How does tap to pay actually work?
The shop never learns your card number. It has not learned it for years, and nobody told you.
The number that leaves the phone is single use. Even a captured signal cannot be replayed.
What is actually on your phone
When you add a card to a phone wallet, the card number is not stored on the device. The network issues a device account number, a different number tied to that specific phone, and that is what lives in the secure chip.
So your phone holds a card number that only works from your phone. Your plastic holds a different one. Same account, two credentials, and one of them cannot be used anywhere else.
The half second at the terminal
Three things happen when the phone touches the reader.
You authorise. Face, fingerprint or passcode. That happens on the device, before anything transmits, which is why a stolen phone with no biometric is not a payment instrument.
The chip generates a one-time code. A cryptogram computed for this transaction, this amount, this moment. It is the crucial piece: even a perfect copy of everything transmitted cannot be replayed tomorrow, because tomorrow's code is different.
It travels the ordinary rails. Device number and cryptogram go to the terminal, then along exactly the same path as any card payment: acquirer, network, issuer. The issuer maps the device number back to your real account, checks the cryptogram, and answers.
Nothing about the rail is new. Only the credential changed.
Why it is safer than the card
A shop that is breached leaks device numbers and used cryptograms. Both are worthless. Compare that to a magnetic stripe, which leaked a permanently reusable secret to anyone who could read it.
The contactless limit on plastic exists because plastic has no biometric. A phone has one, which is why phone taps often clear well above the card limit with no further prompt. You already authenticated, more strongly than a signature ever did.
The part people get wrong
Tap to pay is not a payment method. It is a way of presenting a card. The money still moves on card rails, the merchant still pays interchange, and a chargeback still works exactly as it always did. Nothing about your protections changed when you stopped using the plastic.
Handing over a photocopy of your passport that is valid for one border crossing, at one border, today. Losing it is a shrug rather than a crisis.
Where you meet it
Every terminal you have hovered a phone over, every "card limit exceeded, please insert" that a phone would have cleared, and every watch that paid for coffee.