What happens when you tap your card at the reader
When you tap a contactless card against a payment terminal, your card transmits encrypted payment information wirelessly using radio frequency identification (RFID) or near-field communication (NFC) technology. The terminal reads that data, verifies it with your bank, and completes the transaction—all in under a second. No physical contact, no chip insertion, no PIN required for most purchases under a set limit.
The card itself contains a small antenna and a chip that holds your payment details in encrypted form. It does not transmit your full card number or expiration date in plain text. Instead, it sends a one-time token—a unique code generated just for that transaction—along with encrypted data that the merchant's bank and your bank use to confirm the payment is legitimate.
The entire exchange happens at very short range, typically 1 to 2 inches. The terminal must be actively reading for the card to transmit, so simply walking past a reader with your card in your pocket will not trigger a payment.
Key Takeaways
- Contactless cards use RFID or NFC radio waves to send encrypted payment data to a terminal without physical contact.
- Each transaction generates a unique one-time token instead of transmitting your actual card number, which reduces fraud risk.
- Most contactless payments under a certain amount (often $25 to $100, depending on your bank and card type) do not require a PIN or signature.
- The card must be within 1 to 2 inches of the reader to transmit, and the reader must be actively powered for the exchange to occur.
- Contactless cards are backward compatible—you can still insert the chip or swipe the magnetic stripe if the terminal does not support contactless payment.
How the encryption protects your card details
Your card's chip stores your payment information in a secure, encrypted format that cannot be read by a standard RFID scanner. When you tap, the terminal sends a challenge—a request for proof that your card is authentic. Your card responds with a cryptogram, a mathematically generated response that proves it holds the real data without revealing it.
This cryptogram changes every time you use the card. Even if someone intercepted the radio signal during one transaction, they could not replay that same cryptogram to make another payment. Your bank and the card network (Visa, Mastercard, American Express) have the keys to verify that cryptogram, but the merchant never sees your actual card number.
The terminal also includes its own security features. It verifies that the cryptogram is valid, checks that the transaction amount is within normal limits for your card, and confirms that your card has not been reported stolen or compromised. If anything fails that check, the transaction is declined before any money moves.
Why some purchases need a PIN and others do not
Most contactless cards have a floor limit—a threshold amount below which you do not need to enter a PIN or sign a receipt. This limit varies by card issuer and country. In the United States, many banks set the limit between $25 and $100. Visa and Mastercard allow issuers to set their own limits, so your bank may differ from another person's bank.
When you exceed the floor limit, the terminal will ask for a PIN or signature to verify you are the cardholder. This is a fraud prevention measure: a thief who steals your card can make small purchases without your knowledge, but larger ones require proof of identity.
Some terminals also require a PIN randomly, even below the floor limit. This is part of the card network's fraud detection system—they may flag a transaction as unusual based on location, time of day, or spending pattern, and require additional verification on the spot.
The difference between contactless cards and mobile wallets
Contactless cards and mobile wallets (Apple Pay, Google Pay, Samsung Pay) both use NFC technology and work at the same terminals. The main difference is where the payment data lives. With a contactless card, the encrypted data is stored on the card's chip. With a mobile wallet, the data is stored on your phone's secure element—a protected area of the phone's memory that functions like a miniature card chip.
Mobile wallets add an extra layer: your phone requires biometric authentication (fingerprint or face recognition) or a PIN before it will transmit payment data. A contactless card transmits whenever it is tapped, regardless of who is holding it. This makes mobile wallets slightly more secure if your phone is stolen, because a thief cannot pay without unlocking it first.
Both methods are accepted at the same terminals and offer the same fraud protections. The choice between them is mostly about convenience—whether you prefer carrying a physical card or using your phone.
What happens if a contactless payment fails or is declined
If the terminal does not read your card on the first tap, try again. Hold the card steady against the reader for a full second, and make sure there is no metal object or thick case between the card and the terminal. Some card holders or wallets can block the signal.
If the transaction is declined, the terminal will usually display a reason: insufficient funds, card expired, or a security flag. The merchant will ask you to use a different payment method—insert the chip, swipe the magnetic stripe, or pay with another card. A declined contactless transaction does not charge your account, so you can try again without risk of a duplicate charge.
If you see a charge you did not authorize, contact your card issuer immediately. Contactless transactions are protected by the same fraud liability rules as any other card payment. If you report the charge within 60 days, your bank will investigate and reverse it if it was fraudulent. You are not responsible for unauthorized charges once you report them.
Contactless cards and data security on public networks
The radio signal from your contactless card is encrypted, but it is still a radio signal traveling through the air. A determined person with specialized equipment could theoretically intercept that signal. However, the intercepted data would be a one-time cryptogram tied to a specific transaction amount and merchant—not your card number or any information they could reuse.
This is why contactless payments are considered secure even in public places. The encryption and one-time token system mean that even if someone captured the radio data, they could not use it to make another purchase or access your account. The card network and your bank would also flag any attempt to use a stolen cryptogram, since each one is logged and tied to a specific transaction.
Your bigger security risk is physical theft of the card itself. If someone steals your contactless card, they can make purchases up to the floor limit without a PIN. This is why you should monitor your statement regularly and report a lost or stolen card to your issuer right away.
How to know if your card is contactless-enabled
Look for a small symbol on the front or back of your card: four curved lines radiating outward, like a WiFi icon. This is the contactless indicator. If you see it, your card supports contactless payment. Not all cards have this symbol, even if they are issued recently—some banks still issue chip-only or magnetic-stripe-only cards.
If you are unsure, ask your bank or check your card issuer's website. You can also test it at any terminal that supports contactless: tap your card and see if it works. A failed tap does not charge your account, so there is no risk in trying.
If your card does not support contactless, you can still use the chip or magnetic stripe at any terminal. Contactless is a convenience feature, not a requirement. Your bank can issue you a contactless card if you request one, though there may be a small fee or a wait for a replacement card to arrive.
Frequently Asked Questions
Can someone steal my card information just by scanning it with a reader?
No. A standard RFID scanner cannot read the encrypted data on your card, and even if it could, it would only capture a one-time cryptogram tied to a specific transaction. That cryptogram cannot be reused to make another payment. Your card issuer and the card network would also flag any attempt to use a stolen cryptogram.
What is the limit on contactless payments before I need a PIN?
The limit varies by bank and card type. Many U.S. banks set it between $25 and $100. Your bank's website or your cardholder agreement will state your specific limit. Transactions above that limit will prompt the terminal to ask for a PIN or signature.
Do I have to use contactless if my card supports it?
No. If your card has both contactless and a chip, you can choose which method to use at each transaction. Simply insert the chip or swipe the magnetic stripe if you prefer not to tap. All three methods are accepted at most terminals.
What if my contactless card is lost or stolen?
Contact your card issuer immediately. They will cancel the card and issue a replacement. You are not responsible for unauthorized charges once you report the card lost, as long as you do so within 60 days of the charge appearing on your statement.
Can I use a contactless card at every store?
Most major retailers, restaurants, and gas stations now have contactless-enabled terminals, but not all. If a terminal does not support contactless, you can insert the chip or swipe the magnetic stripe instead. Your card works at any terminal that accepts your card network (Visa, Mastercard, American Express).