rfid.wtf / WTF is RFID?
In the wildHF · 13.56 MHz

Contactless credit cards

Tap to pay is a tiny smart card doing cryptography in the half-second your card hovers over the terminal.

The contactless symbol on your bank card means there's an HF antenna around the edge and a smart-card chip in the middle, the same chip the gold contacts connect to. Tapping is just a second way to talk to it.

Contactless payment follows EMV, the standard set by the big card networks, running over ISO 14443.

#What happens in a tap

  1. Wake up. The terminal finds the card with the usual ISO 14443 handshake, and the card says it's a smart card.
  2. "What can you do?" The terminal asks the card for its list of payment applications, then selects one: Visa, Mastercard, a local scheme…
  3. Read the basics. The card sends back the account number, expiry date and the settings for how it wants to be verified.
  4. The cryptogram. The terminal sends the amount, the date and a random number of its own. The card mixes them with a secret key that never leaves the chip and returns a cryptogram: a short code that proves this exact card approved this exact payment.
  5. The bank checks it. The bank has the matching key, recomputes the code, and approves or declines.

All of that takes well under a second.

Same idea as any authentication: a fresh number in, an answer only the right key can make out.
Same idea as any authentication: a fresh number in, an answer only the right key can make out.

#Why a "skimmed" tap doesn't get you much

The account number and expiry date are often readable by any NFC reader, and that's on purpose: the terminal needs them. What a reader can't get is the secret key, and every cryptogram is tied to one transaction and one random number. A recorded tap won't approve a different payment.

The card also doesn't hold the security code printed on the back, which most online shops ask for, and banks use limits, PINs for bigger amounts and fraud checks on top.

#Phones are better at this

Phone wallets don't even use your real card number. They get a separate token with its own keys, so a tap reveals a number that's useless anywhere else, and losing the phone doesn't mean cancelling the card. More on that in Phones and Mobile wallets.

#Card clash

Keep two contactless cards together and a terminal or ticket gate might charge the wrong one, or give up. On transit systems that charge by journey this can mean paying with a card you didn't mean to. Tap the one you mean, on its own.

With Your phone

NXP TagInfo shows a bank card as an ISO 14443-4 smart card and lists the payment applications it offers. It's a nice way to see step 2 for yourself.

Where next

ISO 14443The standard behind almost every card you tap — how a reader finds a card, picks it out of a crowd, and starts talking.ConceptHF · 13.56 MHzPhonesYour phone is a reader, a card and a wallet — sometimes all in the same minute.In the wildHF · 13.56 MHzPublic-key cardsCards that hold a private key and prove it — the "authentication" end of RFID.ConceptHF · 13.56 MHz

Shows up in

HF — 13.56 MHzMobile wallets