What Is NFC? How Contactless Cards and Tap to Pay Work
NFC is a way of communicating by radio that works only when two things are within a few centimeters. It uses a magnetic field at 13.56 MHz. Cards such as Suica, a rail and e-money card used in Japan, need no battery. The reader's magnetic field makes electricity in the card's coil, and that runs the chip. FeliCa, which Suica uses, and the international system used by tap-to-pay bank cards are both types of NFC.
What you'll learn
- What NFC is, and why a short range is an advantage
- How a card with no battery runs on the reader's magnetic field and replies
- How Suica (FeliCa) differs from tap-to-pay credit cards
- Why station ticket gates are so fast, and what keeps tap-to-pay safe
- How a phone can act as a card, and other uses such as NFC tags
Prerequisites: none. Reading "How Wireless Charging Works" first makes the part about sending power with a magnetic field easier to follow.
In everyday life
In the morning, you tap a transit card at the station ticket gate and walk through. At a store, you hold a credit card or phone over the reader to pay. At work, you hold up your ID badge to open the door. Many of these "just tap it" moments use a radio technology called NFC.
The strange part is that the card has no battery. Even so, the chip inside does calculations and exchanges encrypted messages with the reader. In this article, we look at where its electricity comes from, and why it only works up close.
What is NFC? Radio that works over a few centimeters
NFC stands for Near Field Communication, meaning "communication over a short distance." The industry group NFC Forum describes it as a radio technology for devices a few centimeters apart. The frequency it uses is 13.56 MHz. This means the magnetic field goes back and forth 13.56 million times a second.
The NFC Forum is a group founded in 2004 by Nokia, Philips and Sony. How devices communicate is set by international standards such as ISO/IEC 18092. So devices from different companies can talk to each other.
A short range is an advantage
Wi-Fi and Bluetooth reach from a few meters to tens of meters ("How Does Bluetooth Work?"). NFC's range is kept short on purpose. There are three main reasons.
First, the act of tapping itself shows that you mean to talk to this particular reader. Second, it is hard to eavesdrop from far away (NFC Forum). Third, even with a line of people at a ticket gate, the reader talks only to the one card on top of it.
How it works 1: Why a card with no battery can work
Inside the card is a thin wire wound a few times around the card's edge. A part made of wound wire like this is called a coil. Both ends of the coil connect to a small chip.
The reader has a coil too. It sends through it a current that switches direction very fast, which makes a magnetic field that keeps changing. When a magnetic field changes, a voltage appears in a nearby coil. This is electromagnetic induction, the same principle as wireless charging (more in "How Wireless Charging Works").
The card's coil is paired with a part that stores electricity for a short time, called a capacitor. This makes the coil respond well near 13.56 MHz. Responding strongly at only one frequency like this is called resonance (resonant circuit). According to STMicroelectronics, the closer the resonance is tuned to the reader's frequency, the more power reaches the chip.
The chip runs on the electricity it receives. The magnetic field from a coil weakens sharply with distance. Beyond a few centimeters, the card stops working because not enough power arrives to run the chip.
How it works 2: The card replies by changing how much power it takes
Because the card has no battery, it has no power to send a signal itself. Instead, it replies by making tiny changes in how much power it takes from the reader's magnetic field. This makes the current in the reader's coil wobble slightly. The reader picks up these wobbles and turns them back into 0s and 1s (STMicroelectronics).
This way of replying is called load modulation. Here, the load means the side that receives and uses the power. The card signals by changing how much it takes in, so it can reply only while inside the reader's magnetic field.
The conversation always starts from the reader's side. The NFC Forum standards also say that a device acting as a card does not start communication on its own.
