What a mobile wallet is
A mobile wallet is an app on your phone or watch that stores payment cards and other items in digital form and uses them to pay. You add a card by scanning it or typing its details, and the card issuer may ask you to confirm it, often with a code or a check in your banking app. After that, you can pay by holding the device near a payment terminal, or by choosing the wallet at an online checkout.
Wallets differ by phone maker and country, and some banks offer their own. The general mechanics described here are common to most of them, but details vary.
How tapping works
At the shop, the terminal and your phone talk over NFC (near-field communication), a short-range radio technology that only works across a few centimetres. That limited range is deliberate: it makes it hard for a distant device to listen in or trigger a payment by accident.
The sequence is roughly:
- You wake and unlock the phone, or confirm in some other way, and hold it near the reader.
- The terminal tells the phone what it needs, including the amount.
- The phone sends back a package of payment data, including a one-time proof that the transaction came from your device.
- The terminal forwards the request into the normal card system, where the issuing bank approves or declines it.
From there the payment follows the same path as any card payment, as described in the overview of online payments. The merchant sees a successful or declined result, and the money settles later.
Tokens: the stand-in card number
The key security feature is tokenization. When you add a card, the wallet system does not store your real card number on the phone. Instead, the card network or issuer creates a token, a different number tied to that card and to that particular device. This is sometimes called a device account number.
When you pay, the shop’s terminal receives the token and a unique, single-use code (a cryptogram) rather than your real number. The network translates the token back to the real card on its side, and the issuer checks the code. The consequences are useful:
- If a shop’s systems are breached, the token it kept is generally of little use elsewhere, because it is tied to your device and the cryptogram changes for every payment.
- If you replace your phone, the old device’s token can be deactivated without cancelling the physical card, in many systems.
- The shop does not have to hold your real number to take the payment.
The same stand-in idea is used in other tools, including virtual card numbers, where a separate number can be given to a specific merchant.
Device authentication
Tokens protect the number; authentication protects the use. Phones typically require you to unlock them before a payment, using a PIN or passcode, or biometric authentication such as a fingerprint or face scan. The biometric data used to unlock is normally processed and kept on the device rather than sent to the shop or the card network, though practices depend on the maker.
Small contactless payments are sometimes allowed without a fresh unlock on certain card types, but wallets generally ask for an unlock first, and larger transactions may require extra confirmation. Limits vary by country and bank.
Compared with a plastic card
Whether a phone is “safer” than a card is a matter of trade-offs, not a flat rule.
Advantages of a wallet:
- The real number is not handed over at the terminal.
- Payment normally requires unlocking the device, whereas a physical contactless card may work for small amounts without any check.
- A lost phone can be locked or wiped remotely, and the tokens disabled.
Things to weigh:
- Your phone becomes a more valuable target. A strong passcode and automatic locking matter, as do software updates.
- A thief who knows your passcode and has your phone could potentially misuse it. Shoulder-surfing a passcode in a public place is a real concern for any device.
- If the battery dies or the device fails, you may need a backup way to pay.
- Not every shop or country supports every wallet.
Planning for a lost phone, including how to lock it and remove cards remotely, is worth doing before it happens.
Online and in-app use
Wallets are also offered at online checkouts and within apps. Here the wallet usually provides a token and asks you to authenticate on the device, so you do not type your card details into every site. This can reduce the number of places where your real number is stored, and it makes it harder for a lookalike page to harvest typed card data, though you still need to confirm you are on the genuine site.
Other points of caution
- Adding cards. Be wary of messages asking you to add a card to a wallet or read out a code; this is a known scam technique, in which a fraudster tries to add your card to their own device. Real banks do not usually ask you to share verification codes.
- Notifications. Turn on payment notifications so unexpected activity is visible quickly.
- Shared devices. Family members’ fingerprints or faces registered on a phone may be able to authorize payments, so check what is enrolled.
- Privacy. The wallet provider and your bank may see transaction information. Their policies describe what is collected; the privacy policy is where to look.
Used with a strong lock and sensible habits, a mobile wallet adds protections that a card alone lacks, but no payment method is risk-free.