Return of NFC: Curse of the secure element

by Cherian Abraham 8 min read March 13, 2013

This post is in response to the recent Bankinter story of NFC payments at the point-of-sale without requiring SE – and the lack of any real detail around how it plans to achieve that goal. I am not privy to Bankinter’s plan to dis-intermediate the SE, but as I know a wee bit about how NFC works, I thought a post would help in clearing up any ambiguity as to how Card emulation and Host Card emulation differs, upsides, challenges – the whole lot.

Back in December of 2012, Verizon responded to an FCC complaint over its continued blocking of GoogleWallet on Verizon network. The gist of Verizon’s response was that as GoogleWallet is different to PayPal, Square and other wallet aggregators in that its reliance on the phone’s Secure Element – a piece of proprietary hardware, lies behind the reason for Verizon denying GoogleWallet from operating on its devices or network. Verizon continued to write that Google is free to offer a modified version of GoogleWallet that does not require integration with the Secure Element.

Now Software Card Emulation was not born out of that gridlock. It had been always supported by both NXP and Broadcom chipsets at the driver level. Among operating systems, BlackberryOS supports it by default. With Android however, application support did not manifest despite interest from the developer community. Google chose to omit exposing this capability via the API from Android 2.3.4 – may have to do with opting to focus its developer efforts elsewhere, or may have been due to carrier intervention. What very few knew is that a startup called SimplyTapp had already been toiling away at turning the switch back on – since late 2011.

Host Card What?

But first – let’s talk a bit about Card Emulation and how Host Card Emulation (or SE on the Cloud) differs in their approach. In the case of GoogleWallet, Card Emulation represents routing communication from an external contactless terminal reader directly to the embedded secure element, dis-allowing visibility by the operating system completely. Only the secure element and the NFC controller are involved. Card Emulation is supported by all merchant contactless terminals and in this mode, the phone appears to the reader as a contactless smart card. Google Wallet, Isis and other NFC mobile wallets rely on card emulation to transfer payment credentials to the PoS. However the downsides to this are payment apps are limited to the SE capacity (72kb on the original embedded SE on Nexus S), SE access is slower, and provisioning credentials to the SE is a complex, brittle process involving multiple TSM’s, multiple Carriers (in the case of Isis) and multiple SE types and handsets.

Host Card Emulation (or Software Card Emulation) differs from this such that instead of routing communications received by the NFC controller to the secure element, it delivers them to the NFC service manager – allowing the commands to be processed by applications installed on the phone. With that, the approach allows to break dependency on the secure element by having credentials stored anywhere – in the application memory, in the trusted execution environment (TEE) or on the cloud.

The benefits are apparent and a couple is noted:

  • NFC returns to being a communication standard, enabling any wallet to use it to communicate to a PoS – without having to get mired down in contracts with Issuers, Carriers and TSMs.
  • No more complex SE cards provisioning to worry about
  • Multiple NFC payment wallets can be on the phone without worrying about SE storage size or compartmentalizing.
  • No need to pay the piper – in this case, the Carrier for Over-the-air SE provisioning and lifecycle management. Card Issuers would be ecstatic.

However this is no panacea, as software card emulation is not exposed to applications by Android and host card emulation patches that have been submitted (by SimplyTapp) have not yet been merged with the main android branch – and therefore not available to you and I – unless we root our phones.

Which is where SimplyTapp comes in.

SimplyTapp appealed to an early segment of Android enthusiasts who abhorred having been told as to what functionality they are allowed to enable on their phones – by Google, Carriers or anyone else. And to any who dared to root an NFC phone (supported by CyanogenMod) and install the Cyanogenmod firmware, they were rewarded by being able to use both SimplyTapp as well as GoogleWallet to pay via NFC – the former where credentials were stored on the cloud and the latter – within the embedded SE.

So how does this work? SimplyTapp created a Host Card Emulation patch which resolves potential conflicts that could arise from having two competing applications (SimplyTapp and GW) that has registered for the same NFC event from the contactless external reader. It does so by ensuring that upon receiving the event – if the SimplyTapp app is open in the foreground (On-Screen) then the communication is routed to it and if not – it gets routed to GoogleWallet. This allows consumers to use both apps harmoniously on the same phone (take that ISIS and Google Wallet!). SimplyTapp today works on any NFC phone supported by CyanogenMod. Apart from SimplyTapp, InsideSecure is working on a similar initiative as reported here.

