Why is a phone payment safer than a card tap?
Two differences that compound. A phone will not pay until it has checked who is holding it, which a plastic card cannot do at all. And the credential it presents is specific to that device, so what a terminal sees is not the number embossed on your card.
The phone asks who you are
A plastic card is available to anybody holding it. It has no way of knowing whose hand it is in and no way of refusing.
A phone normally requires unlocking or a biometric check before it will present a payment credential at all. That step is performed on your device, by software you control, before anything reaches the terminal.
This is the difference that matters most in the case that actually happens: a wallet or a phone going missing.
The credential is the device
What a phone presents is provisioned to that device rather than being the number printed on your card.
The practical consequence is that a merchant, or anybody who obtains records from one, does not thereby hold the number on your plastic card.
How the provisioning works, and what exactly is presented, is specified by the payment tokenisation specification published by EMVCo and by each platform. Those specifications rather than this page are the authority on it.
It also means a compromise on one side does not automatically compromise the other, which is a structural improvement rather than a marginal one.
Why the two compound
Either alone would be worth having. Together they close the two ordinary routes at once.
A lost phone cannot be tapped by whoever finds it. A merchant record cannot yield your card number. Neither of those is true of plastic.
Card emulation, the mechanism that lets a phone behave like a card, is explained on the standards side of the site along with why you cannot use it to copy a card of your own.
What you give up
A phone runs out of battery and a card does not, which is the practical argument for carrying both.
Not every terminal or every country accepts phone payment equally, and a phone that is refused is a phone you need a fallback for.
And a phone is a more attractive thing to steal than a card, though a locked phone is a poorer prize than an unlocked wallet.
Carrying both, and preferring the phone, is the arrangement that gets the security benefit without the failure mode.
Frequently asked questions
Is a phone genuinely safer, or is that marketing?
Genuinely. It checks who is holding it before paying, and it presents a credential specific to that device rather than your card number.
Does the merchant get my card number?
Not from a phone payment. What is presented is provisioned to the device rather than being the number on the plastic.
What if my phone battery dies?
You need the card as a fallback, which is the practical argument for carrying both and preferring the phone.
Can I copy my own card onto my phone?
No. A phone credential is issued through the platform and the bank rather than copied, which is a separate subject.