How does contactless payment work, and is it safe?
Through near-field communication, a short-range radio standard where the terminal powers the card and exchanges a few messages — and the security model is considerably stronger than the convenience suggests.
The physical mechanism. A contactless card contains a chip and an antenna loop but no battery. The terminal generates an alternating magnetic field; the card's coil picks up energy from it inductively and powers the chip. Range is a few centimetres by design, limited by the physics of the coupling rather than by a software setting.
What actually gets exchanged. Not simply your card number. The chip performs a cryptographic computation using a key that never leaves it, producing a one-time cryptogram unique to that transaction, including an incrementing counter. The terminal cannot derive the key, and a captured transaction cannot be replayed — which is the fundamental reason cloning a contactless card is not practical in the way copying a magnetic stripe was.
Phone and watch payments add another layer: tokenisation. Your actual card number is never stored on the device or sent to the merchant. A device-specific token stands in for it, useless elsewhere, and each payment is additionally authorised biometrically. This is meaningfully more secure than the physical card.
The real risks, in proportion:
A lost card being used for low-value payments until it is blocked. This is the actual risk, and is why transaction limits and periodic PIN requests exist.
Relay attacks, where two devices extend the range between a card and a terminal. Demonstrated in research, requiring proximity and equipment, and rare in practice.
Accidental double payments, from two cards in one wallet — terminals generally detect clashes and ask you to present one card.
"Digital pickpocketing", which is heavily overstated. Reading a card at range is difficult, and the data obtainable is largely useless without the cryptogram.
Your protections. Liability rules in most markets mean the cardholder is not responsible for fraudulent transactions where they have not been negligent. Report a lost card immediately, and check statements.