BEHIND THETHINGS
Behind the

Card Tap

Ep 00157 sec9 sources

Your bank card has no battery. So how does it pay with a single tap?

What happens in the second after you tap a contactless card: a radio field powers the chip, the chip makes a one-time code, and four computers agree in a second or two. The money hasn't moved yet.

  1. 01

    The field

    A contactless reader is always transmitting a weak radio field at 13.56 megahertz, the frequency set by the ISO/IEC 14443 standard for contactless cards.

    The field only reaches a few centimetres. That short range is deliberate, and it's why you tap rather than wave from across the counter.

  2. 02

    The coil

    There's no battery in the card. A loop of fine wire runs around the inside of the plastic several times, connected to the chip.

    When the card enters the reader's field, the changing field induces a small current in that loop, the same principle a wireless phone charger uses. It's enough to power the chip for the moment it needs.

  3. 03

    The one-time code

    The reader sends the transaction details, including the amount and a random number it has just generated. The chip combines them with a counter and a secret key stored inside it, and computes a short cryptogram that only fits this one transaction.

    Your bank holds a matching key, so it can check the code. A recording of the exchange is useless: next time, the counter and the reader's random number are different.

  4. 04

    The journey

    The terminal sends the request to the shop's bank (the acquirer). The acquirer passes it over a card network, such as Visa or Mastercard, to the bank that issued your card.

    Your bank checks the cryptogram, your available balance and its fraud models, then sends an approval or a decline back along the same route. The round trip usually takes a second or two.

    1. Terminal
    2. Shop's bank
    3. Card network
    4. Your bank
    Code OK
    Balance OK
    Fraud risk Low
  5. 05

    The twist

    An approval doesn't move any money. Your bank places a hold on the amount.

    Later, usually at the end of the day, the shop's bank submits its transactions in a batch for clearing, and the money settles between the banks, typically within a day or two.

Simplified on purpose

  • We say the chip “signs” the price. Technically it computes an application cryptogram (a message authentication code) with a key derived from your bank's master key.
  • Some networks, such as American Express, act as card network and bank at once, so the route has fewer stops.

Sources

  1. SecureIDNews — Tech 101: Contactless smart cards
  2. ITWissen — Contactless chip card
  3. Contactless smart card (ISO/IEC 14443, 13.56 MHz)
  4. Black Hat Europe 2019 — First Contact: vulnerabilities in contactless payments
  5. Paragon — Simplifying EMV cryptography
  6. Visa — Quick Chip for EMV specification
  7. Antom — How does merchant acquiring work?
  8. Barking Iguana — How payments work
  9. Marqeta — Card program clearing and settlement
Read the narration

Your bank card has no battery. So how does it pay with a single tap? The reader is always humming: a radio field pulsing thirteen and a half million times a second. Inside the plastic hides a loop of wire. Bring it close, and the loop catches that field. That's its power. The chip wakes up. The reader sends the price. The chip signs it with a secret key only the card and your bank know. That makes a one-time code. Copy it, and it won't work twice. Then it races out. To the shop's bank. Across the card network. To your bank, which checks the code, your balance, and whether it looks like fraud. Yes or no, and back, in a second or two. And the money? It hasn't moved yet. Your bank just puts it on hold. The real transfer comes later, in batches. Now you know what's behind the tap.

Next up · 002: Behind the Barcode

All episodes