Contactless Payment
A contactless payment is a card-present transaction made by holding a card, phone or wearable near a terminal, which exchanges the EMV chip data over near-field communication in under a second without inserting the card or, below a limit, entering a PIN. It made small payments faster than cash, took most of cash's share in the markets that adopted it, and moved the card into the phone — where the wallet's biometric replaced the PIN and the limit disappeared.
- Also known as
- Tap-to-pay (card), NFC payment, Contactless card
- Used at
- shops, transport, vending, hospitality — over 90% of card-present transactions in the UK and much of Europe by 2024; the US caught up after 2020
- Binding
- the schemes' contactless rules and the EMV specifications; limits set nationally (£100 in the UK since 2021, €50 in most of the euro area, with a cumulative limit before a PIN is required); device-based payments with biometric authentication are exempt from the limits
- Typical security
- each tap generates a one-time cryptogram from the chip, so the data captured in transit cannot be replayed; the no-PIN limit is the fraud exposure, managed by cumulative-value and count rules that force a PIN periodically
- Typical fraud
- card-present fraud on contactless is low in absolute terms — a lost card can be tapped for a few payments before the PIN is forced, and the issuer's liability rules and the customer's report handle it; the larger effect was the fall in cash-related crime
- Parties
- the card schemes and EMVCo, issuers (which set limits within the rules), acquirers and terminal vendors, merchants, and the wallet providers whose phones now make most taps
How a contactless payment works in practice
A customer taps a card. The terminal powers the chip through the NFC field, they exchange the EMV data — the card's cryptogram for this transaction, the amount, the terminal's identity — and the terminal sends an authorisation to the acquirer as for any chip transaction, marked contactless. The issuer approves within its rules: below the limit and the cumulative threshold, no PIN; above either, the terminal asks for one. The customer's phone does the same thing with a token in place of the card number and a fingerprint in place of the PIN, which is why phone payments have no limit.
The consequences were larger than the convenience. Cash lost its speed advantage for small purchases and its share fell across Europe; transport networks replaced tickets with taps; the card-present decline rate fell because nobody enters a PIN wrong on a tap; and the phone became the card, with the wallet providers — Apple, Google — sitting between the issuer and the customer and, in Apple's case, charging the issuer for the privilege. For merchants the terminal became a phone too: tap-to-pay on a smartphone, with no dedicated hardware, is the small-merchant product of the 2020s.
For fintech M&A, the contactless era's assets are the terminal fleets, the tap-to-pay software vendors, and the wallet-provisioning platforms that put a fintech's card into a phone on day one.
Example
A coffee chain with 200 shops processes 40,000 transactions a day. Before contactless: 45% cash, 55% card with chip and PIN, an average card transaction of 14 seconds at the terminal. After enabling contactless and accepting phone payments: 12% cash, 88% card, of which 80% is tapped, at 4 seconds — a throughput gain the chain values at one fewer till per shop at peak. Card fees rise with the card share, €280,000 a year; cash-handling costs fall by €420,000; till losses and armoured-car collections fall; fraud on lost cards costs the issuers, not the chain. Its next terminal contract is for phones running tap-to-pay software, at a third of the hardware cost.
Common mistakes
- Merchants refusing contactless for small amounts to avoid card fees, and losing the queue. - Assuming a tapped payment is riskier than a PIN; the cryptogram makes it the same, and the PIN rules bound the exposure. - Terminal fleets bought without NFC in 2015, replaced in 2018. - Ignoring the wallet providers' growing position between the issuer and the cardholder. - Reading the no-PIN limit as a fraud ceiling per card rather than per tap.