Contactless payments (NFC)
Also known as: tap to pay, NFC payments, tap payments, Interac Flash, contactless card
Contactless payment means tapping a card, phone, or watch on a payment terminal instead of inserting or swiping it, using a short-range radio technology called NFC.
While many people assume tapping is less secure than inserting, it uses the same one-time cryptographic codes as an EMV chip. The real risk isn't the radio. It's the spending limit that lets a stolen card be used without a PIN.
Contactless payments (NFC), explained at three levels
At home
Look for the little wave symbol on your card. If it's there, you can tap the card on the terminal instead of inserting it. The terminal reads it from a few centimetres away, and the payment usually goes through in a second without a PIN for smaller amounts.
At work
For a business, contactless speeds up the line. Customers tap and go, which matters at coffee shops, transit gates, and busy stores. Most modern terminals support contactless cards, phones, and watches out of the box.
At home
Tap payments use NFC (near-field communication), which only works within about 4 centimetres, so someone can't easily read your card from across a room. For purchases above your bank's tap limit, you'll be asked to insert the card and enter your PIN. If your card is lost, report it right away, since small tap purchases don't need a PIN.
At work
Contactless transactions are EMV transactions with a radio link instead of a physical contact, so they carry the same fraud protections and liability rules. Businesses should know the difference between card limits (set by issuers) and terminal settings, and that phone and watch payments often allow higher amounts because the device itself authenticates the user.
At home
Contactless cards follow the ISO/IEC 14443 radio standard and generate a cryptogram for each payment, just like chip-insert transactions. Researchers have demonstrated relay attacks, where two devices extend the radio range to make a distant card pay, but they're impractical at scale. In my opinion, the PIN-free limit is the meaningful trade-off: banks accept a little more lost-card fraud in exchange for speed.
At work
Transit systems use contactless open-loop payments, where riders tap their own bank cards instead of buying a transit card, which shifts fare collection onto card network infrastructure and raises questions about offline authorization and fare capping. Retailers should also watch for cumulative tap limits, where issuers require a PIN after several taps in a row, which can surprise customers at checkout.
Real-world examples
At home
Sophie lost her wallet on the subway. By the time she called her bank, someone had tapped her card three times at convenience stores, each purchase under the tap limit. Because she reported the loss promptly, the bank refunded the charges and cancelled the card.
At work
Thomas manages a stadium's food concessions. After replacing old terminals with contactless-capable ones, average transaction time dropped noticeably during intermissions, and lines moved fast enough that sales rose even though prices didn't change.
Common confusions
- Someone can steal my card details by walking past me with a reader. — NFC only works at a few centimetres, and each transaction uses a one-time code. Skimming tapped data for reuse doesn't work the way it did with magnetic stripes.
- Tapping is less secure than inserting the card. — Both use EMV chip cryptography. The main difference is that small tap purchases may not require a PIN.
- Phone payments are just a copy of my card. — Phones use a separate device token, not your actual card number, and usually require Face ID, a fingerprint, or a passcode.
For analysts
Speed at checkout is a revenue lever, not just convenience. I'd look at queue time data before and after any terminal upgrade, because in high-traffic businesses seconds per transaction translate directly into sales.
History & origin
Contactless card payments grew out of earlier RFID and NFC work. Mastercard trialled PayPass in the United States in 2003, and Visa's contactless brand, payWave, spread from the mid-2000s. Interac launched Flash for contactless debit in Canada in the late 2000s. Canada became one of the world's heaviest users of tap payments, and during the COVID-19 pandemic in 2020 Canadian banks and networks raised the typical tap limit from $100 to $250 to reduce contact at checkouts. Apple Pay and Google's wallets later put the same capability in phones. In my view, contactless is the rare security technology that also made payments faster, which is exactly why it spread so quickly.