What are the steps of an NFC contactless payment, and what protects the real card number?

Activation (proximity) → encrypted communication → tokenised data transfer (not the real card number!) → dynamic authentication code → authorisation. Tokenisation plus a per-transaction dynamic code is the key protection.

An NFC transaction runs in five steps:

1. Activation: the NFC chip in the phone or card is activated by proximity to the terminal.
2. Communication: an encrypted connection is established between device and terminal.
3. Data transfer: tokenised payment data is transmitted — not the real card number.
4. Authentication: a dynamic authentication code is generated and validated.
5. Authorisation: the payment processor checks and approves the transaction.

Tip: Two layers defeat skimming: tokenisation (the terminal never sees your real PAN) and the dynamic per-transaction code (a captured code is useless for a second payment). This is why NFC payments are far safer than reading a magnetic stripe.