What happens when you tap your phone to pay?
The radio, the stand-in number, and who gets paid on a $10 tap.
-
Why now
A truck stop in North Dakota went to court over 21 cents
Ruling filed
A truck stop and convenience store sued over a fee no customer ever sees on a receipt. The case reached a federal appeals court, which is a long way to carry 21 cents.
The 21 cents is the base of a US cap on what big banks can collect from the shop's side when you pay by debit card. A court struck down the cap on October 26, 2026, but it still applies for now. The court set no new number. It told the Fed to write a new rule. Source
You never see this fee, and who really ends up bearing it is still argued about. To see why anyone would fight over it, follow the money.
Guess first. You tap to pay $10 at a small shop. How much does the shop keep?
- $10.00 The receipt says $10, so this is a fair guess. Someone takes a cut before it reaches the shop. On one common price list, the shop keeps $9.59.
- About $9.60 That's close. On Square's list price the shop keeps $9.59, and on Stripe's with a reader it keeps $9.68.
- About $8.00 That's too low. On a small sale like this one, the cut is about 3 to 4 cents on the dollar.
The receipt says $10 either way. On Square's list price the shop keeps $9.59.
-
Step by step
It starts with a very short radio
Your phone talks to the shop's terminal over NFC, a radio that runs at 13.56 MHz. The standards group gives a typical range of up to 2 cm. It certified devices at 5 mm for years, and since October 2025 its tests can reach 2 cm. That's why you have to hold it so close. Source Source Payment readers have their own test rules, which reach 4 cm. Source
The phone acts like a contactless card. That's why one terminal can take a card, an iPhone and an Android phone without caring which is which. The terminal sends a command, the phone replies, and they take turns. Source
A tap is not always a phone. About 4 in 10 US in-person card payments were contactless in 2024, and a tapped plastic card counts. Data In a separate survey of US adults, phones were 11% of in-person payments. Source
-
Step by step
Your phone doesn't send your card number
It sends a stand-in called a device token: a card number for one wallet on one device. Source With plastic, the shop gets the printed number. With a wallet, the shop never gets the real one. Source
That pays off when something goes wrong. If you lose the phone, the bank can suspend that one token without replacing your plastic card. Source
On an iPhone, the token and keys sit in a certified security chip and never on Apple's servers. Source Android allows two designs, a chip or an ordinary app, so it varies by phone. Source
You pay with your phone. What does the shop get?
- Your real card number That's what plastic hands over. A wallet sends a stand-in instead.
- A stand-in number made for that one device The token works like a card number for this one wallet, so the real number stays out of the shop's hands.
- Your name and bank balance Neither one is what the phone hands to the terminal. Your balance stays at your bank, which simply answers yes or no.
-
Step by step
Then it signs a code that only works once
Each payment comes with a one-time code, computed from a key and a counter that goes up with every payment. The key is loaded when you add the card, and your bank or the network holds it too. Source The code is valid only for its own transaction, so it can't be reused in another one. Source
A comparison, and only a comparison: a magnetic stripe is like showing the same ID card every time. The code is like a new note for each purchase, signed with a pen only you and your bank hold.
No system is perfect. Security researchers have published design flaws in how contactless pieces fit together. Source
Why does a fresh code matter?
- It makes the payment faster Speed isn't what it's for. Think about what a copy of old data could do.
- It tells the shop who you are It doesn't. The shop sees the same stand-in number, and the code means something only to your bank or network.
- A copy of one payment's data can't be used for another With a stripe, copied data looks the same as the real thing. A code that is valid once takes that away.
-
Step by step
Your tap makes a round trip
- Your phone
- The shop's terminal
- The shop's processor
- The card network, which turns the token back into your real number
- Your bank or card company, which says yes or no
The answer comes back the same way. Your bank checks the card, then whether the account is open and can cover it, with fraud controls along the way. Source
Visa and Mastercard are not your bank. Neither one issues cards or lends money. American Express is different: it does both. Source Visa's rules give a US bank 10 seconds to answer, and then Visa answers for it. Source We could not find a measured time for the whole trip. In Israel, a national switch called SHVA sits between terminals and card companies. Source
Who decides whether your payment goes through?
- Your bank or card company The bank that issued the card checks it and answers. The others mostly carry the message.