How it works 3: There is more than one type
NFC has several types, all using the same 13.56 MHz. They differ in rules such as how 0s and 1s are shown by changes in the field, and how the data is split up. The NFC Forum calls them NFC-A, NFC-B and NFC-F and links each one to the standard it is based on.
| Type | Based on | Main uses |
|---|---|---|
| NFC-A, NFC-B | ISO/IEC 14443 (Type A, Type B) | Tap-to-pay credit cards, many NFC tags (NFC-A) |
| NFC-F | JIS X 6319-4 (FeliCa) | Transit cards such as Suica, e-money |
Tap-to-pay credit cards follow the standards of EMVCo, a body run jointly by the major international card companies. These standards are based on international standards such as ISO/IEC 14443 (EMVCo). At the end of 2022, there were about 12.8 billion EMV chip cards in the world (including cards you insert; EMVCo).
FeliCa is a system developed by Sony. According to FeliCa Networks, development began in 1988. Its first commercial use was in 1997, in Hong Kong's Octopus transit card. In Japan, the rail company JR East launched Suica at 424 stations in the Tokyo area on November 18, 2001.
FeliCa is part of the NFC Forum standards as NFC-F. These standards are designed so that one device can handle all three types. That is why many phones can read cards of different types.
How it works 4: Why FeliCa is fast at ticket gates
At a busy station in the morning, people walk through the gates without stopping. So the time from tapping to deciding whether to open the gate must be very short. According to JR East's technical journal, the target for people passing through a ticket gate was 60 per minute. In the development of Mobile Suica, processing in 0.2 seconds or less was treated as an "absolute requirement."
First, the card and the reader check that each other is genuine. This is called mutual authentication. It keeps them from dealing with a fake card or a fake reader.
Sony gives two reasons why FeliCa is fast: its own efficient method of mutual authentication, and a way of communicating suited to contactless use. Even including the cryptography, the exchange between card and reader takes about 0.1 seconds (Sony). The data rate is 212,000 bits per second (212 kbps), or twice that, 424 kbps.
JR East has also been moving, step by step since fiscal 2023, to a system where a central computer does tasks such as fare calculation. Before that, this calculation was done inside the ticket gate.
How it works 5: What keeps tap-to-pay safe
A well-guarded chip that holds secrets
Card numbers and cryptographic keys are kept in a special chip. It is built so that the secrets inside cannot be read out from the outside. This chip is called a secure element.
Chips like this resist attacks such as opening them up or touching them with probes. If they sense something wrong, they protect their secrets, for example by erasing the keys. This property is called tamper resistance. The differences between parts that store keys are compared in "TPM vs HSM vs Secure Element."
Encryption and one-time codes
The exchange between the card and the reader is protected by encryption. FeliCa uses a cipher called DES for mutual authentication and encrypted communication. Chips announced in 2011 and later can also use the newer AES (Sony). How encryption works is explained in "What Is Encryption?"
For each payment, a tap-to-pay card's chip uses encryption to create a security code for that one payment only (EMVCo). The card company uses this code to check that the card is genuine. The code changes every time, so even if someone steals it, it cannot be used for the next payment (Visa).
Why reading from far away is hard
Secretly reading the information on someone's card is called skimming. A card with no battery works only inside a strong magnetic field, so reading it from a distance is difficult. Even if it is read, all you get is a one-time code. For these reasons, Visa says skimming is unlikely and its damage is limited.
Still, the risk is not zero. Research has reported tricks that make a distant card look as if it were near a reader (relay attacks). There are also rules that limit the damage, such as asking for a PIN or signature above a set amount (Visa). If you lose your card or phone, contact the card company right away to have it stopped.
How a phone becomes a card
A phone's NFC can work both as a reader and as a card. Acting like a card when talking to a reader is called card emulation. An iPhone contains an NFC chip and a secure element ("What Chips Are Inside a Smartphone?").
According to Apple, when you add a card to Apple Pay, the bank or card issuer creates a number just for that device. The number is encrypted and stored in the secure element. In a store, the phone hands over this number and a code that changes with each payment. Neither the iPhone nor Apple sends the real card number.
