How Safe Is Tap-To-Pay?
Tap-to-pay credit cards are nothing if not fast. Hold your card up to a payment terminal, and one quick beep later, you're on your way. But how safe is it? We're generally used to a new convenience coming with some sort of drawback. Could security be the cost of convenience with contactless credit card payments?
It's time to find out. According to a 2024 Federal Reserve study, nearly 20% of in-person credit card payments in 2022 were made using tap-to-pay technology.1 As adoption continues to grow, it's helpful to know how secure this option is compared to the others. After all, when stepping up to a payment terminal, you may have the choice to pay with a credit card in many ways — swiping the magnetic strip, dipping the EMV chip, tapping to pay, or paying with a digital wallet. What's the safest option?
Here's how tap-to-pay, or contactless, credit card technology works — and what the security weaknesses are of each credit card payment option.
What Is a Tap-to-Pay Credit Card?
Many credit cards now have three payment methods on the same card: the magnetic stripe on the back you can swipe at a point-of-sale terminal, the EMV chip you can insert, and a near-field communication (NFC) antenna hidden inside the card for contactless payments.2 The NFC technology is what enables contactless payments from a physical card, also known as tap-to-pay.
While the technology is complex, here's a simplified explanation of how it works:
- When you're checking out at store, the contactless payment terminal starts looking for an NFC signal.
- When you hold your credit card up to the terminal, the terminal communicates with the antenna inside your credit card.
- Your credit card sends an encrypted code to the terminal that only the credit card issuer can decrypt. No credit card data that anyone else can read is part of the transaction.
- Instantly, your credit card issuer (hopefully!) approves your payment, tells the terminal, and your transaction is complete.
How Secure Is Tap-To-Pay?
Overall, tap-to-pay is a very secure payment — but "secure" is a relative term. For example, compared to the old magnetic strip, a contactless payment with a credit card is definitely more secure.2 If you're comparing a tap-to-pay credit card to a contactless payment with a digital wallet on a well-secured smartphone, a superior security argument could be made for the digital wallet.3 But compared to an EMV chip dip to a tap from the same card, the security nuances are small enough that it's a bit of a toss-up.4
Here's why:
Tap-to-Pay versus Magnetic Stripe
With the old magnetic stripe credit card payment method, your all-important static data is stored on the magnetic stripe in full and communicated without encryption to the payment terminal. This is why credit card skimmers — devices illegally installed inside credit card readers — can so easily steal credit card data transmitted via a magnetic stripe.5 Tap-to-pay and the EMV chip dips are much more secure. A skimmer can't intercept contactless payment communications, and even if it intercepted data from a chip dip, a criminal couldn't do anything with it.
Nearly 20% of in-person credit card payments in 2022 were made using tap-to-pay technology. That number has readily risen.
Tap-to-Pay versus EMV Chip Dip
The relative security of tap-to-pay compared to inserting the same credit card for an EMV chip payment is harder to parse. Some experts say tapping is safer because it avoids contact with a payment terminal that could be infected with malware. However, such malware is rare. A Kaspersky analysis found just 156 malware-affected devices in the U.S. in 2021.6 In a nation of around 10 million payment terminals, that's a fairly inconsequential threat.7 The research also noted that the number of devices encountering ATM and PoS malware grew by 39% in 2021 and continued to increase by nearly 4% in the first eight months of 2022.
On the other hand, malicious devices that eavesdrop on NFC transactions are technically possible; if a malicious device were close enough, it could intercept transaction data.8 But with a transmission range of just a few centimeters, this would be difficult for scammers to pull off — and they'd ultimately be left with encrypted data. In any case, this narrow risk exists for any NFC-capable card, whether or not you choose to dip your card or tap it. Since most credit cards come with both options, the security comparison between the two is trivial.
Tap-to-Pay Cards versus Digital Wallets
The technology that enables digital wallets is similar to the tap-to-pay card technology described above — with a key difference. The encrypted data your smartphone sends to a payment terminal includes even less credit card data. Your credit card data is not stored on your device; instead, a digital wallet sends encrypted data related to your account through the digital wallet provider (like Apple for Apple Pay). Unless you, the digital wallet owner, have unlocked your phone and activated your wallet, it cannot make a payment.9
This is also why, if your smartphone is well-secured, it may also provide some additional protection against credit card theft when lost or stolen. Even if a thief has your phone in hand, they shouldn't be able to access your digital wallet without your login credentials. That should make digital wallets safer than a lost or stolen physical credit card, regardless of the payment technology it uses.
Tap-To-Pay Is Quite Secure ... For Now
Tap-to-pay credit card technology is, currently, extremely secure. It's worth noting that scammers and financial fraud criminals are working hard to develop new tools and technology to take advantage of NFC payments. Some early signs of those efforts have already emerged in Eastern Europe (though the complex fraud currently requires targeted phishing as well as technology).10 So consumers should continue to closely monitor their credit card activity and be savvy about financial fraud safety, no matter what payment method they use.
For now, however, saving a few minutes in the check-out line with a tap-to-pay with credit card transaction doesn't appear to come at any security costs — so go ahead and tap away.
-
How Cryptocurrency ATM Scams Work
There's a new fraud in town. Cryptocurrency ATMs are appearing across the U.S., and scammers are using them to defraud thousands of victims.
-
Shhh! Don’t Tell Anyone That Access Code!
One-time access codes are for account owners' eyes only, but scammers are tricking victims into sharing them. Learn how this fraud works.
Important disclosure information
- Board of Governors of the Federal Reserve System, "Federal Reserve Payments Study (FRPS)," FederalReserve.gov, published March 12, 2025. Accessed October 6, 2025. Back
- George Downs, "The Complex Engineering Behind Firework-Firing Drones," WSJ Video, published July 4, 2025. Accessed October 6, 2025. Back
- Patrick Cooley, "Are digital wallets safer than debit cards?" Payments Dive, published May 31, 2024. Accessed October 6, 2025. Back
- PayPal, "Are contactless payments safe? A Guide to tap-to-pay, QR codes, digital wallets, and security practices," PayPal Business Resource Center, published January 3, 2025. Accessed October 6, 2025. Back
- Federal Bureau of Investigation, "Skimming," accessed September 8, 2025. Back
- Kaspersky, "A look at the 2020–2022 ATM/PoS malware landscape," SecureList, published Oct 6, 2022. Accessed October 6, 2025. Back
- Kalle Radage, "A Market Overview of Payment Terminals in the USA in 2024," Clearly Payments. Accessed October 6, 2025. Back
- Thomas P. Diakos, et al., "Eavesdropping near-field contactless payments: a quantitative analysis," The Journal of Engineering, published July 2013. Accessed October 6, 2025. Back
- Apple, "Apple Pay security and privacy overview," published October 8, 2024. Accessed October 6, 2025. Back
- Roman Cuprik, "Now it is certain: NFC data for contactless payments are the new target. Here is what you need to know," Eset Blog, published June 27, 2025. Accessed October 6, 2025. Back