- Visa or Mastercard They run the road. They don't issue the card or lend the money, though Visa answers if a bank runs out of time.
- Apple or Google The wallet hands over the token and code. The yes or no comes from your bank.
-
Step by step
And no money has moved yet
Card payments happen in three stages.
- Authorization: your bank says yes and places a hold.
- Clearing: the banks exchange information about the sale.
- Settlement: the banks exchange money.
A 2007 Mastercard diagram shows clearing usually within a day and settlement usually within two. Those are old numbers, and we could not find a current official count. Source
Settlement doesn't happen one coffee at a time, either. Each bank's activity gets added up into one lump sum. Source By the time you reach the door, your coffee has been approved, not paid for.
What has happened when the terminal says approved?
- Your money has reached the shop Not yet. That comes later, and through a lump sum between banks.
- Your bank has said yes and placed a hold The approval shows on the terminal, and your phone's buzz only means the tap finished. The banks pay each other later.
- The banks have settled up Settlement is the last stage, and on the old figures it takes a day or two.
-
Try it
Follow the money yourself
US, Visa, in person. A processor is the company that handles card payments for a shop. This shop pays Square's list price, a flat rate for any card. Everything here is arithmetic from published price lists, using Visa's ordinary in-person rows so $10 and $100 run on one formula. Restaurants, supermarkets and very small shops have other rows. So do small sales, and a $10 sale may count as one. Source
This experiment needs JavaScript. On $10 with a rewards credit card: the shop keeps $9.59, the bank gets 26.5 cents, the network's two main fees 3.35 cents, and the processor what is left, 11.15 cents. On a big-bank debit card the bank gets 22.5 cents at $10 and 27 cents at $100. On a small-bank debit card it gets 23 cents at $10 and 95 cents at $100.
At $10 the two debit cards pay their banks almost the same. What happens at $100?
- They stay about the same Try the $100 button with each debit card and look at the bank's row.
- The small bank gets 95 cents and the big bank 27 cents The small bank's rate has a much bigger percent, so it grows with the price. The big bank's cap is mostly a fixed amount, so it barely moves.
- The big bank gets far more It's the other way around. The cap holds the big bank down, and smaller banks are exempt.
-
Step by step
What the court actually said
The cap is 21 cents, plus 0.05% of the sale, Source plus 1 cent for banks that meet fraud standards. Source It covers banks with at least $10 billion in assets. Source
The law tells the Fed to consider the extra cost of a particular transaction. Picture a lemonade stand: the lemons in your cup are an extra cost, and the stand itself is a fixed one. The court said fixed costs can't count, and that the Fed's job is "not just pick a number and hope it is close enough for government work." Source
Bank groups say banks, credit unions and consumers will pay for this. Source Retailers applauded. One analyst guesses a new cap could be under 5 cents, and that is only a guess. Source Check back: the court's order hasn't taken effect yet.
Where does the 21-cent cap stand today?
- It's gone, and big banks charge nothing now The ruling hasn't taken effect, and the court didn't say the fee goes to zero.
- The court replaced it with 5 cents That is one analyst's guess. The court set no new number and sent the rule back to the Fed.
- It was struck down, it still applies for now, and no new number exists yet Keep all three parts together. This may change, so check the date at the bottom of this lesson.
-
Step by step
Who pays for card rewards?
Card rewards reached $47.5 billion in the US in 2024. The fee shops pay is one source of that money. Source Source
Shops usually charge one price whatever you pay with. So in a model by researchers at the Federal Reserve and the Bank of Canada, using US data from about 2018, people paying with debit and cash help cover credit card rewards. Rewards came to 0.70% of purchases for the highest-income group and about 0.25% for the two lowest. Source The amounts change with the model's assumptions, and people still argue about them.
We explain how the system works. We don't tell anyone which card to get or what to buy.
What's one big source of the money for card rewards?
- It's a free gift from the bank The money comes from somewhere.
- The fees shops pay on each card sale Yes. Who ends up bearing that cost is the part researchers model and argue about.
- Visa and Mastercard's own profits The fee goes to the bank that issued the card, and the bank funds the rewards.
-
The honest part
What does a tap actually prove?