You get a wallet! And you get a wallet! Everyone gets a wallet!

Well not quite. What are the downsides to this approach? Well for one – if you wish to scale beyond the enthusiasts, you need Google, the platform owner to step up and make it available to all without having to root our phones. For that to happen it must update the NFC service manager to expose Host Card emulation for the NXP and Broadcom chipsets. And if Google is not onboard with the idea, then you need to find an OEM, a Handset manufacturer or an Amazon ready to distribute your amended libraries. Further, you can also expect Carriers to fight this move as it finds its investment and control around the secure element threatened. With the marked clout they enjoy with the OEM’s and Handset manufacturers by way of subsidies, they can influence the outcome.

Some wonder how is it that BlackberryOS continues to support Host Card Emulation without Carrier intervention. The short answer may be that it is such a marginal player these days that this was overlooked or ignored.

The limitations do not stop there. The process of using any cloud based credentials in an EMV or contactless transaction has not been certified yet. There is obviously interest and it probably will happen at some point – but nothing yet. Debit cards may come first – owing to the ease in certification. Further, Closed loop cards may probably be ahead of the curve compared to Open loop cards. More about that later. *Update: Latency is another issue when the credentials are stored on the cloud. Especially when NFC payments were called out last year to be not quick enough for transit.*

So for all those who pine for the death of secure elements, but swear fealty to NFC, there is hope. But don’t set your alarm yet.

So what will Google do?

Let’s consider for a moment that Google is down with this. If so, does that represent a fork in the road for Google Wallet? Will the wallet application leverage HCE on phones with inaccessible Secure Elements, while defaulting to the Secure Element on phones it has? If so, it risks confusing consumers. Further – enabling HCE lets other wallets to adopt the same route. It will break dependency with the secure element, but so shall it open the flood gates to all other wallets who now wants to play. It would seem like a pyrrhic victory for Google. All those who despised proximity payments (I am looking at you Paypal & Square!) will see their road to contactless clear and come calling. As the platform owner – Google will have no choice but to grin and bear it. But on a positive note, this will further level the playing field for all wallets and put the case for contactless back – front and center. Will Google let this happen? Those who look at Google’s history of tight fisted control over the embedded SE are bound to cite precedent and stay cynical.

But when it comes down it, I believe Google will do the right thing for the broader android community. Even on the aspect of not relinquishing control over the embedded SE in the devices it issued, Google had put the interests of consumer first. And it felt that, after all things considered it felt it was not ready to allow wanton and unfettered access to the SE. Google had at one point was even talking about allowing developers write their own “card emulation” applets and download them to the SE.

Broadcom also has an upcoming quad-combo chip BCM43341 that has managed to wrap NFC, Bluetooth 4.0, Wi-Fi and FM Radio, all on a single die. Further, the BCM43341 also supports multiple Secure Elements. Now, I also hear Broadcom happens to be a major chip supplier to a fruit company.

What do you think?

This is content was originally posted to Cherian's personal blog at DropLabs.

Related Posts

What Is AI Decisioning?

