NFC loyalty cards and Apple/Google Wallet: how tap-to-stamp works for local businesses

How a phone tap on a counter tag becomes a stamp on a digital loyalty card, what Apple Wallet and Google Wallet add, and how to stop stamps being copied.

By Loylo5 min read

Paper stamp cards get lost, forgotten and faked. Digital ones used to mean asking customers to download an app, which few will do for a café they visit twice a week. Tap-to-stamp sits between the two. The customer taps their phone on a tag at the counter, a web page opens, and a stamp lands on a card they can keep in Apple Wallet or Google Wallet.

Here is how each part works, and what to check before you put one in a venue.

An NFC tag is a small chip with an antenna, usually inside a sticker, a card or a table plate. It has no battery. When a phone comes within a few centimetres, the phone’s own NFC field powers the chip and reads what is stored on it.

For tap-to-stamp, the tag stores a web address in a standard format (an NDEF URI record). The phone reads the address and offers to open it. No app is needed.

  • iPhone. iPhone XS and later read tags in the background while the phone is in use. A notification appears, the customer taps it, and the link opens in the browser. Apple lists exceptions: the phone will not read tags while Apple Pay or Wallet is in use, while the camera is in use, or in aeroplane mode.
  • Android. Phones with NFC switched on read tags when the screen is unlocked. Depending on the Android version, the link either opens straight away or the phone shows a prompt to open it.

Some customers will have NFC switched off or an older phone. So every NFC touchpoint should carry a printed QR code as well.

The page: where the stamp is recorded

The link opens the venue’s stamp card in the browser. The first tap starts a card. Each tap after that adds a stamp, within the venue’s rules: how many stamps earn a reward, and how often a stamp can be collected.

The tag itself does nothing clever. The logic lives on the server, so the rules can change without reprinting anything. A well-designed system also lets the business re-point a printed code to a different page later, so a tag bought today does not become waste when plans change.

Wallet passes: the card that lives on the phone

A Wallet pass is a digital card stored in Apple Wallet or Google Wallet. A loyalty pass shows the venue’s name, logo and colours, and the stamp count. When a stamp is added, the server sends an update and the pass refreshes on the phone (Apple, Google).

Passes have practical benefits. The customer does not need to find a link or an old email, and the card is always on the phone, next to their other cards.

Adding a pass should be optional. The card should work in the browser either way.

Two kinds of NFC: tag reading and Wallet NFC passes

This is a common source of confusion. Apple Wallet and Google Wallet both support NFC loyalty passes, through Apple’s Value Added Services and Google’s Smart Tap. These work the other way round. The customer holds their phone to a certified reader at the till, and the reader reads the pass. That needs certified hardware at each venue, set-up for each merchant, and approval from Apple. It suits larger chains with compatible tills.

Tap-to-stamp with a tag needs no powered hardware at all. For most independent venues, it is the practical choice.

Stopping copied stamps

A plain NFC tag holds a fixed link. Anyone who reads it once with an NFC app, or photographs the QR code next to it, could try to collect stamps from home.

There are three common defences. Good systems combine them.

  1. Signed tags. Chips such as NXP’s NTAG 424 DNA support Secure Unique NFC (SUN) messages. On every tap, the chip adds a tap counter and a one-time code to the link. The server checks the code and rejects any counter it has already accepted, so a copied link stops working. NXP’s application note AN12196, NTAG 424 DNA features and hints, lists loyalty points and verified visitor presence among the intended uses.
  2. Visit rules. One stamp per card per visit window, such as once a day, plus limits on taps per tag per hour, with alerts when something looks unusual.
  3. People at redemption. The reward itself is confirmed at the counter.

A QR code cannot be signed in the same way. A QR scan is weaker proof of a visit than a signed tap, so it’s worth limiting what a scan on its own can earn, for example by asking staff to confirm it.

Keep loyalty and reviews separate

It is tempting to combine the two: “tap for your stamp and leave us a review”. Do not link them. Google, Trustpilot and Tripadvisor all ban incentives for reviews, and a loyalty stamp given for a review counts as one. The stamp should be earned by the visit, and the customer should get it whether or not they ever review.

The cleanest set-up uses separate touchpoints: one to collect stamps, one to ask for reviews. Our guide to compliant review flows covers the review side.

Setting up a venue: a checklist

  • Put the stamp tag where customers pay or collect their order, where it is easy to reach.
  • On metal surfaces, use on-metal tags. Ordinary tags do not read reliably on metal.
  • Test every tag with an iPhone and an Android phone once it is fixed in place, including through any acrylic or wood cover.
  • Keep the QR code and a short line such as “Tap or scan to collect a stamp” visible.
  • Agree the reward and the number of stamps with the owner before launch.
  • Agree how staff confirm a redemption.
  • Brief staff that a stamp is never held back until a customer reviews.
  • Tell customers what data the card collects, and ask for marketing consent separately.

How Loylo does it

Loylo’s rewards feature gives each venue a branded stamp card. Customers collect stamps by tapping the venue’s NFC touchpoint, and can add the card to Apple Wallet or Google Wallet. Loylo prints the touchpoints in the UK and ships them to the agency or straight to the venue. Every printed code is permanent and can be re-pointed from the dashboard. Rewards and reviews are separate features with separate touchpoints, and stamps are earned by visits, never by reviews.

Sources

All checked on 9 October 2026.