How Tap to Pay Works and Why It's Safer Than Swiping

Tapping a card or phone at checkout takes about a second, and most of us never think about what happens in that second. Some people avoid it entirely because they worry a thief with a hidden reader could “steal their card through the air”. Others assume tapping must be less secure than inserting a chip, because it’s so easy.

Both worries are mostly misplaced. Tap to pay is one of the more secure ways to pay in person, and it is clearly safer than swiping a magnetic stripe. Here’s how it works in plain English, what actually gets sent when you tap and the few real risks worth knowing.

What happens in the second you tap

Tap to pay, also called contactless payment, uses near-field communication (NFC). NFC is a type of short-range radio that lets 2 devices exchange small amounts of data when they’re very close together.

Here’s the sequence when you tap a card at a store:

1. The merchant starts the transaction. The terminal turns on its contactless field only when the cashier or self-checkout requests a payment.
2. The terminal powers your card. A contactless card has no battery. The reader’s radio field powers the tiny chip and antenna inside the card for a fraction of a second.
3. Your card sends payment data. This includes your account number, expiration date and a one-time security code generated for that transaction.
4. The network checks the code. The terminal passes the data through the payment network to your card issuer, which verifies the one-time code and approves or declines the purchase.

Visa says a card or device must be tapped or held within about 2 inches of the terminal, and that contactless terminals communicate with only one card at a time. That short range is part of the security design.

The one-time code: why stolen tap data is hard to use

The magnetic stripe on the back of your card stores the same static data every time. If someone copies it with a skimmer, they can write it onto a blank card and use it again and again.

Chip and contactless payments work differently. EMVCo, the industry body that manages the EMV chip standards, explains that the chip uses cryptography to generate a one-time code, called a cryptogram, for each transaction. That code is unique and can’t be reused. Visa makes the same point: because a new code is created for every contactless purchase, skimmed data is difficult to use for fraudulent purchases.

Key takeaway: A tap shares data that is only good for one transaction. A swipe shares data that works until the card is replaced. That single difference is why tapping beats swiping for in-person security.

Tokenization: how phone and watch wallets hide your card number

When you tap with a phone or smartwatch, there’s an extra layer called tokenization. A token is a substitute card number that stands in for your real one.

• Apple Pay: Apple says your card issuer creates a Device Account Number that’s stored in a dedicated security chip, the Secure Element. Apple doesn’t store your original card number, and merchants receive the Device Account Number and a one-time code, not your actual card number.
• Google Wallet: Google says eligible cards get a virtual card number when you add them for in-store payments, so stores don’t see your actual card number.

If a merchant that only ever saw your token gets breached, the attackers don’t get your real card number. And if your phone is lost, you can suspend or remove the token without canceling your physical card. We compare the 2 big wallets in detail in Apple Pay vs Google Pay.

Tap vs chip vs swipe: how they compare

Phone wallets come out ahead because they combine the one-time code, a token and your phone’s biometric or passcode check.

Common myths about tap to pay

Myth: someone can walk past and steal my card wirelessly

The short range makes this hard in practice. A reader has to be within a couple of inches, and the data it could pull from a card includes the one-time code that can’t be replayed. Researchers have shown lab attacks on contactless systems, but turning them into real-world theft is difficult, and card networks add fraud monitoring on top. A phone wallet adds another barrier, because most wallets require you to unlock or authenticate before a payment is sent.

Myth: I need an RFID-blocking wallet

You can buy one if it gives you peace of mind, but it addresses a small risk. A much larger, well-documented threat is skimmers hidden in card slots at gas pumps and ATMs, which tapping helps you avoid. Our guide on how to spot a card skimmer shows what to look for.

Myth: anyone who finds my card can tap it without limits

A lost contactless card can be misused for some purchases, just like a lost card could be swiped. That’s why you should lock it in your bank app immediately. Federal rules also limit your liability for unauthorized charges when you report them promptly. Our banking app security settings checklist explains card locks and alerts.

Myth: tap to pay costs me extra

Shoppers don’t pay a separate fee for tapping. Merchants pay processing fees on card transactions however the card is presented. If you run a business, our explainer on credit card processing fees covers how those work.

The real risks worth knowing

Tap to pay is secure, but it isn’t magic. The genuine risks are mostly about people, not radio waves.

• Phone theft while unlocked. If a thief grabs your phone while it’s unlocked, they may be able to access more than your wallet. Use a strong passcode and your phone’s theft protection features.
• Double-tapping or charge errors. Occasionally a terminal charges twice or charges the wrong card in your wallet. Check alerts after you tap.
• Card held too close to another reader. Hold only the card you want to use near the terminal, especially if you keep several in a phone case.
• Express transit modes. Some wallets let you pay for transit without unlocking your phone. That’s convenient, but it’s worth knowing which cards are set up that way.
• Scams that trick you into paying. No payment method protects you from willingly paying a scammer.

Where to start: setting up tap to pay safely

1. Check your card. Look for the contactless symbol, 4 curved lines, on the front. If it’s missing, ask your issuer for a replacement.
2. Set up a phone wallet. Add your card to Apple Wallet on iPhone or Google Wallet on Android, and verify it with your bank.
3. Make sure NFC is on. On Android, check your connection settings. iPhones handle it automatically.
4. Use a strong screen lock. Wallets require a passcode, and biometrics make it fast.
5. Turn on transaction alerts in your bank app so you see every tap.
6. Learn your wallet’s lost-phone steps before you need them, such as Lost Mode on iPhone or remote erase on Android.

Which phone you carry affects which wallet you’ll use, so if you’re choosing a new device, see our iPhone vs Android comparison. Business owners who want to accept taps, including on a phone, should also read up on PCI DSS compliance.

Conclusion

Tap to pay works by sending a small packet of data over a very short-range radio link, protected by a one-time code that’s useless after the purchase. Phone and watch wallets add a token that keeps your real card number away from merchants, plus a biometric check. Swiping a magnetic stripe is the weakest option left at the checkout. When you have the choice, tap, ideally with your phone.

Sources

• Visa: tap to pay and contactless payments — data sent during a tap, one-time codes, 2-inch range
• EMVCo: EMV contactless chip — chip cryptograms unique to each transaction
• Apple: Apple Pay security and privacy overview — Device Account Numbers and what merchants receive
• Google: keep your payment info safe — virtual card numbers and screen lock requirement