On a phone, it usually proves someone passed that device's check, like a face or a passcode. Some setups, like transit modes, can skip it. It doesn't prove who you legally are. Anyone whose face or passcode works looks the same to the bank. Source A plastic card under the limit proves only that someone is holding it. Israel's limit is NIS 300. Source We could not find a published US figure.
Is it safer? We can't tell you. In the UK in the first half of 2025, contactless cards ran at 1.2p of fraud per £100 spent, against 6.9p for all card fraud. But that 6.9p includes online, phone and mail fraud, about 72% of UK card fraud losses in that half-year, and a tap can't be used for those. Source We found no rate for phones alone, and none at all for the US or Israel.
Your brother knows your passcode and pays with your phone. What does your bank see?
- The same thing it sees when you pay The bank sees that the device's check passed. It doesn't see whose thumb it was.
- A warning that someone else is paying Nothing in the tap identifies the person, only that the check passed.
- Your brother's name Nothing in the tap tells the bank who is holding the phone. The token stands for the card on that phone.
-
Your project
Build the calculator
- You will have Your own table that takes any price and shows what each party gets, and a graph of how the cut changes.
- Time About 45 minutes.
- You need Paper and a calculator, or LibreOffice Calc (free, no account). No card, purchase or bank account.
- Make one row per card, using these rates from Visa's sheet: rewards credit 1.65% + 10¢, premium credit 2.30% + 10¢, big-bank debit 0.05% + 22¢, small-bank debit 0.80% + 15¢.
- Add the shop's total, using Square's list price: 2.6% + 15¢.
- Add the network's two main fees, about 3¢ at $10 and about 15¢ at $100. The rates are in this bank's schedule.
- Find the price where small-bank debit passes big-bank debit. You should land near $9.33.
- Graph the bank's share of the price from $1 to $100 for each card. Which line falls fastest? Why?
- Type in your own guess for a new cap, and see who gains on this flat-price plan. Be careful: the shop's bill doesn't change.
Want more?
With a parent or teacher aware, ask a neighborhood shop owner roughly what card companies take in total. Only ask for a rough percent, never statements or customer details, and it's fine if they say no. Work out a day, a month and a year, then turn it into what the shop sells: how many falafels is that? Outside the US, stick to what the owner tells you, because these rates are US only.
-
Done
Back at the counter
Tomorrow you will buy something small. The phone will buzz, and you'll already be turning toward the door. The receipt will say $10.
It won't mention the truck stop.
Another lesson How does an AI pick its next word?Sources
- Eighth Circuit opinion, No. 25-3000, filed Oct. 26, 2026.
- 12 CFR 235.3, 235.4 and 235.5: the debit cap.
- Visa US interchange sheet, effective Oct. 24, 2026, and Visa Core Rules, Oct. 2026.
- Wells Fargo pass-through schedule, effective July 1, 2026 (the two main network fees, shop side only).
- CardFellow, a payment guide, on the small-sale limit, which Visa's own sheet doesn't state.
- Square and Stripe list prices.
- US Justice Department complaint, March 21, 2024, paragraph 113: the alleged Apple fee. An allegation, not a finding. MacRumors, Sept. 25, 2026: the debit figure, from a class action.
- Apple and Google: no added fee for shops.
- NFC Forum and its Oct. 2025 certification notice, EMVCo tokenisation guide, Apple Platform Security, Android developer docs, Google Pay docs.
- Philadelphia Fed, 2013, and Mastercard, 2007: clearing and settlement. Older sources, so timing may have changed.
- CFPB, Oct. 2023 and Dec. 2025, and Felt et al.: rewards.
- BIS payments data (43,041 million of 110,944 million in 2024) and the Fed's Diary of Consumer Payment Choice, 2025.
- Bank of Israel overview, Aug. 2024: SHVA and the NIS 300 limit.
- UK Finance, 2025: UK fraud rates.
- American Banker, Oct. 26, 2026: the 5-cent guess. Joint bank trade groups' statement.
The $10 and $100 shares are our arithmetic from those lists. They mix three price lists with different dates, and the processor's share is only what is left. The Israeli numbers are limited to what we could confirm.
Last checked . The debit cap case is moving, so these numbers may change. Torah Tech researched and wrote this lesson with the help of Claude, an AI made by Anthropic. Any mistakes are ours.