Chip