How does tap to pay work?

What happens inside a single tap

A contactless reader is always emitting a small radio field at 13.56 MHz, the frequency the NFC Forum sets for NFC. When a card or phone enters that field, the field induces enough current to wake the chip. A passive contactless card carries no battery, so this borrowed power is the only reason it can respond at all.

Once the chip is awake, the reader and the card run a short conversation defined by the EMV contactless standard. The card proves it is genuine, the reader states the amount, and the card returns a cryptogram, a one time value computed from a secret key that only the card and the bank hold. The reader cannot read the key and neither can anyone listening nearby. It only relays what the card produced.

Because the exchange is a few centimetres wide and lasts a moment, there is no time to line anything up or key anything in. Presence at the reader, plus the tap gesture, is the entire instruction the customer gives.

NFC and EMV, the two standards behind the tap

Two standards do two different jobs, and confusing them is the most common mistake people make about tap to pay. NFC, governed by the NFC Forum, is the radio. It defines how two devices talk when they are within a few centimetres, and nothing about money. EMV, governed by EMVCo, is the payment protocol. It defines the cryptogram, the keys, and the rules a card and reader follow to authorize a charge.

A contactless card payment is EMV riding on top of NFC. The NFC layer carries the bytes; the EMV layer decides what those bytes mean and whether the transaction is valid. Separating the transport from the payment logic is why the same NFC radio in a phone can also read a transit pass or a smart tag that has nothing to do with EMV.

Why a tap does not expose your card number

The security of tap to pay rests on the fact that the real card number is never the thing being transmitted. In its place the card sends a cryptogram that is valid for one transaction and useless afterward. Intercepting it, if that were even practical over a few centimetres, would capture a value that has already expired.

Phone wallets add a second layer. During setup the wallet stores a device specific token instead of the card number, a scheme EMVCo calls tokenization. So even the token in the phone is not your account number, and it can be revoked without reissuing the card. The result is that a contactless payment reveals less than handing a cashier the physical card.

Tap, chip, and swipe compared

The three ways to present a card differ mostly in what data leaves the card and how much a bystander could learn. The older magnetic stripe carries static data that is the same on every use. Chip and contactless both replace that with a fresh cryptogram, so a captured transaction cannot be replayed.

Tapping a phone versus a card

A phone tap runs on the same NFC radio and EMV rules as a card, with two additions. The phone holds a token rather than the card number, and it asks for a fingerprint or a face check before it will release a cryptogram. Apple Pay and Google Wallet are the familiar examples, though the NFC transport and the EMV tokenization underneath them are open standards, not the property of any one wallet.

That biometric step is why a lost phone is not a lost card. The wallet will not authorize a tap without the owner present, and the stored token can be switched off remotely. The card in your pocket has no such gate, which is one reason phone taps are often treated as the stronger of the two.

Where proximity payment goes beyond the tap

A tap is elegant, but it still asks the customer to find a terminal and hold a device to it within a few centimetres. That is fine at a fixed counter and awkward everywhere else, such as a line of cars at a curb or a market with many sellers. The limiting assumption is that there is one reader, in one place, and the customer aims at it.

Parousya's patented proximity method removes that assumption. Instead of a tap, the provider broadcasts a short range signal, and the patent US10657515B2 covers how the customer's phone detects it, identifies the nearest provider, and routes the payment through a central server rather than a terminal. The two devices never connect directly, so there is nothing to pair and no reader to reach. NFC is still welcome as one of the radios the method can sense, alongside Bluetooth, ultra wideband, and WiFi Direct, but the payment no longer depends on the tap.

The divisional patent US11392923B2 extends this to identification without a payment, so a provider and a customer can be matched by presence alone before any money is discussed. Where tap to pay ends at the terminal, the proximity method begins at the moment the customer is simply near the right provider.