What data is on a contactless card?
Keys and counters it will never disclose, plus whatever the payment application is willing to answer for. The important correction is that a card is not a file: it is a small computer choosing what to reveal, and the printed face of it usually gives away more.
What it holds
Cryptographic keys, which never leave under any circumstances and are the basis of every guarantee the card offers.
Counters and state, which let the card produce a value specific to each transaction rather than repeating itself.
A payment application, which is software with rules about what it will answer and to whom.
And identifying information the issuer put there, the extent of which is a matter for the issuer and the scheme rather than a fixed list.
What it will release
To an accredited terminal conducting a transaction, what the scheme requires for that transaction.
To a general purpose application on a phone, very little: that a card is present, the technology it uses, and the identifier used during selection.
The reason is not that the application lacks a clever technique. It is that the payment application is under no obligation to answer software that is not a terminal, and does not.
Take NFC Tools. On iOS it requires an iPhone 7 or later running iOS 15.6 or later, and the app must be launched manually. Background reading is available from the iPhone XS and XR onwards.
The printed face
The number, the name and the expiry date are printed on most cards and visible to anybody who looks at one.
Which means the exposure people worry about over the radio is generally smaller than the exposure of handing the card to somebody, or of it being photographed.
Cards without printing on the face exist for exactly this reason, and they address the realistic route rather than the imagined one.
It is worth holding both facts at once: the chip is conservative, and the plastic is not.
What the demonstrations show
Demonstrations exist showing more being read than the description above suggests, and they are usually genuine.
What they generally show is that some cards, historically, exposed more than they needed to, which is a matter of issuer choices and card generations rather than of the mechanism.
Treating those as the normal state of affairs is a mistake, and treating them as evidence that payment is unsafe is a larger one.
The question to ask of any such demonstration is what could be done with what was obtained, and the answer is usually nothing.
Frequently asked questions
Can an app read my card number?
A general purpose application gets very little: that a card is present, its technology, and the selection identifier. The payment application declines the rest.
What is on the card that matters?
Keys that never leave it, and state that lets each transaction produce a unique value. Neither is obtainable.
Is the printed face a bigger exposure?
Usually yes. The number, name and expiry are visible to anyone who looks, which no radio precaution addresses.
What about videos showing card data being read?
Some cards historically exposed more than needed. The question is what could be done with it, and the answer is normally nothing.