Technology
NFC operates at 13.56 MHz and supports card emulation, reader, and peer-to-peer modes. Financial applications often rely on a Secure Element (SE) or cloud-based card; Android HCE emulates cards via the host. The acceptance terminal must pass UnionPay/PCI-related certifications.
Internet of Things
Access control and vending machine hybrids connect the reader MCU with a 4G module, sending transaction messages to the TSP. Antenna design and metal environment tuning are critical.
Security
Protection against side-channel attacks and firmware cloning; key injection production lines must be controlled.
Antenna, structure, and metal environment
NFC near-field coupling is extremely sensitive to coil geometry, ferrite shielding, and metal proximity. If a vending machine or access control hybrid places the reader close to a metal door panel, the magnetic circuit and matching network must be redesigned; otherwise, reading distance may sharply decrease or an ISO14443 session may fail. When deployed alongside 4G/Wi-Fi antennas, evaluate whether 13.56 MHz harmonics and spurs interfere with cellular reception; add filters and layout isolation if necessary. The production line should use standard reference cards and multi-axis positioning fixtures to reproduce the worst-case posture, avoiding "works in the lab but fails in the field."
Transaction linkage with cellular modules
After the card reader MCU completes offline or online authorization, the transaction message is usually sent to the TSP or acquiring platform by the cellular module. It is necessary to design timeout, retry, and reversal mechanisms to prevent duplicate charges caused by weak networks; keys and terminal numbers should be written into secure storage and support remote revocation. For HCE and cloud cards, the clocks, random numbers, and certificate chains on both the phone side and the terminal side must comply with card organization specifications. Remote operations and maintenance should support firmware signature upgrades and blacklist synchronization, and monitor abnormal transaction rates and card reading failure codes on large screens.
Engineering Practice Supplement
Combine "NFC payment" with the full lifecycle of the module: verify reference designs and antenna solutions during the EVT phase; conduct conduction/radiation benchmarking and thermal imaging during the DVT phase; and solidify calibration and test scripts during the PVT phase. Check target country regulations and operator entry requirements before certification to avoid missing frequency bands or SAR items. The mass production line should retain golden samples for comparison and random inspection rules; after-sales should be able to trace software versions, calibration parameters, and key component batches by serial number. If the customer requires remote operations and maintenance, security upgrade, rollback, and emergency shutdown strategies must also be designed at the same time.
Near-Field Coupling Distance and Transaction Boundaries
NFC payment takes place in a 13.56 MHz magnetic field. The reader coil induces energy in the card or phone coil, and the two sides complete anticollision, card selection, and mutual authentication under ISO/IEC 14443. The application layer then runs the card scheme's purchase or load commands. Card emulation can run inside a secure element, or the host can use HCE to forward commands to a cloud card. Peer-to-peer mode is almost never used for acceptance. The cellular module does not join that near-field exchange. It appears only for online authorization, blacklist delivery, and transaction upload. Treating "the module has attached" as "a card can be read" mixes a coverage fault with a read-range fault.
Payment-grade read range is usually only a few centimeters. Field strength, modulation depth, and frame waiting time all have to fall inside the card scheme's terminal test conditions. When small offline amounts are allowed, the local limit, blacklist, and transaction counter must be auditable. When online authorization is required, the cellular timeout must be shorter than the acquirer's authorization window. Otherwise the cardholder has already left and the reversal is still queued. An external reader chip and the cellular module commonly use UART or SPI. Baud rate, flow control, and buffer depth must be sized for the longest transaction message, not estimated from the heartbeat alone.
Read Range and the Reversal Window on Site
A stainless panel, a metal door frame, or a battery packed against the coil pulls the resonant frequency off. The symptom is a beep with failed card selection, or a lab range of a few centimeters that becomes an occasional success only when the card is pressed flat against the reader. A ferrite sheet can pull the field only part of the way off the metal. It does not replace a new match. A second class of error sits in the state machine: the same authorization is submitted again on a weak network. If the acquirer deduplicates on the terminal trace number instead of a global idempotency key, the card is charged twice. If the reversal arrives later than the next purchase, it can reverse the wrong transaction.
If key injection shares a station and a log directory with ordinary firmware download, side channels and plaintext logs cancel the point of the secure element. Without device attestation, HCE can copy a cloud card onto an unmanaged phone. Compared with QR code payment, a near-field transaction is more sensitive to structure and metal and less sensitive to screen brightness. When both acceptance methods share one module, failure codes should still be stored separately, so a channel return code is not used to explain a failed card read. Settlement time should not be taken from the module clock. The day-cut has to follow the channel settlement day described in settlement and reconciliation.
Acceptance tests should record "the field is up" and "the transaction is complete" as separate facts. Field up only means anticollision and card selection succeeded. Completion also requires the application command to return within the frame waiting time, and the host to hold one definite result: approved, declined, or timed out. After a bare card passes at a standard spacing in the lab, a production fixture that adds a metal door frame shifts coil resonance again. Sampling with a bare card then leaves the range problem for the gate. On the cellular side, authorization, reversal, and void should be written as three terminal states in a record that survives power loss, not left as the last transaction in RAM. If a PAN or a track equivalent appears in that record, truncate it before upload. Card-read failure, attach failure, and acquirer timeout belong in three fields, so a complaint can show whether to change the antenna, the timeout, or the reversal order.