Before you pay, the phone usually checks that it is you, by your face or fingerprint ("How Do Fingerprint and Face Unlock Work?"). But if you set a transit card such as Suica to "Express Mode," you can pass the ticket gate without this check (Apple).
On Android 4.4 and later, an app can also act as a card without using a secure element. This method is called HCE (host card emulation) (Android Developers). Google says that paying in stores needs a phone that supports NFC and HCE. Here too, a stand-in number is sent to the store instead of the real one.
In Japan, Mobile Suica, which lets you use Suica on a mobile phone, launched on January 28, 2006. In March 2023, the number issued passed 20 million (JR East).
Other uses: tags and pairing
An NFC tag is a sticker or card made of just a small chip and a coil. It has no battery. When you bring a phone close, the phone's magnetic field powers the tag, and it sends back its data. A tag can hold a web page address, Wi-Fi or Bluetooth connection details, and more (NFC Forum).
Some earbuds and speakers start a Bluetooth connection (pairing) when you bring a phone close. NFC carries only the information needed to connect. The sound itself is sent over Bluetooth.
A QR code, which does a similar job, can be made just by printing it on paper. An NFC tag can be read just by tapping, with no need to aim a camera. With either one, check that the page that opens is genuine before you type anything in.
Common myths
Myth: Just walking around with a card in your wallet lets someone read it from far away and take your money
In fact, a card with no battery works only in the strong magnetic field right next to a reader. A payment also cannot go ahead unless the store's side starts it (Visa). Even if the card is read, all anyone gets is a one-time code. Still, there is research on relay attacks, so the risk is not zero. Because paying with a tap is so easy, people tend to assume reading a card is easy too.
Myth: NFC and FeliCa are separate, unrelated technologies
In fact, FeliCa is one of the types of NFC, as NFC-F. It uses the same 13.56 MHz. What differs is how 0s and 1s are shown and how data is split up. Phone spec sheets sometimes list "NFC" and "FeliCa" separately, so they can look like different things. Whether you can put Suica on a phone, though, depends on the model and the service.
Myth: When you tap, a quick swipe over the reader is enough
In fact, JR East asks Suica users to touch the reader firmly for about 1 second. Sliding the card over the reader may not register. It also asks people to keep only one IC card in a pass case. If there are several, the ticket gate may show an error. Because people talk about holding a card "over" the reader, they tend to think it can pass by without touching.
By the numbers
| Number | What it is |
|---|---|
| 13.56 MHz | NFC's frequency. The magnetic field goes back and forth 13.56 million times a second |
| 212 kbps | FeliCa's basic data rate. It also supports twice that, 424 kbps (Sony) |
| About 0.1 s | FeliCa's exchange time, including cryptography (Sony) |
| 0.2 s or less / 60 people per minute | Processing requirement in Mobile Suica's development / target for people passing a ticket gate (JR East technical journal) |
| About 12.8 billion | EMV chip cards in use worldwide at the end of 2022 (EMVCo) |
| 20 million | The number of Mobile Suica cards issued passed this mark (March 2023, JR East) |
212 kbps is much slower than Wi-Fi. Sending 1 MB (8 million bits) of data would take about 38 seconds on paper. NFC is not for large files. It is for swapping short pieces of data quickly, up close.
Learn more
- Related articles: "How Wireless Charging Works" (electromagnetic induction and resonance) / "How Does Bluetooth Work?" (short-range radio that reaches much farther) / "What Is Encryption?" (symmetric and public keys) / "What Chips Are Inside a Smartphone?" (NFC and secure element chips)
- Terms: NFC / tamper resistance / TEE (a protected area inside a phone) / symmetric-key cryptography / side-channel attack
- See the differences in a table: TPM vs HSM vs Secure Element / Wi-Fi vs Bluetooth vs LPWA
- Try the numbers: data transfer time calculator (how long sending at 212 kbps takes)