How Do Apple Pay and Samsung Pay Actually Work? NFC and Tokenization Explained

We live in an age where leaving your wallet at home is no longer a crisis. At the checkout counter, you tap your phone on the terminal, and about a second later the payment chime rings. But think about it for a moment — it is a strange thing. You never swiped a card, never typed in a card number, and yet the charge lands on your card. In this post, we will unpack what happens during that one second using just two words: NFC and tokenization. No code involved.

Let me set the scope up front. This post is about the moment your phone touches the terminal. The journey that follows — the signal leaving the terminal, the card network approving the charge, the store getting paid days later — is the same as any regular card payment, so if that side interests you, I recommend reading How Are Online Payments Processed? alongside this one.

NFC is wireless that was deliberately built not to travel far #

The way your phone and the terminal talk is NFC (Near Field Communication). As the name says, communication only works within a few centimeters — practically touching. It is the same technology a transit card uses when you tap it on a bus reader.

While Wi-Fi and Bluetooth compete to send data farther and faster, NFC was intentionally designed to be short-range. That short range is itself a security feature. For someone nearby to intercept the radio signal, they would have to wedge a device into the few-centimeter gap between your phone and the terminal — capturing a payment signal from a distance is structurally difficult. The fact that starting a payment requires the physical act of “bringing the phone close” is a deliberate design choice.

NFC has one more interesting property. The radio waves the terminal emits act as a tiny power source, so the receiving side can respond even without a battery. This is why a plastic transit card has no battery yet still registers at the gate. This property will come up once more in the transit card section near the end of this post.

Your phone does not contain your real card number #

Here is the heart of this post. When you add a card to Apple Pay or Samsung Pay, it feels like the phone must be storing your card number — but it is not. The moment you register, the card network issues a separate number that only works on that device, and only this substitute number is stored in the phone’s dedicated security chip. Replacing the real card number with a substitute like this is called tokenization.

What crosses over to the terminal during a payment is also just this token. The store’s terminal has never seen your real card number, and neither has the store’s computer. The only place that can turn the token back into the real number is on the card network’s side.

The real value of this design becomes clear when things go wrong. Even if a store’s entire system gets hacked, what leaks is a token that is useless outside that one device — your real card number was never there to begin with, so it cannot leak. Compare that with swiping a plastic card, where your real number passes through the store’s system every single time, and phone payments turn out to be the safer architecture.

What happens during the one second your phone is touching the terminal #

Now let’s walk through the payment moment step by step.

1. Identity check — the phone verifies its owner with a fingerprint or face. Until this lock is released, the payment function itself will not run. How your phone recognizes fingerprints and faces is covered separately in the biometric authentication post.
2. Signal transmission — the phone generates a one-time code valid for this single payment only and sends it to the terminal along with the token.
3. Verification — the card network turns the token back into the real card number, checks that the one-time code is valid, and approves the charge.

The one-time code in step 2 is the final safety net. Even if someone managed to record the entire radio exchange, the code inside it has already been used once and expired — it cannot be replayed for another payment. From a thief’s point of view, there is no card number to steal, an intercepted signal cannot be reused, and nothing even starts without the owner’s fingerprint. A triple lock.

Why Samsung Pay used to work on magnetic-stripe terminals #

Early Samsung Pay spread quickly — especially in markets like South Korea — thanks to a secret weapon called MST (Magnetic Secure Transmission). A coil inside the phone generates a magnetic field that mimics the signal of a magnetic-stripe card being swiped, and feeds that signal to the terminal. This meant phone payments worked even on the older card terminals at small neighborhood shops that had no NFC reader. But because it imitates a magnetic stripe by nature, it offers less security than NFC, and now that NFC terminals are widespread, recent models have been dropping MST.

Why the same phone works at one store but not another #

Even after Apple Pay arrives in a country, some stores still say “Apple Pay doesn’t work here.” The reason is simple. Apple Pay runs only over NFC, so if the store’s card terminal has no NFC capability, your phone can send signals all day and there is nothing on the other end to receive them. It is not a flaw in the payment technology but a matter of terminal adoption — and as more stores install NFC terminals, the places that accept it keep growing.

If you lose your phone, do you have to cancel your card too? #

Losing your phone is where tokenization shines one more time. Since the only thing on the phone is a token specific to that device, reporting it lost lets the network suspend just that token. The physical card in your wallet keeps working, and you don’t need to get a replacement card. When Apple’s Find My or Samsung’s Find My Mobile remotely locks the payment function, this token suspension is exactly what is happening. And even before you get around to suspending it, anyone who picks up the phone runs into the fingerprint or face lock first, so unauthorized use is hard from the start.

The transit card still works even when the battery is nearly dead #

Finally, a short note about using your phone as a transit card. At a fare gate there is no time to press a fingerprint, so transit payments get a special mode that skips the identity check — for transit only. The phone operates in card emulation mode, pretending to be an ordinary transit card, so it processes just as fast as the plastic one. Some models even reserve a sliver of emergency power so that after the battery dies and the screen goes dark, the transit function alone stays alive for a few hours — a thoughtful touch that lets you get through the gate on the way home even with a dead phone.

Wrapping up #

To sum up: phone payments ride on NFC, a wireless link only a few centimeters long, and what travels between your phone and the store is not your real card number but a device-specific token plus a one-time code. That is why a hacked store cannot leak your card number, and why losing your phone only requires suspending one token. The next time you tap your phone at a checkout counter, remember that in that single second, a fingerprint check, a token transfer, and a one-time code verification all march through in order.