NFC in Payments
Near Field Communication (NFC) operates at 13.56 MHz over distances up to ~4 cm. In payments, it enables tap-to-pay at POS terminals, transit fare gates, and mobile wallets. The technology is governed by ISO/IEC 14443, ISO/IEC 18092, and NFC Forum specifications — with EMVCo layering the payment protocol on top.
Standards Governing NFC Payments
Multiple overlapping standards bodies define the NFC payment stack. ISO/IEC provides the physical and data-link layers; NFC Forum adds interoperability profiles; EMVCo sits on top with the transaction protocol.
ISO/IEC 14443 — The Payment Card Standard
ISO/IEC 14443 defines proximity coupling devices (PCDs — readers) and proximity integrated circuit cards (PICCs — cards/tags) at 13.56 MHz up to 10 cm. It is the foundation for every EMV contactless payment.
Animated link-layer handshake (PCD ↔ PICC)
The low-level handshake between a contactless reader (PCD) and card/phone (PICC): RF activation, anti-collision, protocol activation, then the EMV application exchange.
RF Field / Power
Reader emits a 13.56 MHz field that powers the card.
The PCD continuously generates an RF field. When a PICC enters it, the card harvests power inductively — passive cards have no battery.
Type A Dominant in payments
- Used by: Visa payWave, Mastercard PayPass, Amex ExpressPay, most European cards
- Modulation: ASK 100% (card-to-reader), ASK 8–10% (reader-to-card)
- Bit coding: Modified Miller (reader), Manchester (card)
- Data rates: 106, 212, 424, 848 kbps
- Anti-collision: Bit-frame based
- Examples: Mifare Classic, Mifare DESFire, most EMV cards
Type B Government & ID use
- Used by: Some national payment schemes, biometric passports, ID cards
- Modulation: ASK 10% (both directions)
- Bit coding: NRZ-L
- Anti-collision: Slot-based (time-divided)
- Examples: French Cartes Bancaires (pre-2010), German ePass
ISO/IEC 18092 — NFC-IP-1 (Peer-to-Peer)
- Defines P2P communication between two active NFC devices
- Includes NFC Data Exchange Format (NDEF) protocol
- Used for: Android Beam (deprecated), NFC tag writing, contactless pairing
- Logical Link Control Protocol (LLCP) enables reliable, bidirectional comms
NFC Forum Tag Types (1–5)
| Type | Based on | Memory | Speed | Common use |
|---|---|---|---|---|
1 | ISO/IEC 14443 Type A | 96B – 2KB | 106 kbps | Simple URL tags |
2 | ISO/IEC 14443 Type A | 48B – 2KB | 106 kbps | Business cards, stickers |
3 | JIS X 6319-4 (Felica) | up to 1MB | 212/424 kbps | Transit (Japan: Suica, Pasmo) |
4 | ISO/IEC 14443 Type A/B | up to 32KB | 106–424 kbps | Secure documents, loyalty |
5 | ISO/IEC 15693 | up to 64KB | 26 kbps | Long-range inventory, NFC tags |
NDEF — NFC Data Exchange Format
Message Structure
NDEF messages contain one or more records. Each record carries a type identifier and a payload, enabling interoperable data exchange across devices and readers.
Hierarchy
- Message → one or more Records
- Record → Type + Payload
Common Record Types
TNF (Type Name Format)
EMVCo Contactless Specifications
Book A
Architecture & general requirements
Defines the overall contactless architecture, entry point flow, and general requirements for all contactless transactions.
Book B
Entry point specification
Specifies the common kernel selection logic — how a terminal chooses between multiple supported AIDs when a card presents several applications.
Book C-2
Kernel 2 — Mastercard M/Chip Advance
Defines Mastercard's contactless EMV kernel for PayPass / Mastercard Contactless.
Book C-3
Kernel 3 — Visa payWave / Visa Contactless
Defines Visa's contactless EMV kernel, covering both EMV mode and Magnetic Stripe Data (MSD) mode.
Book D
Communication protocol & RF analog
Defines the RF analog requirements — field strength, waveform quality, modulation levels, and timing that underpin ISO/IEC 14443 compliance.
Book E
Security & key management
Covers cryptographic requirements for contactless transactions including session key derivation, ARQC/ARPC generation, and issuer script security.
PCI PTS POI Requirements for NFC
- RF field must be monitored for tampering
- Contactless reader antenna must be sealed within the tamper-evident enclosure
- Jamming detection required by some schemes
- Entry point must enforce transaction limits per network rules (CVM limit, contactless limit)
Related Tools
Use these tools to work with the cryptographic primitives and data formats used in NFC / EMV contactless transactions.