Digital wallet guide: Credentials and payment flows

What to take away

The word wallet covers at least four structures. One app presents a bank card through a device token. Another holds a stored balance the company owes you. A merchant app keeps a card on file. A crypto wallet holds private keys, not dollars.

Ask what the wallet stores, what it can instruct, and who holds the underlying account.

A functional definition

A digital wallet is software and services that organize credentials or value and present them for a transaction. It runs on a phone, watch, browser, merchant account, or dedicated device.

The Federal Reserve's 2023 payments survey glossary counts wallet payments across NFC, QR, barcode, in-app, and browser channels. It separates tokenized credentials, which use a substitute account number plus a transaction-specific code, from the printed card number.

That definition serves measurement. Your wallet agreement decides what the product actually does.

Map the five layers

Different companies usually control different layers. Removing a card from one phone does not close the card account, cancel a merchant subscription, delete a cloud pass, or withdraw an app balance.

Card credentials and payment tokens

A device wallet provisions a payment token tied to an eligible card. The token stands in for the primary account number inside a defined domain, which the issuer can limit by device, merchant, or channel.

Tokenization shrinks exposure of the real account number in supported flows. It does not make a purchase anonymous, stop all fraud, or remove the issuer from the decision. The merchant still receives transaction and customer data, and other parties can link token records to an account within their role.

Device and cloud roles

Some wallet data lives only on the device. Other data syncs through a cloud account. A watch can carry its own payment credential even when paired to a phone.

So one wallet can hold several states at once: card active at the issuer, token active on the old phone, token suspended on the lost watch, pass synced in the cloud, stored balance reachable by web login.

Inventory devices and credentials. Do not treat the wallet as one object.

Contactless acceptance

Near-field communication lets a compatible device and terminal exchange data at short range. A contactless symbol marks a reader capability.

A completed payment also needs merchant configuration, wallet eligibility, a network route, an issuer decision, and acceptable transaction conditions.

A tap is a presentation step. The terminal can request a fallback, the issuer can decline, or the merchant can lack support for that wallet even when its reader takes contactless cards.

QR, barcode, in-app, and browser flows

Not every wallet payment uses NFC.

QR or barcode

The customer or merchant displays a code. Scanning may identify the recipient, open a payment request, or present a credential. Check the recipient and amount after scanning, because a printed code can be swapped.

In-app checkout

The merchant app calls a wallet or payment service, and the customer approves without retyping card details. Save the merchant order number and the wallet transaction ID together.

Browser checkout

A wallet button presents a saved credential inside a web session. Confirm the domain and the final merchant before approving.

Merchant-stored credential

A merchant may call its saved-card feature a wallet. That is usually a card-on-file arrangement, not a general device wallet. Removing a card from your phone will not remove the merchant's copy.

Stored value versus credential presentation

A wallet showing $75 might hold a program balance, mirror a bank balance, report a pending transfer, or aggregate another institution's data.

For every displayed balance, identify:

A card wallet works without holding customer funds. A stored-value wallet can hold funds without supporting tap-to-pay.

Named products, fees, and protections

Apple Pay, Google Wallet, and Samsung Wallet can present eligible payment cards from a device. PayPal, Venmo, and Cash App offer payment services that may include a stored balance, while Zelle moves money through participating banks and credit unions rather than holding a wallet balance. Features depend on the specific service, account, and enrollment, so check the product terms and identify the legal entity.

Tokenization may also involve card-network services such as Visa Token Service or Mastercard Digital Enablement Service (MDES). There is no universal wallet fee: a provider may charge for particular transfers or withdrawals, and a linked card or bank may have separate charges. Check the applicable fee schedule before moving money.

Regulation E, which implements the Electronic Fund Transfer Act, sets protections and error-resolution requirements for covered electronic transfers. The CFPB's Prepaid Accounts Rule applies to certain prepaid accounts, not automatically to every wallet or payment app; coverage depends on how the product is structured. Check the account disclosures for the applicable process and deadlines.

FDIC insurance covers eligible deposits at insured banks, not wallet apps as a category. Pass-through coverage may apply when funds are held as bank deposits and the applicable recordkeeping requirements are met. Some stored-value providers may also need state money-transmitter licenses; money transmitters generally must register with FinCEN as money services businesses, subject to exceptions. Consumers can submit complaints to the CFPB or contact the relevant state financial regulator.

What happens during a device-wallet card purchase

A common sequence runs as follows:

Device authentication confirms a user action under the wallet's design. It is not issuer approval. The issuer can still decline, and an on-screen checkmark may only report that the credential was transmitted.

When you dispute a charge, save the wallet transaction display and the merchant receipt or order. Also save the card statement line, the device used, and the token suffix. Save the date, amount, currency and status, plus both case numbers.

Privacy map

Possible recipients of your data include:

Ask which party receives account identity, device and location data, purchase history, and loyalty activity.
Ask which party receives contacts and advertising identifiers.

Tokenizing a card number does not answer the privacy question. Read permissions and privacy notices as separate documents.

Recovery map

Also prepare:

After a loss, separating a disabled device token from a closed card matters. The issuer may suspend one credential and keep the account open. Follow its verified instructions rather than a search result.

Common questions

Does a digital wallet store my money?

Sometimes. A stored-value wallet can hold a balance the provider owes you. A device card wallet usually presents a credential tied to an account at a bank or card issuer.

Is NFC the same as tokenization?

No. NFC is a short-range way for a device and terminal to communicate. Tokenization substitutes a credential for a card number. Products use them together, but either can exist alone.

Does a tokenized purchase skip the issuer?

No. A typical card-wallet purchase still reaches the issuer for an authorization decision, and the issuer can decline it.

Will deleting the wallet cancel my subscriptions?

Not necessarily. Merchant-stored credentials and the contracts behind them survive. Cancel through the merchant's own documented process.