How contactless payments work

A tiny radio in your card

A contactless bank card has a small chip and a thin aerial hidden inside the plastic. When you hold it near a card reader, the reader's radio field powers the chip, and the two exchange information. This uses NFC, which stands for near-field communication. It only works over a few centimetres, which is why you have to hold the card close.

Phones and smartwatches have the same kind of radio built in, so a payment app can do the job of the card.

What happens in that one second

1. The shop's terminal asks for payment and sends the amount.
2. Your card or phone replies with payment details and a one-time code created just for this payment.
3. The terminal sends this to the shop's payment company, which passes it to your bank.
4. Your bank checks the code, the account and your spending pattern, then approves or declines.
5. The terminal beeps. All of this usually takes less than two seconds.

Because each code works only once, someone who secretly recorded the exchange could not reuse it to make another payment.

Why phone wallets are even safer

• Your real card number is hidden. The phone uses a stand-in number, called a token, which is useless if a shop's systems are later hacked.
• You must unlock it. A fingerprint, face scan or PIN is usually needed for each payment, so a thief cannot simply tap your phone.
• You can switch it off remotely. If the phone is lost, you can erase it or remove the cards from another device.

Common worries, answered

"Can someone steal money by walking past with a reader?" In theory a criminal could get very close and trigger a single small payment, but they would need a registered merchant account that banks can trace, and the amount is limited. Real cases are extremely rare. Card limits, bank fraud checks and the one-time codes make it an unattractive crime.

"Do I need a special card sleeve?" For most people, no. If it gives you peace of mind, a metal-lined wallet will block the signal, but it is not essential.

"Why do I sometimes have to insert my card and enter my PIN?" Banks set limits on single contactless payments and on how many you can make in a row. Once you pass a limit, the card asks for a PIN to prove it is still in the right hands.

What to do if your card or phone goes missing

1. Freeze or cancel the card straight away in your banking app, or call the number on the bank's official website.
2. For a phone, use the maker's "find my device" service to lock or erase it.
3. Check your statement for payments you do not recognise and report them to your bank quickly.
4. Change passwords for important accounts if the phone was unlocked when it was lost.

Tip: Turn on payment notifications in your banking app. You will know about any payment within seconds.

Want the technical version? Our note on cryptography explains the maths behind one-time codes.