As far I know NFC tags are quite simple. They contain small amount of data, from several bytes to few kilobytes. NFC / RFID readers receive that data. They can also write back some data to read it later.
I thought that NFC payments are more secure than traditional magnetic cards where whole security is based on one secret number.
So how do NFC payments are implemented? I am especially interested in implementations which we'll have on Android devices. Please describe only high level algorithm.
Android and Google use HCE—the device uses a virtual credit card number, which the mobile payment provider's servers verify, and then send the user's real credit card number to the merchant to complete the transaction.
Your phone uses Near Field Communications (NFC) to communicate with the terminal and so you may not need an internet connection to use the Google Wallet app in stores.
NFC tags work like any other RFID tag to communicate over radio waves. Two devices — the NFC tag and the NFC reader exchange information in NFC data exchange format. An NFC tag sends radio waves to activate the antenna in a receiving device. The recipient validates the information to complete information exchange.
On a bit lower level NFC works using so-called NDEF protocol (NFC data exchange format). Basically NDEF consisting message->record->payload. Payload where application specific information goes. It depends solely on application which kind of data/encryption will be in those payload.
So there's no standard payment method implementation. Everything will depend on vendors. For example how Google and Visa guys will establish data exchange protocols and implement it.
It's very similar to regular chip and pin, except that your phone becomes a contactless credit card. You will have to enter a pin on a sales terminal.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With