How do contactless card payments work? NFC, EMV contactless and limits

A contactless card payment is an EMV chip transaction carried over NFC, a short-range radio link between the card or phone and the terminal. The chip generates a one-time cryptogram that the card issuer verifies, just as it does when the card is inserted. What differs is cardholder verification: small taps often need no PIN, within limits set by regulation, card networks and issuers, while phone wallets verify the user on the device.

What is NFC and how does it carry a card payment?

Near field communication (NFC) is a set of short-range wireless technologies built into cards, phones and terminals. Android Developers: NFC overview The terminal's antenna creates a field; when a card enters it, the card's chip powers up and the two exchange commands. EMVCo's contactless specifications cover both contactless chip cards and NFC-enabled mobile devices, and its Level 1 contactless interface specification defines the radio layer. EMVCo: specifications

On top of that radio link runs the same EMV logic as an inserted card, covered in what is EMV. Mastercard notes that reusing captured transaction data is prevented because each authorization requires a unique cryptogram. Mastercard: contactless security fact sheet

What happens during a contactless tap?

Card or phone enters the field

The terminal's NFC antenna powers the chip or wakes the wallet.

Payment applications on the card

Application and kernel selection

The terminal picks the payment application and the network's contactless kernel.

Amount and terminal data

Chip returns a cryptogram

A one-time code calculated with a key that never leaves the chip.

Verification check

Is cardholder verification needed?

Within limitsNo PIN

The tap goes straight to authorization.

Over a limit or counterPIN or device check

A card asks for PIN; a phone relies on its own biometric or passcode check.

Authorization request

Issuer approves or declines

The issuer checks the cryptogram, funds and risk.

Simplified: offline approval and network routing are left out.

What is an EMV contactless kernel?

A kernel is the terminal software that runs the card dialog. Contactless acceptance has historically used a separate kernel per card network, so a terminal carries several, each certified. In October 2022 EMVCo published a common EMV Contactless Kernel specification, designed to fit existing terminal architectures and run alongside the existing network kernels, and it launched approval testing for that kernel in October 2024. EMVCo: contactless kernel specification, EMVCo: kernel testing process For merchants, every kernel and configuration change feeds into testing; see EMV certification levels L1, L2 and L3.

What are the contactless limits in the EU?

In the EU, the SCA rules allow a payment provider not to apply strong customer authentication to a contactless payment at the point of sale when the single payment is no more than EUR 50, and either the cumulative value of contactless payments since the last SCA is no more than EUR 150 or there have been no more than five consecutive contactless payments since then. EUR-Lex: Delegated Regulation 2018/389, Article 11

The EBA has clarified how this works:

• The cumulative limit is either the value limit or the count limit, not both. EBA: Q&A 2018_4225
• The counter resets at the next in-person transaction where SCA is applied, whether contactless or not. EBA: Q&A 2018_4226
• Providers and card schemes may keep the thresholds in euros outside the euro area. EBA: Q&A 2018_4040

These are ceilings for the exemption, not obligations. An issuer can ask for a PIN below them.

What is the contactless limit in the UK?

Until 19 March 2026, UK rules set fixed thresholds: £100 per transaction, with SCA required after £300 cumulative or five consecutive contactless payments. From that date the FCA removed the fixed regulatory limits and replaced them with a risk-based exemption, so firms with strong fraud controls can set their own limits. FCA: Handbook Notice 136 The FCA says it is up to firms if and when they use that flexibility, that most are likely to keep their existing limits for the foreseeable future, and that firms changing limits must tell customers clearly. FCA: greater flexibility for contactless limits

In practice, UK Finance describes the £100 cap on physical cards as scrapped by the FCA but kept by most issuers. UK Finance: UK Payment Markets 2026 summary It also notes that taking contactless card payments above £100 would need separate changes to terminals and industry rules, and that Apple Pay and Google Pay continue without a fixed £100 limit. UK Finance: contactless limit change FAQs For a merchant, the safe assumption is that a UK card tap above £100 will still need chip and PIN unless your acquirer confirms otherwise.

In the US, where SCA regulation does not apply, ask your acquirer which verification limits your terminals are configured with.

Mobile wallets vs contactless cards: what is the difference?

On Android, the operating system routes a tap to the default wallet app, or to a payment app in the foreground that asks to be preferred. If Secure NFC is turned on, card-emulation services cannot run from the lock screen. Android Developers: host-based card emulation The token side is covered in wallet tokens, VTS and MDES and network tokenization.

Do contactless payments work offline?

Most taps go online to the issuer. EMV also allows the chip to approve offline by returning a transaction certificate instead of an online request, where the card's and terminal's rules allow it. ID TECH: cryptogram and EMV transaction flow Some acceptance products also offer store-and-forward, holding a transaction to authorize later; Apple notes that PIN entry is not supported for store-and-forward on Tap to Pay on iPhone. Apple: Tap to Pay on iPhone FAQ Before enabling either, ask your acquirer who bears the loss if a delayed authorization is declined.

FAQ

What is the contactless limit in the UK?

There has been no fixed regulatory cap since 19 March 2026, but most banks keep £100 on physical cards. Phone wallets have no fixed £100 limit.

What is the contactless limit in the EU?

Taps of up to EUR 50 can skip strong customer authentication until EUR 150 cumulative or five consecutive taps since the last SCA. Issuers can set lower limits.

Why did my contactless card ask for a PIN?

Usually because a cumulative value or count limit was reached, or the issuer's risk checks asked for verification. Entering the PIN resets the counter.

Is a phone wallet tap the same as a card tap?

Both use EMV contactless and a one-time cryptogram. The wallet sends a device token instead of the card number and verifies the user on the phone.

Is contactless safe?

Each tap carries a unique cryptogram, so captured data cannot be replayed. The residual risk is a lost or stolen card used for taps below the limit. UK Finance put the contactless card fraud rate at 1.2p per £100 spent in the first half of 2025. UK Finance: half year fraud report 2025