Every business makes decisions about people and transactions all day long. Should we approve this loan? Is this purchase fraud? Which customer should get this offer, and what should it be? For a long time, those decisions were made in one of two ways: a person reviewed each case by hand, or the company wrote fixed rules, like "approve anyone with a credit score above 700." Both work. Both also leave value on the table. The manual review is slow and hard to scale. The fixed rule can turn away good applicants and is slow to adapt when the market shifts. AI decisioning is a third way. What makes AI decisioning work Instead of relying on a single reviewer or a rigid rule, automated decisioning uses models that learn from data — studying how thousands of past cases turned out, finding the patterns that predict an outcome, and applying them to each new decision, often in real time. The result is faster, more consistent decisions. But a model on its own isn't the whole story. Getting real value from AI decisioning takes good data to learn from, AI analytics to generate insights, the tools to act on it and the governance to keep it compliant. What we've found is that the pieces only pay off when they work together, and that is where we're built differently. A model is only as good as what it learns from, and we pair your data with one of the deepest views of consumer and commercial credit: decades of full-file history and vetted attributes. Then we give you the tools to act on it. Use cases across your business Whether you're trying to grow your customer base, reduce fraud, manage lending risk, or improve collections, automated decisioning brings all the pieces together to make more accurate, consistent and explainable decisions at scale. Fraud and Identity A fraudulent transaction that slips through costs money and erodes trust. Rules are static, and fraudsters move fast. They'll probe boundaries, find the blind spots and move to the next scheme. By the time the rules are updated, they're already three steps ahead. How AI decisioning changes this: AI fraud detection with real-time risk scoring and decisioning across transactions and customer interactions Intelligence that continuously learns from results to help adapt fraud strategies as threats evolve Reduced false positives and less friction for customers at account opening and checkout Identity verification tools that confirm someone is who they say they are without slowing down the experience Credit and Lending Loan approval is where the relationship begins. Credit risk decisioning helps lenders find that delicate balance between approving enough people to grow, but carefully enough to manage risk. Missing that balance means turning away good customers or taking on losses that are difficult to absorb. How AI decisioning changes this: Increased approval opportunities for creditworthy applicants without increasing overall risk Models you can update and deploy quickly as market conditions change, rather than waiting months Ability to run "what-if" scenarios to test how a new strategy would have performed on your historical data before putting it live Collections Which customer should your team reach out to today? Through which channel? What kind of message? If you reach out too aggressively, you push someone who might have recovered into default. If you wait too long, you lose them. If you call someone at work, they resent you; if you text, they might ignore it. If you offer a payment plan, they might accept it, but only if the terms make sense to their financial situation. How AI decisioning changes this: Optimized next-best-action and contact-channel strategies for each individual customer Improved recovery potential through better targeting Less time spent on accounts with a lower propensity to pay, freeing your team for higher-impact cases Ability to segment and test new strategies before rollout Customer Acqusition Finding the right customers is about reaching the right people with the right offer at the right time. To stay competitive, it’s now a requirement to balance growth with risk while creating a seamless experience converting prospects into customers. How AI decisioning changes this: More precise prospect targeting using credit, behavioral, and alternative data, where permitted, to identify consumers most likely to respond Personalized offers delivered in real time Dynamic decision strategies that can be updated quickly as market conditions and customer behavior change Ongoing testing and optimization of acquisition strategies to improve campaign performance and support customer lifetime value Driving results with AI decisioning Every customer interaction is a decision. Businesses that can adapt quickly will be better positioned to grow, manage risk, and deliver the experiences customers expect. The technology will continue to evolve, but the goal remains the same: making informed decisions that balance business objectives, risk, and customer experience. Learn more about our decisioning software

July 27, 2026 by Zohreen Ismail
Why Innovation Matters for Members First Credit Union

Learn how Members First Credit Union uses innovation and data-driven insights to better serve members and expand financial opportunity.

July 24, 2026 by Scarlet Nickel
Ask the Expert: Unlocking the ROI of alternative data with Natasha Madan and Julius Heim

