Tap to pay and digital wallets: are they safe?

How it works

Your phone and the reader talk over a very short-range wireless link called NFC; you have to be within a few centimeters. When you add a card to a phone wallet, your bank gives the phone a stand-in number (a “token”). The store receives that token and a one-time code for each purchase, not your actual card number.

Why it’s generally safe

• Payments from a phone wallet need you to unlock with your face, fingerprint or passcode.
• Stores and card skimmers don’t get your real card number.
• If your phone is lost, you can lock it or remove the cards remotely.

Where the real risks are

• Scams, not the tap itself: fake texts asking you to “verify” your card or read back a code that adds your card to their phone.
• Money-sending apps are different: payment apps that send money to people (like Zelle, Venmo or Cash App) move money instantly and often can’t be reversed. Only send to people you know.

What it means for you

For in-store purchases, tapping with a phone wallet is one of the safer ways to pay. Protect the phone itself, and never share a code your bank texts you.

Quick tips

• Use a strong passcode and Face ID or fingerprint on your phone.
• Turn on Find My or Find Hub so you can lock a lost phone.
• Turn on purchase alerts in your bank or card app.
• Never read a verification code to a caller, even one who says they’re your bank.