How NFC Works: The Tech Behind Tap-to-Pay and Metro Cards

Hold your phone an inch from a card reader, hear a beep, and you’ve paid for your coffee without opening an app or typing a PIN. Or you tap a plastic card on a turnstile and the metro gate swings open in under a second. Both of those moments run on the same quiet piece of technology: NFC, or Near Field Communication.

What NFC actually is

NFC is a short-range wireless standard — a specific way for two chips to talk to each other — that only works across a gap of a few centimetres, unlike Wi-Fi or Bluetooth which can reach across a room. That tiny range is a feature, not a limitation: it means a reader only talks to the one card or phone you deliberately hold up to it, not to every NFC chip in everyone’s pocket on a crowded train.

Under the hood, an NFC reader generates a small radio field. A passive NFC tag — the chip inside a metro card, an access badge, or a product tag — doesn’t need its own battery at all; it draws just enough power from that radio field to wake up and send back its data. That’s why a metro card keeps working for years without ever being charged. A phone, by contrast, uses an active NFC chip that’s part of its own hardware, powered by the battery, which is what lets it run a full payment app rather than just broadcasting a fixed ID.

How a tap-to-pay transaction actually goes through

When you tap a phone or contactless card at checkout, the terminal and the chip exchange encrypted data in a fraction of a second — not your actual card number, but a one-time token, a temporary stand-in value generated just for that transaction. That’s why a stolen tap-to-pay transaction record is far less useful to a fraudster than a stolen card number would be: the token is already worthless the moment the transaction is over.

• Card-present chip cards: the same idea, minus the phone — the card’s embedded chip talks to the reader over NFC for the contactless variant.
• Phone-based payments (Google Pay, Apple Pay, and similar): the phone stores a tokenized version of your card inside a secure chip, separate from the regular storage a hacked app could reach.
• Access and transit cards: use the same radio link, but exchange an ID or balance instead of payment data.

Where India actually uses this every day

NFC is already stitched into daily commuting and payments across Indian cities in ways that are easy to miss. Delhi Metro, Mumbai’s Metro network, Bengaluru’s Namma Metro, and several other systems run on NFC-based smart cards for exactly the reason above — no battery, years of use, instant taps at the gate. On the payments side, NPCI’s UPI Lite and various banks’ tap-and-pay cards use NFC to let small transactions go through without a PIN, and the RBI sets a per-transaction contactless limit (₹5,000 at the time of writing) specifically to cap how much a lost or stolen card can be tapped for before a PIN is required. That single regulatory rule is a direct response to the tradeoff NFC creates: it trades a small amount of friction-free convenience for a small amount of no-PIN risk, and the cap is how the system keeps that trade in check.

NFC’s biggest security feature isn’t encryption — it’s distance. A reader can only talk to what’s already touching it.

What to actually watch out for

NFC being short-range doesn’t mean it’s risk-free. A few practical points worth knowing:

1. Contactless cards can, in theory, be read by a rogue reader brought close enough — a few centimetres, not across a room — which is why RFID-blocking wallets exist, though the real-world risk is low given the tokenization and spending caps already in place.
2. Turning on your phone’s screen lock isn’t optional if you use tap-to-pay — most phone-based NFC payments still require the device to be unlocked or authenticated to fire.
3. If a card or phone is lost, reporting it immediately still matters, since the contactless cap limits damage per tap but not the number of taps before you notice.

None of this needs you to think about radio fields or tokens day to day — that’s rather the point of good hardware design. But the next time a metro gate opens on a five-year-old card with no visible battery, or a payment goes through with a tap and no PIN, it’s worth knowing that a genuinely elegant piece of engineering is doing the work, not magic.