NFC and Contactless

Near field communication, known as NFC, is a short range wireless technology that lets a card or phone communicate with a payment terminal when held within about four centimetres. The terminal sends a radio signal that powers the chip in the card, the chip responds with the payment data, and the terminal sends an authorization request to the acquirer in the same way as a chip and PIN transaction. The whole tap takes less than a second, and no physical contact is needed, which is why contactless payment became popular for transport, coffee shops and grocery stores. A phone using Apple Pay or Google Pay uses the same NFC technology, but the phone also asks for a fingerprint, face recognition or passcode before it releases the payment data. Tokenization is the security layer that makes contactless payment safe, even though no PIN is entered for small amounts. When a customer adds a card to a phone wallet, the card network replaces the real 16 digit card number with a device specific token, called a device account number, and stores the mapping in a secure token vault. The phone sends only the token, plus a one time cryptogram that changes with every transaction, so a thief who intercepts the radio signal cannot reuse the data for another payment. The network detokenizes the token, finds the real card number, and routes the authorization to the issuer. If the phone is lost, the customer can suspend the token without cancelling the physical card. Contactless limits balance convenience against fraud risk, and they differ by country and by card network. In India, the Reserve Bank of India allows contactless payments without a PIN up to 5,000 rupees per transaction, and a customer can choose a lower limit or disable contactless payment entirely through the bank application. Above 5,000 rupees, the terminal asks for a PIN, and the transaction proceeds as a normal chip and PIN payment. Some banks also set a cumulative limit, for example five contactless transactions or 10,000 rupees in a day without a PIN, after which the next transaction requires a PIN even if it is below the single transaction limit. These limits mean that a stolen card can be misused only for a small amount before the PIN is required. A contactless decline can happen for several reasons, and the terminal message tells the customer what to do next. If the transaction is above the contactless limit, the terminal displays insert card or enter PIN, and the customer must insert the card and enter the PIN. If the issuer declines the payment for insufficient funds or suspected fraud, the terminal displays declined and the customer should try another payment method or contact the bank. If the card has been used for several contactless payments in a row, the issuer may ask for a PIN as a security check, even for a small amount, which is called a step up authentication. A terminal that cannot read the card, because the card is in a thick wallet or next to another NFC card, will display try again, and the customer should present only one card at a time. A worked example shows the flow in a real shop. A customer buys coffee and a sandwich for 420 rupees at a cafe in Bengaluru and taps a Visa card on the terminal. The terminal reads the token and cryptogram, sends an ISO 8583 authorization request for 420 rupees, and the issuer approves it with response code 00 in under two seconds. No PIN is needed, because 420 rupees is below the 5,000 rupee limit. Later the same day, the customer buys groceries for 6,200 rupees and taps the same card. The terminal asks for a PIN, because the amount exceeds the contactless limit, the customer enters the PIN, and the payment is approved. If the customer had tapped a phone, the phone would have asked for a fingerprint first, and the token would have been used instead of the real card number in both cases.