Tap to Pay: Contactless Cards, Wallets and Phones as Terminals

How it works

The phone's NFC (near-field communication) chip reads the card or wallet when the customer taps it against the phone. The PCI Security Standards Council describes its Contactless Payments on COTS standard as covering solutions that let merchants accept contactless payments on commercial off-the-shelf devices such as phones and tablets, using their built-in NFC, without an external contactless reader. Its newer Mobile Payments on COTS (MPoC) standard builds on that and on the software-based PIN entry standard, and includes entry of both PIN and contactless card data on the same device. You do not use these features directly; you use a payment app from your provider that has been built on them.

iPhone requirements, as Apple documents them

Apple's business page says Tap to Pay on iPhone requires iPhone Xs or later and works best with the latest version of iOS, updated under Settings, General, Software Update. You enable it in the payment app of your choice, then open the app, enter the amount and present the iPhone to the customer. Apple says it accepts in-person contactless payments from physical debit and credit cards, Apple Pay and other digital wallets. On the developer side, Apple says a payment app needs a payment service provider that supports Tap to Pay in your region and an entitlement from Apple. Apple's list of countries and regions included the United States and Canada when we checked on September 17, 2026.

Android phones

The Google and Android pages we checked describe consumers paying with an Android phone at a terminal, not merchants accepting payments on one. Merchant acceptance on Android comes through your payment provider's app, and that provider sets the supported devices and Android versions. Before you commit, ask the provider for its current supported device list, the minimum operating system version, and whether its solution appears in the PCI Security Standards Council's MPoC listing.

Security: what Apple and PCI say

Apple says it does not store card numbers or PINs on Apple servers, that transactions are encrypted and processed using the Secure Element, that Apple does not know what is being bought or who is buying it, and that the feature is designed to block camera and screen captures during transactions. The PCI Security Standards Council says MPoC is for entities developing, deploying or managing these solutions, and points to its MPoC products and solutions listing. As a merchant, your own PCI obligations still come through your acquirer or provider; our PCI guide explains how that works for small businesses.

Limits to plan around

Tap on phone reads contactless payments only, so a card without contactless cannot be inserted or swiped. Apple notes that some contactless cards may not be accepted, that transaction limits may apply, and that the service is not available in all markets. A phone also depends on its battery and on a data connection. Consider keeping a card reader or terminal as a backup for those cases; our terminal and offline guides cover the choices. Pricing is set by your provider, so ask how tap-on-phone transactions are priced rather than assuming they match terminal pricing.

Where it fits

Tap on phone suits sales away from a counter: trades collecting payment on site, market stalls and pop-ups, deliveries, and staff taking payment on the floor. Illustrative example only, with made-up round numbers: a contractor with 4 technicians could have each one take payment on their own phone at the end of a job, with all 4 phones linked to one account, instead of buying 4 card readers. Check that your provider supports several users and devices on one account and lets you see who took each payment.

Two meanings of tap to pay

Tap to pay describes two different things. For customers, it means paying by tapping a contactless card, phone or watch on a terminal. For merchants, it also means using a phone itself as the terminal, with no separate card reader. Both run on the same contactless technology, and both are card-present transactions when done in person, which generally carry lower interchange and better fraud protection than typing a card number.

Wallets and tokens

When a customer pays with a phone or watch wallet, the wallet sends a token instead of the real card number, and the transaction is priced like the card inside the wallet. That makes wallet payments safer for you, because a stolen token is of little use elsewhere. It also means there is no extra fee for accepting phone payments as such; you pay what you would for the underlying card.

Choosing between a phone and a terminal

A phone as a terminal suits low-volume, mobile or backup use: a market stall, a service call, a second checkout on a busy day. A dedicated terminal suits steady counter volume, needs a printer, supports chip and PIN for cards that cannot tap, and usually handles offline mode and tipping more smoothly. Many small businesses use both. Check your provider's per-transaction pricing for each, because some price phone acceptance differently.

Costs to compare

Ask how your provider prices contactless and phone-as-terminal payments compared with chip payments. In most cases an in-person tap is priced as card-present. Also check whether a phone-as-terminal app has its own monthly fee, whether it supports tips and receipts the way you need, and whether it works offline. A cheap app that cannot handle your checkout flow costs more in staff time than it saves.

Accessibility at checkout

Tap payments are quick for most customers, but keep a way to insert a chip and enter a PIN, and make sure terminals are reachable from a wheelchair or can be handed to the customer.

When a tap asks for more

Card issuers and networks set limits above which a contactless payment may ask for a PIN or a chip insert, and those limits differ by country and card. Train staff to expect it and keep a terminal that accepts chip and PIN for those cases.