Digital Wallets NZ
The common instinct is that paying with a phone must be riskier than paying with a card. It is a newer thing, it involves the internet somehow, and the card feels like the solid object. That instinct is backwards.
A digital wallet is, for most people, the safest way to pay that is available to them, and it is safest for a reason worth understanding rather than taking on trust.
The three things to remember
The merchant never receives your card number. Every payment is authenticated by your face, fingerprint or passcode. And the wallet itself costs you nothing, because the fee sits on the merchant's side.
Why the merchant never gets your number
When you add a card to a wallet, your card number is not what gets stored on the phone. The card network issues a substitute number tied to that specific device, called a device account number or token. Your real number stays with your bank.
At the till, the phone sends that token along with a cryptogram, a single-use code that is valid for that one transaction and useless afterwards. The merchant receives a number that is not your card and a code that cannot be reused.
| If the merchant is breached | Physical card | Digital wallet |
|---|---|---|
| What the attacker obtains | Your actual card number | A device token and a spent code |
| Can it be used elsewhere? | Often yes, especially online | No, it is tied to that device |
| What you have to do | Cancel and replace the card | Nothing, in most cases |
That is the whole security argument, and it is a structural one. It does not depend on the phone being well looked after or the shop being trustworthy.
What happens if you lose the phone
Less than people fear. A card in a wallet cannot pay for anything until the device is unlocked with your biometrics or passcode, so a phone in someone else's hand is not a card in someone else's hand.
A physical contactless card in New Zealand generally requires a PIN above a set amount, commonly around $200. A wallet payment is not subject to that ceiling in the same way, because the device has already authenticated you by biometrics before the payment is sent. The bank has stronger proof of who you are from a fingerprint than from a tapped piece of plastic, so the low-value shortcut is not needed.
Who pays for it
Not you. There is no consumer charge for adding a card or paying with it. The merchant pays their usual merchant service fee, at the same interchange rate as a physical contactless card, and the card issuer pays the wallet provider out of its own share.
Paying by phone abroad still carries your bank's foreign transaction fee and its exchange rate margin. The wallet is a way of presenting the card, not a different card. If your card charges 2.5 percent on foreign purchases, it charges it whether you tap plastic or a phone.
Overseas: the choice at the terminal that costs money
Abroad, a terminal will often offer to charge you in New Zealand dollars instead of the local currency. This is dynamic currency conversion, and it is almost always the worse option. Take an $100.00 Australian purchase with the market at 0.92 Australian dollars to the New Zealand dollar.
The one fraud that targets wallets
Tokenisation defeats card skimming and merchant breaches, so fraud has moved to the one step where a real card number is still needed: adding the card to a wallet in the first place.
The attack runs like this. A scammer already has your card details, from a phishing page or a data breach. They begin adding your card to their own phone. Your bank sends you a one-time code to approve it. They ring you, posing as your bank, and ask you to read out that code. If you do, your card is now in their wallet, on their device, working normally.
Never read a one-time code to anyone who rang you, no matter who they say they are, and no matter how convincing the reason. A real bank will never ask you to read a code back to them over the phone. If you receive a code you did not request, or a notification that your card was added to a new device, treat it as an attack in progress and ring your bank on the number printed on your card.
Notice what this fraud does not do. It does not break the tokenisation, or the phone, or the payment network. It asks you politely for the one thing the security cannot supply on its own.
If money goes missing anyway
New Zealand bank card terms generally provide that you are not liable for unauthorised transactions, with exceptions that matter. The usual ones are failing to keep your credentials secure, sharing your PIN or passcode, and not reporting promptly once you knew or should have known.
Sensible habits, briefly
Keep the device passcode long and not a birthday, since biometrics fall back to it. Turn on transaction notifications so an unexpected payment reaches you within seconds rather than at the end of the month. Do not add cards to a wallet on a device you share with someone else.
Batteries go flat and phones break, usually at the least convenient moment. Some places still do not accept contactless at all. Carrying one physical card as a backup is not a lack of confidence in the wallet, it is the same reasoning that keeps a spare tyre in a reliable car.
What this guide does not cover
Buy now pay later products presented inside a wallet follow their own terms and are not covered here. Bank card conditions differ between issuers, particularly on liability and reporting deadlines, so read your own. Wallet features and bank policies change, and this is general information rather than financial or legal advice.
Related guides and tools
- Avoiding scams guide, for the phone call that asks for your one-time code.
- Identity theft protection guide, for what a scammer does with the details first.
- Eftpos, debit and credit cards guide, for what sits behind the token in your wallet.
- Credit cards guide, for the card itself rather than how you present it.
- Merchant fees explained guide, for who actually pays when you tap.
Test Your Knowledge
Ten questions on wallet security, cost and fraud.
Sources: the EMVCo payment tokenisation specification, which defines the device account number and cryptogram model used by Apple Pay and Google Wallet; the Commerce Commission's interchange fee caps under the Retail Payment System Act 2022; and New Zealand bank card terms addressing unauthorised transaction liability. Bank terms differ, so read your own card conditions on liability and reporting, and confirm anything here with your bank.