You hold a card near a terminal. It beeps, a green light appears, and you leave. The whole thing takes a few seconds and feels like a single event: money left you, money arrived at the shop.
Almost none of that is what happened. Nothing has moved. What you just watched was a question being asked and answered — and the answer was a promise, not a payment.
The First Half-Second: A Conversation Over Radio
Contactless cards have no battery. The terminal emits a field at 13.56 MHz, and the card’s antenna harvests energy from it — which is why the card must be within a few centimeters, and why the range limit is a consequence of physics rather than a security feature bolted on afterward. The radio layer is defined by ISO/IEC 14443, the same standard behind e-passports and most access badges.
Once powered, the card and terminal negotiate quickly. The terminal works out which payment applications the card supports and selects one. Then it hands the card the transaction data — amount, currency, date — plus a random value it has just generated, called the unpredictable number.
The card takes all of that and computes a cryptogram, using a secret key it holds and never transmits, and an internal counter that increments with every single transaction the card has ever performed. The result is an eight-byte value that is unique to this amount, this currency, this moment and this card, and which cannot be replayed tomorrow for a different purchase.
This part — the whole card-to-terminal exchange — is typically over in well under half a second. The card is then irrelevant. You can put it away, and often people do, before anything has actually been decided.
The Next Few Hundred Milliseconds: A Round Trip
The terminal packages the cryptogram and the transaction data and sends it to the merchant’s acquiring bank, which routes it to the card scheme, which routes it to the bank that issued your card.
The issuer independently re-derives what the cryptogram should be, using its own copy of the key hierarchy, and compares. A match proves the physical card was present and that these exact transaction details were what it saw. Then the issuer does the part everyone assumes is the whole process: checks whether there is money or credit available, checks its own fraud rules, and decides.
The approval travels back the same way, with its own cryptogram proving the response came from the issuer and not from something sitting in the middle of the network. A typical round trip is in the range of a few hundred milliseconds.
That is the beep. An authorization: A statement by your bank that it will honor this amount, and a hold placed against your available balance.
The Days Afterward: The Part That Is Actually the Payment
At some point — usually end of day — the merchant’s terminal batches its approved authorizations and submits them for clearing. The schemes exchange the batches. Funds move between banks in settlement, and the merchant’s account is credited, normally within one to two business days, minus fees.
Nearly everything that confuses people about cards lives in the gap between authorization and settlement.
A pending charge that vanishes and returns at a different amount is an authorization being cleared for a different final figure — a restaurant tip added afterward, a hotel adjusting a stay. A fuel pump that reserves a round sum before you have pumped anything is a pre-authorization for an unknown amount. A refund that takes days while the original charge appeared instantly is not a bank being obstructive: the charge you saw instantly was never a movement of money, and the refund is.
And a chargeback — weeks later, sometimes months — is possible precisely because the money moved after the decision, in a system built to be reversible, on a network where the customer and merchant have no relationship with each other and no direct means of settling a dispute.
Two Things People Get Wrong
That a stranger with a reader can quietly drain your card in a crowd. Passive skimming of a contactless card yields the sort of data that, on its own, is not enough to construct a valid transaction — the cryptogram is generated per transaction, from a challenge only the terminal supplies, using a key that is never transmitted. The realistic attack is a relay: two devices, in real time, one near the card and one near a genuine terminal. It works, it has been demonstrated, and it is nothing like as easy as walking through a train carriage with a reader in a bag.
Paying with a phone is less safe than paying with a card. It is the other way round. Mobile wallets add tokenization — the terminal never sees your actual card number, only a device-specific substitute that is useless elsewhere — and they usually add a cardholder verification your plastic card does not perform for small amounts.
Why It Still Matters
Because the mental model most people carry — tap, money moves — quietly misdescribes the thing they use most days, and the misdescription is expensive.
It is why merchants are surprised that a completed sale can be reversed. It is why customers assume a declined card means “no money” when it very often means a risk rule fired. It is why fraud losses land on parties who thought the transaction was finished.
The four seconds are a user interface. The system underneath is slower, more provisional, and far more interesting: a network that has agreed, globally, to let strangers make promises to each other and to sort out who actually pays afterward.
Leave a Reply