Is Tap-to-Give Safe for Churches?

What Actually Happens When Someone Taps a Plate

The tap does one thing: it hands the phone a web address. Nothing more moves between the plate and the phone. Understanding that single fact answers most of the security question by itself.

When a member holds their phone within an inch or two of the plate, the phone’s reader briefly powers the chip and receives the URL stored on it. The phone shows a small banner, the giver taps it, and their browser opens your church’s giving page. From that point on, it is identical to a member typing your giving link into their phone at home. The plate is out of the loop the moment the page opens.

NFC works only at very short range, a few centimeters, so a phone cannot pick up a plate from across the room or in a passing pocket. If you want the full step-by-step, we wrote a plain-English walkthrough of how tap-to-give works.

Does the Plate Store Any Card or Bank Information?

No. The chip stores one small piece of text, a web address, and nothing else. There are no card numbers on it, no bank details, and no donor records.

This matters because the thing people worry about, a device holding sensitive financial data, simply does not exist here. The URL burned onto the plate is the same link already published on your website and in your bulletin. Reading the plate reveals a public address, not a secret.

For a deeper look at the chip and the standard behind it, our tech team wrote NFC giving explained.

Can an NFC Giving Plate Be Hacked or Reprogrammed?

Not by a tap. Tap.Giving plates ship locked, so the encoded URL is write-protected and cannot be overwritten by another phone. This is the single most common worry, and locking closes it.

Even if a plate were left unlocked, reading it would only reveal your public giving link, so there is no hidden data to extract and no payment to intercept. The chip is passive: it does nothing until a phone powers it, and all it can do is repeat one address.

Because we sell hardware and not a payment system, we can also lock a plate to a redirect you control, so you can re-point it later without reprinting. That keeps the address in your hands, not a stranger’s.

Where Does the Payment Security Actually Live?

On your giving platform, which is exactly where it lives today. Tap.Giving is hardware, not a payment processor, so the money never flows through us and we never see a card.

The donation happens on the same checkout your members already use online. Reputable giving platforms such as Tithely, Pushpay, Subsplash, and Donorbox run PCI-DSS-compliant payment pages, the industry security standard for handling card data. Adding a plate does not change that page or its protections in any way.

When a giver pays with Apple Pay or Google Pay, it is safer still. Their real card number is never shared with your church or your platform. A device-specific token stands in for the card, and the payment is confirmed with a face scan, a fingerprint, or a passcode on the giver’s own phone.

So the security you are counting on is your platform’s security, the protection your church already relies on for every online gift. The plate simply gets a member to that page faster.

What About Donor Privacy?

Tap.Giving collects nothing about the giver, because there is no app and no account on our side. The tap opens a web page in the phone’s browser, and that is the end of our involvement.

There is no download that asks for permissions, no login that creates a profile, and no tracking baked into the plate. Your giving platform records the gift the same way it always has, under the same privacy policy your members already agreed to. Adding plates does not create a new place your donors’ data is stored or a new company that holds it.

For many congregations, that is the appeal of the no-app model in the first place. If a member can give without downloading anything, they can also give without handing personal information to one more vendor. We wrote more about why app-free giving wins if that is the direction your church leans.

How Does It Compare to Cash, Checks, and QR Codes?

Measured against the offering methods your church already uses, tap-to-give holds up well and beats some of them. Here is the honest comparison.

Cash leaves no record and can go missing between the plate and the count. A check hands over a bank account number in plain sight. Tap-to-give and QR both route to your secure platform, but the plate has an edge: it can be write-locked, and if you use a redirect you control, you can change where it points without reprinting a single thing.

What Your Board Should Check Before Rolling It Out

Due diligence here is short, because most of the security is inherited from tools you have already vetted. Run this list at your next meeting.

That is the whole review. There is no new processor to audit, no contract that touches your donor database, and no vendor added to your list of data holders.

Once the security question is answered, the rest is simple. Plates are a one-time purchase from $3.50 to $4.50 each, with free shipping and no monthly fees, and they work with the giving platform you already trust.

FAQ