A visibility gap lenders can't afford to ignore Alternative data is often associated with thin-file or credit invisible consumers. But its value extends far beyond those segments. Experian's Clarity Services database includes approximately one in five credit-active consumers, including one in four consumers with prime-and-above credit profiles. That means lenders may be missing important signals, not only for emerging borrowers, but also for applicants who appear well qualified using traditional bureau data alone. Consider two consumers with the same credit score. Based on traditional credit data, they may appear equally creditworthy. But when Clarity data is added, one consumer may demonstrate stable repayment behavior while another shows recent defaults on alternative finance products. The credit score hasn't changed, but the decisioning context has. That's where alternative data creates value: helping lenders distinguish between consumers who look similar on paper but represent very different levels of risk and opportunity. In this Ask the Expert session, Experian’s Julius Heim, Vice President of Analytics Product Build, Innovation and Scores, and Natasha Madan, Senior Director, Analytics Consulting, explain how different alternative data assets solve different business challenges and why the greatest return comes from using them together throughout the credit lifecycle. What that visibility gap is really costing lenders Better visibility matters because every lending decision carries consequences. Without alternative data, lenders may approve applicants whose repayment behavior suggests elevated risk but isn't reflected in a traditional credit file. Without cash flow insights, they may decline consumers who appear thin file on bureau data despite demonstrating strong income and responsible financial management. The result is a two-sided cost: avoidable bad debt on one side and missed growth opportunities on the other. But ROI extends beyond approvals alone. It also appears through stronger marketing strategies, improved conversion, reduced friction and more precise risk segmentation throughout the lending lifecycle. "ROI can mean many things ... marketing to the right people, achieving better approval rates, reducing risk, getting less friction and overall profitability."Julius Heim, Vice President of Analytics Product Build, Innovation and Scores Where alternative data creates ROI Improve approval strategies Use additional consumer signals to recover creditworthy applicants while avoiding unnecessary declines. Reduce portfolio risk Identify elevated repayment risk earlier through enhanced visibility beyond traditional bureau data. Improve portfolio performance Increase conversion, reduce friction and strengthen profitability across the credit lifecycle. Different data. Different jobs. Not all alternative data solves the same problem. Clarity Services can help lenders strengthen decisions early in the customer journey. It provides additional visibility during prospecting and acquisition, helping identify potential risk before an application moves through the underwriting process. Cash flow insights can provide value in a different way. When traditional credit information offers part of the picture, consumer-permissioned cash flow data can provide greater insight into income, spending patterns and financial capacity. That makes it especially valuable as a second look during underwriting. Together, these complementary data assets help lenders improve decisioning throughout the credit lifecycle. They can support acquisition, underwriting, account management and collections while building on the trusted foundation of traditional bureau data. Research also continues to demonstrate measurable lift when cash flow insights are combined with traditional credit information. "I recently did a study with a client where we actually saw a 20% lift in KS [Kolmogorov-Smirnov] above and beyond credit bureau data. Again, the bureau data itself was very predictive. But even from the cash flow data, we still got a 20% lift, which is an amazing stat." Julius Heim, Vice President of Analytics Product Build, Innovation and Scores The greatest value comes from using these data sources together for a more holistic consumer view. Start with proof, then build Adopting alternative data doesn't have to begin with a large transformation. A practical first step is a data study. By comparing current decision strategies with enhanced data, lenders can identify where additional visibility creates measurable lift within their own portfolios. This approach allows institutions to validate results before making broader operational changes. Every lender has different workflows, technology environments and business priorities. A flexible implementation strategy helps organizations incorporate new data in ways that support existing processes rather than disrupting them. Three ways to get started Run a data study Benchmark current decision strategies and quantify potential lift. Start simple Begin with targeted data attributes or proven scores before expanding to more advanced use cases. Build with confidence Scale implementation based on measured business outcomes and organizational priorities. This approach allows lenders to validate results, build confidence and expand their strategy over time. Explore alternative data with a trusted partner Every lending decision benefits from better consumer insight. Experian helps lenders combine trusted credit data with alternative data, cash flow insights and advanced analytics to strengthen decisioning, improve portfolio performance and uncover new opportunities for growth. Whether you're evaluating alternative data for the first time or expanding an existing strategy, Experian can help you identify where additional consumer insight can create measurable business value. Learn more Contact us About our experts Julius Heim Vice President of Analytics Product Build, Innovation and Scores, Experian Julius Heim works at the intersection of financial services, analytics and innovation. He focuses on leveraging data to drive smarter decision-making and support more inclusive financial ecosystems. Julius brings a practical perspective on how organizations can translate insights into real-world impact, with particular interest in emerging trends across fintech, credit, and the use of alternative data, such as cash-flow data, across the credit lifecycle. Previously, he served as Head of Analytics on the lender side and held roles in insurance analytics earlier in his career. Natasha Madan Senior Director, Analytics Consulting, Experian Natasha Madan partners with lenders to drive smarter, data-driven credit and risk decisions. She specializes in leveraging alternative data and advanced analytics to help organizations improve portfolio performance, optimize customer acquisition, and expand responsible access to credit. During her 15 years at Experian, Natasha has held leadership roles spanning data analytics, product analytics and consulting, giving her a broad perspective of how data can be leverage to solve complex business challenges. She has worked with a diverse range of lenders – including banks, credit unions, fintechs and specialty finance companies to develop analytics strategies that optimize customer acquisition, underwriting and portfolio management. Natasha is passionate about helping organizations unlock the full potential of data to improve both business outcomes and consumer financial inclusion.

July 24, 2026 by Julie Lee

Subscribe to our Newsletter

Enter your name and email for the latest updates.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Subscribe to our Newsletter

Don't miss out on the latest industry trends and insights!
Subscribe