How Tap to Pay on a Phone Works for Merchants

Tap to pay on a phone lets a merchant accept contactless cards and mobile wallets with an ordinary smartphone instead of a separate card reader. The phone's built-in NFC antenna reads the card, a certified payment app handles the transaction, and the payment goes to the merchant's processor like any other card sale. The customer's real card number is protected by one-time codes and, for wallets, by tokens.

Key takeaways

A phone becomes a contactless terminal through software from a payment provider, using the NFC antenna it already has.
Each contactless tap produces a one-time security code, and mobile wallets send a token instead of the real card number.
You need a supported phone, an app from a provider that supports phone acceptance, a merchant account and an internet connection.
Phone acceptance handles taps only, so keep another way to take payment for cards that must be inserted.

How does contactless payment work?

Contactless payments use NFC (near-field communication), a short-range radio link between a card or device and a checkout terminal. EMVCo (opens in a new tab), the body that manages the EMV chip specifications, says its contactless standard covers both contactless chip cards and NFC-enabled mobile devices, which the customer taps or waves near the terminal.

EMVCo says a one-time security code is generated for every contactless transaction, and that its cryptography makes contactless more secure than magnetic stripe cards. Visa (opens in a new tab) describes the same one-time code protecting payment information, and notes that the EMVCo Contactless Symbol shows where to tap.

Why isn't the card number exposed?

Two separate protections are at work.

The first is the one-time code above, which every contactless card produces.

The second is tokenization, which replaces the primary account number (PAN, the long number on the card) with a different value called a payment token. EMVCo (opens in a new tab) explains that a token is restricted to a specific merchant, device or payment scenario, so a stolen token is worth much less than a stolen card number.

Mobile wallets are a common example. Apple (opens in a new tab) says Apple Pay does not send the actual card number to the store. Instead, the phone's secure element passes a Device Account Number created by the card issuer, plus a transaction-specific security code.

How does a phone become a payment terminal?

This approach is often called SoftPOS (software point of sale). Visa (opens in a new tab) describes its version, Tap to Phone, as turning a smartphone into a contactless point-of-sale device, and says sellers need an NFC-enabled Android or Apple smartphone and an app from a certified solution provider.

On iPhone, the feature is Tap to Pay on iPhone. Apple's developer page (opens in a new tab) says it accepts contactless cards, Apple Pay, Apple Watch and other digital wallets without extra hardware, and that Apple does not know what is being bought or who is buying it. A payment service provider processes the payments and supplies the certified terminal configuration loaded on the phone (Apple (opens in a new tab)). As of September 2026, Apple's business page (opens in a new tab) says it requires iPhone XS or later and works best with the latest version of iOS.

On Android, each provider sets its own requirements. As one example, as of September 2026, Stripe's Tap to Pay on Android documentation (opens in a new tab) lists requirements that include a working NFC sensor, Android 13 or later, a security update from the past 12 months, Google Mobile Services, a device that is not rooted or modified, and a stable internet connection. Check your own provider's list before buying phones.

Can customers enter a PIN on the phone screen?

Sometimes. The PCI Security Standards Council's MPoC standard (opens in a new tab) covers solutions that accept both PIN and contactless card data on the same commercial off-the-shelf (COTS) device, such as a phone. Stripe's documentation says its Android solution supports PIN entry when a transaction is above a regional contactless limit or the issuer asks for it, and that it places the PIN pad in a random position on screen. Whether PIN entry is available depends on your provider, phone and country.

What does a merchant need, and how does it compare?

To start accepting payments on a phone, you typically need:

A merchant account and processor that support phone acceptance.
A compatible phone, kept on a current operating system version.
The provider's app, signed in to your account.
A reliable internet connection at the point of sale.

The table compares the three common ways to take in-person card payments. It describes typical setups; check the specifics with your provider.

	Phone (tap to pay)	Mobile card reader	Countertop terminal
Hardware	Your own phone	Small reader paired with a phone or tablet	Dedicated device
Contactless cards and wallets	Yes	Typically yes	Typically yes
Chip insert	No	Typically yes	Typically yes
PIN entry	Depends on provider and region	Typically on the reader	Typically on a keypad
Best fit	Low volume, mobile or backup use	Mobile sales with full card support	Fixed checkout counters

The gap that matters most is chip insertion. Stripe's documentation notes that in some countries, such as Canada, Finland and the UK, some cards require a PIN or authentication that needs the card inserted, which phone acceptance does not support, and recommends a card reader or a payment link instead. If you serve customers whose cards may need insertion, keep a second option. You can compare dedicated hardware on the payment terminals page.

How is this different from paying with a mobile wallet?

The two features sit on opposite sides of the counter. A mobile wallet such as Apple Pay or Google Pay is on the buyer's side: it stores a tokenized card on the customer's phone or watch and pays at contactless terminals that accept it. Tap to pay on a phone is on the merchant's side: it turns the seller's phone into the terminal.

They work together. A customer can tap a physical card, a phone wallet or a watch against a merchant's phone, and Apple (opens in a new tab) says Tap to Pay on iPhone accepts wallets on Android devices too.

For the merchant, a phone payment is an in-person card sale that runs through your processor and settles like other card sales (see card settlement and funding times). Your security responsibilities still apply. PCI DSS for small merchants explains where those requirements come from.

Frequently asked questions

Do I need to buy any hardware?

Not for contactless payments, if your phone is supported. You may still want a card reader for cards that must be inserted.

Does the phone store my customers' card numbers?

For Tap to Pay on iPhone, Apple (opens in a new tab) says it does not store card numbers or PINs on its servers. If you use Store and Forward mode, encrypted card numbers are held temporarily on the iPhone for those transactions. For other platforms, ask your provider how card data is handled.

Is there a limit on how much I can take with a tap?

Contactless limits and PIN rules vary by country, card network, issuer and provider. Ask your processor what applies to your account.