Contactless Payment
PCIComplianceHubLast updated
A transaction where the card or device is tapped against a terminal rather than inserted or swiped, using near-field communication. Contactless payments carry the same EMV cryptographic protections as chip transactions and are treated as card-present. The account data involved is in scope for PCI DSS in the same way as any other acceptance channel.
Applies to. No PCI DSS v4.0.1 requirement names contactless; it is a card-present channel in which the tap delivers the PAN and chip data to the terminal, so Requirement 3's storage limits and Requirement 9's terminal protections apply as for a chip or swipe. A phone or watch tapped instead of a card presents a wallet token rather than the card's own PAN, but the merchant's terminal and systems remain in scope for whatever account data they receive. Contactless taken on a phone with no separate reader is the case the Council's CPoC and MPoC standards cover.