Where NFC security lives — SIM, embedded, or add-on secure element — and who controls it

01 / FIELD NOTE

Keep the decision tied to the operating context.

An NFC phone is more than a chip and an antenna: alongside the radio there is a secure element — the hardware that holds the credentials and executes the cryptography that make a contactless payment or an access pass hard to copy. Where that element lives decides who controls the applications on it, whether the wallet follows the user, and how well the radio behaves. The three form factors make that decision concrete, and the difference between them is ownership as much as engineering.

The SIM-card secure element is the mobile operator’s choice. The card is issued and owned by the operator, and the element rides inside it, so the operator controls which NFC applications are downloaded, stored and used. The engineering case for it is strong: over-the-air management of the SIM is standardized and proven, the applications move when the subscriber moves the card to a new phone, and the card is always reachable through the phone number of the subscription. What the operator gains is control of the wallet, which is exactly why non-operator issuers look elsewhere.

The embedded secure element is the phone manufacturer’s choice. Soldered into the device as part of the phone, it is controlled by whoever owns the handset — often the manufacturer who runs a wallet of its own. The embedded form has the strongest radio and the simplest integration, because the element sits on the same board as the NFC controller and the antenna is tuned for that combination. The trade is portability: the element is part of this phone, so an application bound to it cannot follow the user to the next handset the way a SIM application can.

The add-on secure element is the issuer’s way in without an operator. The most successful form has been the NFC-enabled microSD card: it slides into a standard slot, carries its own secure element, and lets a bank or a payment service issue a wallet without depending on a mobile operator. The issuers who ran pilots liked precisely that independence. The technical challenge is radio performance, because the element sits wherever the slot is, and the antenna and back cover of the phone decide how well the coupling works.

The transport that connects the element to the NFC controller is the same in the SIM and add-on cases: the Secure Wire Protocol (SWP), which moves data between the radio and the secure element on the phone. The protocol is the plumbing that makes the form factors interchangeable — the element’s location changes, the way it talks to the radio does not. The interesting consequence is that the application layer cannot tell which form factor it is running on; only the ownership and the radio do.

Portability is the property the SIM form factor sells. Because the subscription and the element live on the card, moving the card into a new NFC phone moves the wallet and its applications with it, and the operator’s backend can detect the new device the moment the card is inserted. That is a real advantage in a world of frequent phone changes, and it is the reason operators keep building network-centric wallets even as handset manufacturers push their own.

Ownership is the property the other two trade on. The embedded element answers to whoever sold the phone; the add-on element answers to whoever issued the card. A bank that wants to issue a payment application without waiting for an operator or a handset maker chooses the add-on, accepting the radio constraints in exchange for independence. The design question is therefore never just technical — where the element sits is decided by who needs to control the applications on it, and portability and radio are consequences of that choice.

The honest limit: the element decides where the credentials live, and it cannot decide who they belong to. A secure element holding one wallet is one point of control, and the credential never leaves the silicon — but the identity it represents is still the issuer’s, and the phone it rides in is still someone else’s. The architecture answer is a supply chain of trust among operator, manufacturer, issuer and device, in which the physical form factor is only the visible end. The form factors described here are the map of who is on that chain, not the chain itself.