Which standard applies to a contactless bank card?
The radio layer is ISO/IEC 14443, the same one NFC tags use, which is why your phone notices the card at all. Above that sits a payment application specified by EMVCo, and driving it requires being a payment terminal with the relationships that implies.
Two layers, two owners
Underneath, a contactless card is an ISO/IEC 14443 device. It is powered by the reader's field, it answers by load modulation, and it runs the transmission protocol that Android exposes as ISO-DEP. All of that is shared with ordinary NFC tags.
On top sits a payment application specified by EMVCo, the body owned by the major card schemes. That layer is where anything meaningful happens, and it is governed by rules that have nothing to do with the NFC Forum.
What an ordinary application sees
Very little, and less than the internet suggests.
A general purpose application can establish that a card is present, identify the technology and read the identifier used during selection. Beyond that it is talking to a payment application that will decline to answer anything it is not obliged to answer, to software that is not a terminal.
Demonstrations showing more than this exist, and what they mostly show is that some cards historically exposed more than they needed to. Treating that as the normal state of affairs is a mistake, and treating it as a reason for alarm is a bigger one.
Why nobody can charge your card by walking past
Three things have to be true at once for money to move, and an attacker with a phone in a crowd has none of them.
The card must be within a few centimetres, which is a physical constraint no software removes. The exchange must come from an accredited terminal, because the transaction has to reach an acquiring bank that will only accept it from a merchant it knows. And the card performs a cryptographic exchange whose output is specific to that transaction, so a recording of a previous one is worth nothing.
The remaining risk is real but different in shape from the one people picture: it concerns fraudulent merchants rather than proximity, and it is addressed by the banking system rather than by shielding your wallet.
What changes when the card is your phone
When a phone pays, it presents a payment application from a secure element rather than a plastic card, using card emulation. The terminal sees something that behaves like a card.
What differs is the protection around it. A card is available to any terminal it is held against. A phone typically requires unlocking or a biometric check first, which adds a step no plastic card can offer. That is the substantive security difference between the two, and it favours the phone.
Frequently asked questions
Can an NFC application read my card number?
Some cards have historically exposed more data than necessary to applications that ask, and this has been demonstrated. It is neither universal nor what the specification intends, and it does not enable a payment, since a transaction requires a cryptogram the card only produces for a real exchange.
Do RFID blocking wallets protect me?
They do prevent a card being read, by spoiling the coupling rather than by blocking a wave. Whether that addresses a risk worth addressing is a separate question, given that the range is a few centimetres and a transaction needs an accredited terminal.
Why does my phone detect the card but show nothing useful?
Because it reached the payment application and was refused. Detection happens at the radio layer, which is open, and everything above it is governed by rules that exclude general purpose software.
Is a contactless card an NFC tag?
It shares the radio layer and it is not a tag. A tag hands over stored content, a card runs a protocol. This is why an application that reads tags perfectly does nothing useful with a bank card.