Contactless payments (NFC)
Also known as: tap to pay, NFC payments, tap payments, Interac Flash, contactless card
Contactless payment means tapping a card, phone, or watch on a payment terminal instead of inserting or swiping it, using a short-range radio technology called NFC.
While many people assume tapping is less secure than inserting, it uses the same one-time cryptographic codes as an EMV chip. The real risk isn't the radio. It's the spending limit that lets a stolen card be used without a PIN.
Contactless payments (NFC), explained at three levels
At home
Contactless payment works like a quiet whisper between your card and the terminal. A tiny antenna inside the card wakes up when it gets within a few centimetres of the reader, which powers it. The card's chip then answers with a one-time code for that purchase, just as it would if you inserted it. Look for the wave symbol on your card; smaller purchases usually go through in a second without a PIN.
At work
Contactless payment lets customers pay by tapping a card, phone, or watch on a terminal. It uses short-range radio called NFC, but the security is the same EMV chip cryptography as an inserted card. For a business, the main gain is speed: taps finish in a second or two, which matters at coffee shops, transit gates, and busy stores. Most modern terminals accept cards, phones, and watches out of the box.
At home
Tap payments use NFC, near-field communication, which only works within about four centimetres, so the card and reader must almost touch. The terminal's antenna creates a magnetic field that powers the card's chip, and the two exchange data, including a one-time cryptogram for that purchase. Your bank sets a tap limit, often $250 in Canada, above which you must insert the card and enter a PIN. Some banks also ask for a PIN after several taps in a row, to limit losses from a stolen card.
At work
A contactless transaction is an EMV transaction carried over radio instead of a physical contact, so it uses the same cryptograms, network rules, and liability model. Two limits interact: the issuer sets the cardholder's tap limit, and the terminal holds a contactless verification limit, above which it asks for a PIN. Phone and watch payments often allow higher amounts because the device has already authenticated the user with a fingerprint, face, or passcode, which the terminal sees as consumer device cardholder verification.
At home
Contactless cards follow the ISO/IEC 14443 radio standard and generate a cryptogram for each payment, just like chip-insert transactions. Researchers have demonstrated relay attacks, where two devices extend the radio range to make a distant card pay, but they're impractical at scale. In my opinion, the PIN-free limit is the meaningful trade-off: banks accept a little more lost-card fraud in exchange for speed.
At work
Transit systems use contactless open-loop payments, where riders tap their own bank cards instead of buying a transit card, which shifts fare collection onto card network infrastructure and raises questions about offline authorization and fare capping. Retailers should also watch for cumulative tap limits, where issuers require a PIN after several taps in a row, which can surprise customers at checkout.
Real-world examples
At home
Sophie lost her wallet on the subway. By the time she called her bank, someone had tapped her card three times at convenience stores, each purchase under the tap limit. Because she reported the loss promptly, the bank refunded the charges and cancelled the card.
At work
Thomas manages a stadium's food concessions. After replacing old terminals with contactless-capable ones, average transaction time dropped noticeably during intermissions, and lines moved fast enough that sales rose even though prices didn't change.
Common confusions
- Someone can steal my card details by walking past me with a reader. — NFC only works at a few centimetres, and each transaction uses a one-time code. Skimming tapped data for reuse doesn't work the way it did with magnetic stripes.
- Tapping is less secure than inserting the card. — Both use EMV chip cryptography. The main difference is that small tap purchases may not require a PIN.
- Phone payments are just a copy of my card. — Phones use a separate device token, not your actual card number, and usually require Face ID, a fingerprint, or a passcode.
For analysts
Speed at checkout is a revenue lever, not just convenience. I'd look at queue time data before and after any terminal upgrade, because in high-traffic businesses seconds per transaction translate directly into sales.
History & origin
Contactless card payments grew out of earlier RFID and NFC work. Mastercard trialled PayPass in the United States in 2003, and Visa's contactless brand, payWave, spread from the mid-2000s. Interac launched Flash for contactless debit in Canada in the late 2000s. Canada became one of the world's heaviest users of tap payments, and during the COVID-19 pandemic in 2020 Canadian banks and networks raised the typical tap limit from $100 to $250 to reduce contact at checkouts. Apple Pay and Google's wallets later put the same capability in phones. In my view, contactless is the rare security technology that also made payments faster, which is exactly why it spread so quickly.