What does a payment terminal actually receive?
Enough to route the transaction to the right bank and a value proving the card participated in this particular purchase. The card is a small computer deciding what to answer, not a store the terminal reads, and that distinction is why the exchange cannot be repurposed.
A computer, not a store
The mental model that causes the confusion is a card as a container the terminal opens. Under that model, whatever is inside is exposed to whoever reads it.
The accurate model is a card as a small computer running an application. The terminal asks; the application decides what to answer and refuses the rest.
Everything that follows is a consequence of that. A card is not read, it is interrogated, and it holds the right of reply.
What crosses, in shape
Routing information, so the transaction reaches the institution that issued the card.
A value computed for this transaction, which proves the card took part and cannot be produced without it.
Data about the transaction itself, assembled by the terminal rather than supplied by the card.
The exact fields, their names and which are mandatory are specified in the EMV contactless specifications published by EMVCo, and that specification rather than this page is the authority on them.
What does not cross
The keys inside the card, which never leave under any circumstance and are the reason the transaction value cannot be forged.
Anything the payment application is not obliged to answer for, which is a great deal more than people assume and includes much of what a card is imagined to carry.
And nothing at all about you as a person beyond what the card issuer put there, since a card holds no history of where it has been.
Why the distinction matters
Because it explains why capturing an exchange is not the same as capturing a card, and why the entire replay class of attack fails.
It also explains why a general purpose application on a phone gets so little from a payment card: the application is not a terminal, and the card answers accordingly.
Take NFC Tools. On iOS it requires an iPhone 7 or later running iOS 15.6 or later, and the app must be launched manually. Background reading is available from the iPhone XS and XR onwards.
And it sets the right expectation for anyone building with NFC: the payment layer is a closed system with its own rules, adjacent to the tag world rather than part of it.
Frequently asked questions
Does the terminal read my card number?
It receives what the payment application answers with, which is what the schemes require for routing and proof. The card is not simply read.
Are the card's keys ever sent?
No. They stay inside the chip, which is why the value proving the transaction cannot be produced by anything else.
Why does an app on my phone see so little?
Because it is not a terminal, and the payment application answers accordingly. That is deliberate rather than a limitation.
Does the card know where it has been?
No. A card holds no record of its own history, so there is nothing of that kind for a terminal to obtain.