obOpen Banking Lab
GlossarySTETBlogContact
Technical

EMV / NFC

EMV (chip) and NFC (contactless)

EMV is the worldwide chip card standard (1996, Europay-Mastercard-Visa) that eliminated fraud from magnetic-stripe copying. NFC is the contactless radio layer that sits on top of EMV.

See also:CBVisa / MastercardTokenisation carte3D SecurePOS / TPE / mPOS / SoftPOSSCA

Definition

EMV is the worldwide standard for chip cards in payments, developed by EMVCo (a consortium founded in 1994 by Europay, Mastercard and Visa, since joined by Amex, JCB, Discover and UnionPay).

It defines how a card's chip communicates with the terminal to authenticate the cardholder, verify the PIN and cryptographically sign the transaction. NFC (Near Field Communication) is the contactless radio layer (13.56 MHz, range < 4 cm) that carries these same EMV messages between the card (or a phone) and the terminal — "contactless".

EMV vs the magnetic stripe

Before EMV, payments relied on the magnetic stripe: data in the clear, copyable with a simple reader (skimming), hence the explosion of counterfeit fraud in the 1990s. EMV brought:

  • A dynamic cryptogram: on every transaction, the chip signs a unique message that cannot be replayed.
  • PIN verification (offline or online) through cryptography.
  • Card authentication by the terminal (network key).
  • Liability shift: since 2015 in the EEA, fraud on a non-EMV transaction is borne by the party that had not deployed EMV.

The result: fraud on card-present transactions in France has fallen to 0.007% of volumes (Banque de France Observatory 2024), one of the lowest rates in the world.

NFC: the contactless layer

NFC is a short-range radio technology (ISO 14443, ISO/IEC 18092). For payments, the terminal powers the contactless chip, which responds with a signed EMV message, processed like a classic EMV transaction. NFC is therefore only the radio layer: an NFC card always performs an EMV transaction.

Contactless limits

Since contactless works without a PIN, it is capped:

  • France: €50 since May 2020 (raised during Covid, vs €30 before).
  • SCA cumulative threshold: beyond a cumulative €150 or 5 consecutive transactions without SCA, the terminal asks for the PIN.
  • Apple Pay / Google Pay: no cap, because SCA is performed on the phone (biometrics).
  • Internationally: £25 to £100 in the UK, €50 to €200 in Germany.

Apple Pay / Google Pay: NFC + tokenisation

When you pay by NFC with a wallet:

  1. The wallet tokenises your card (DPAN — Device Primary Account Number).
  2. SCA is performed locally (Face ID, Touch ID, passcode).
  3. The phone emits a signed EMV message via NFC, with a cryptogram specific to the wallet.
  4. The terminal processes it like a normal EMV NFC transaction, never exposing the real PAN.
  5. The network (Visa, MC, CB) de-tokenises on the issuer side.

Apple Pay is thus more secure than a physical NFC card: no PAN exposure, systematic SCA, no cap.

Tap to Pay and SoftPOS

Since 2022 in France, a merchant can accept an NFC payment on their own phone, without a physical terminal:

  • Stripe Tap to Pay, Adyen Tap to Pay, myPOS Glass, Worldline Tap on Mobile.
  • Ideal for a courier, a mobile merchant or an agent, without investing €200 to €400 in a card reader.
  • Built on EMV + NFC + PCI MPoC certification.

What EMV and NFC are not

  • EMV is not contactless: it refers to the chip and the protocol; there are insert-only EMV cards.
  • NFC is not reserved for payments: access badges, transport (Navigo, Oyster), file sharing…
  • EMV is not a complete protocol: it only covers the presentation to the terminal; routing and authorisation go through the networks via ISO 8583.
  • NFC does not eliminate all fraud: a stolen card allows quick payments under €50, hence the limits and SCA counters.

In the PSD2 ecosystem

EMV + NFC form the physical acceptance technology. For SCA, the EMV PIN counts as possession + knowledge (2 factors). NFC without a PIN relies on the "low value" exemption (≤ €50) with cumulative counters. Apple Pay / Google Pay perform SCA on the phone, satisfying it regardless of the amount.

Concrete examples

  • EMV cards in France: 100% of cards since 2010 have been chip cards, and NFC contactless since 2015. The magnetic stripe survives as a fallback for countries that migrated later (US, Asia).
  • NFC limit: €50 since May 2020; beyond a cumulative ~€150 without SCA, the PIN is requested.
  • Adoption: more than 90% of proximity transactions under €50 are contactless in 2025 (vs ~40% in 2018), a massive acceleration linked to Covid.
  • Apple Pay: no cap, systematic SCA, strong penetration among the under-35s.
  • SoftPOS: Stripe Tap to Pay on iPhone (launched in France in 2024) turns any iPhone XS+ into a terminal — ideal for couriers, caterers and food trucks.
  • US migration: the United States switched to EMV late (2015, card-present only) and remain behind on NFC compared with Europe.
  • EMV 3DS: EMV only covered in-person; EMV 3DS (3DS2) extends its principles to e-commerce, under the aegis of EMVCo.
  • Future limit: the rise of A2A payments (Pix, Wero) eventually raises the question of the place of the EMV card + NFC combo, with no short-term replacement.

Sources

Back to glossary