NFC in Payments
Near Field Communication (NFC) operates at 13.56 MHz over distances up to ~4 cm. In payments, it enables tap-to-pay at POS terminals, transit fare gates, and mobile wallets. The technology is governed by ISO/IEC 14443, ISO/IEC 18092, and NFC Forum specifications — with EMVCo layering the payment protocol on top.
NFC Payment Use Cases
NFC is the foundation of a broad range of payment and identity scenarios — from retail POS to transit, wearables, access control, and beyond. Each use case has distinct technology requirements and security models.
POS Tap to Pay
Card or phone taps a POS terminal. Full EMV contactless flow runs as described in the Payment Flow tab. PAN is transmitted encrypted; mobile wallets use network tokenization so the real PAN is never sent over the air.
Transit / Fare Gates
Open-loop: a standard bank card taps a turnstile. The terminal makes an offline decision (below floor limit), then settles in the background — used by Transport for London, Clipper (San Francisco), and others. Closed-loop: a proprietary transit card with stored value — Suica and Pasmo (Felica Type 3), Oyster.
Apple Pay / Google Pay
HCE (Host Card Emulation): card data served by an Android app in software — no dedicated hardware chip required.
Secure Element: dedicated chip (embedded SE or SIM) stores tokenized credentials with hardware protection.
Apple Pay uses embedded SE exclusively. Google Pay supports both. Network tokenization (VTS/MDES) issues a device-specific PAN (DPAN); the real PAN is never transmitted to the merchant.
Wearables (Watches, Rings, Wristbands)
An embedded SE in the wearable is paired to a companion app on a smartphone. The wearable runs the same EMV contactless flow as a physical card. Some wearables use Bluetooth for provisioning and credential management but always use NFC for the actual payment tap.
Access Control & Identity
NFC credentials are replacing legacy RFID keycards with cryptographic authentication. FIDO2 over NFC enables passwordless login without an app or biometric on the reader. ePassports (ICAO 9303) embed an NFC chip protected by BAC or PACE cryptographic access control. EU digital ID cards follow the same model with ISO 18013-compliant mobile driver's licences.
P2P Payments & Merchant NFC Tags
NDEF-based P2P transfer for small person-to-person amounts — now mostly replaced by QR codes in most markets. NFC-initiated QR: a customer taps an NFC tag at a merchant's counter and receives a deep link launching their payment app with the payment context pre-filled. India's UPI NFC enables offline merchant acceptance where QR scanning is impractical.
Closed-Loop Smart Cards (MIFARE)
The non-EMV side of ISO 14443 Type A: NXP's MIFARE family powers closed-loop stored value and credentials — transit fare cards (Oyster, OV-chipkaart), campus and citizen cards, event tickets, hotel keys, and EV charging cards. MIFARE Classic's Crypto1 cipher has been broken since 2008; modern deployments use DESFire EV3 or Plus in AES mode. See the full MIFARE guide for the product family, security history, and a product-fit matrix.
Related Tools
Use these tools to work with the cryptographic primitives and data formats used in NFC / EMV contactless transactions.