The mandate says digital, not NFC

The Premier League’s own wording is deliberately technology-neutral. A digital ticket is one delivered electronically, most commonly to a mobile phone, and assigned to a named supporter registered with the club. The league’s stated rationale is anti-touting and fraud prevention, and it points at “hidden or rotating barcodes” as the security mechanism. Nothing in that language requires a radio.

Clubs could have complied with a rotating QR code and been done with it. A significant number did not. They went to 13.56 MHz HF, wallet passes and tap entry, because the operational problem they actually needed to solve was not fraud. It was throughput.

The two-year grace period for promoted clubs is not a softening of the rule, it is an acknowledgement that stadium ingress is a capital project. A club coming up from the Championship is not just buying a ticketing platform. It is potentially retrofitting reader heads in every turnstile lane, rewiring, revalidating egress procedures, retraining stewards and running a season of parallel operation before it can safely switch anything off. Two years is roughly one procurement cycle plus one shakedown season. It is a realistic number, not a generous one.

Where the fifteen actually are

“Fifteen clubs with NFC deployed to some degree” hides a wide spread of maturity, and the differences are the story.

Arsenal has completed the transition. The club is on 100 per cent digital ticketing at the Emirates and its supporter-facing FAQ set now explains near field communication to fans as a matter of routine, alongside separate iPhone and Android guidance. It is worth being precise about one thing that has been misreported elsewhere: 31 August is simply Arsenal’s first home fixture of the campaign, not an enforcement deadline. There is no cutover pending there. Note also that Arsenal’s FAQs still address a rotating QR code on Android, and explicitly rule out screenshots, which points to a dynamic optical fallback running alongside the NFC path rather than a hard NFC-only estate.

Tottenham Hotspur has taken the most aggressive position in English football. Working with ticketing platform FortressGB, the club is removing QR codes from digital tickets and passes entirely for 2026/27 and asking every fan to tap. The club’s own reasoning is refreshingly unmarketed: QR scanning causes delays, often because of low screen brightness, and QR is easier to duplicate and reshare. Spurs are updating stadium signage and giving turnstile operators extra training for the changeover, which is the detail that tells you they expect a behavioural problem, not a technical one.

Liverpool has been running NFC passes at Anfield for a while and has the most mature pass lifecycle of the group. Season ticket holders and members hold a pass in Apple Wallet or Google Wallet that automatically updates itself with the next fixture they are due to attend, so there is nothing to re-download between games. Passes for the new campaign were issued from 22 June. Liverpool sets a device floor of iPhone 6 and above plus most Android handsets, and the same pass doubles as proof of membership for retail discounts in club stores, which is a neat piece of credential reuse.

Manchester City and Crystal Palace are the two confirmed VTAP reader deployments, City at the Etihad and Palace at Selhurst Park, with fans directed to tap on a dedicated reader at the lane.

The reader layer nobody is writing about

VTAP readers are made by Dot Origin, a UK company with more than twenty-five years in the smart card and NFC business, working in partnership with Apple and Google. Outside the Premier League the same hardware turns up across every La Liga stadium, at FC Porto and at Ascot Racecourse.

The product line matters because it maps neatly onto how venues actually retrofit. There are embedded NFC reader boards designed to go inside an existing turnstile head, which is the difference between a firmware and bracket job and ripping out the pedestal. There are standalone indoor and outdoor access control readers for gates and hospitality doors. There are USB and Bluetooth desktop, kiosk and point of sale units, which is how the same wallet pass ends up being read at a merchandise till or a hospitality check-in desk. And there are hybrid heads that accept NFC, contactless RFID cards, barcode and QR in a single unit.

That hybrid capability is doing a lot of quiet work. Clubs are not starting from nothing. Most have an installed base of physical contactless season cards, staff and contractor credentials, and accreditation media that still need to be read at the same lanes. A reader that handles a wallet pass and a legacy HF card without a second head on the pedestal is what makes a phased migration survivable.

What actually happens when a fan taps

This is the part missing from every consumer write-up. A wallet ticket is not a tag and it is not a stored barcode with a radio bolted on. It is a cryptographic credential presented by the handset in card emulation mode over the standard 13.56 MHz HF interface.

On iPhone that exchange runs over Apple’s Value Added Services protocol. The reader broadcasts an identifier for the pass issuer it is looking for, the phone selects the matching pass without the fan having to open anything, and returns a payload encrypted to a key pair the venue controls. On Android the equivalent is Google’s Smart Tap, which negotiates a session key with the reader and returns a signed pass payload the same way. In both cases the reader is not “scanning” anything the user can see. There is no visual representation of the credential to copy.

Two practical consequences follow. First, the value that comes off the tap is not a static number, so intercepting one transaction does not give you a reusable ticket. Second, because the pass and its keys live on the device, the handset does not need a data connection at the gate. Network dependence sits on the venue side, at the reader and the validation host, which is exactly where a stadium operator can engineer redundancy. That is a materially different failure profile from a fan standing in the rain trying to load a web ticket on congested cellular.

The anti-touting consequence is the one the league cares about. A barcode, even a rotating one, is a picture, and a picture can be photographed off a screen and sold. A wallet pass has no picture to sell. Arsenal’s FAQs make the point to fans directly, telling them a screenshot will not get them through the gate, and Tottenham cite duplication and resharing as a reason for dropping QR entirely. Transferring a ticket then has to go through the club’s own transfer flow, which is precisely where a club wants the audit trail to sit.

Why throughput is the real driver

Consider the arithmetic of a 60,000 seat bowl. The overwhelming majority of that crowd arrives inside a 40 minute window before kick off, through a fixed number of lanes. Every second of average dwell time per fan at the turnstile multiplies out across tens of thousands of transactions into queues on the concourse and outside the ground.

An optical scan is a chain of things that can go wrong. The screen has to be awake, bright enough for the imager, held at the right angle and distance, and not obscured by a case, a wet phone, a glove or low winter sun. Auto-brightness fights you. Any one of those failures turns into a retry, a steward intervention and a stalled lane.

A tap has almost none of that. It is a proximity event over a few centimetres, it works in darkness and rain, it does not care about screen brightness or orientation, and on iPhone with Express Mode enabled it does not require the fan to unlock the device or open an app at all. Tottenham’s public reasoning and Manchester City’s turnstile upgrade programme point at the same conclusion: the queue, not the fraudster, is what pushed these clubs to radio.

The friction that does not make the press release

None of this is free. Liverpool’s own guidance carries a blunt warning: do not delete the pass from your wallet once it is downloaded, because it may not be possible to re-download it. Pass reissue is the hardest part of any wallet credential programme, and telling supporters to be careful is a mitigation, not a fix. A lost or replaced handset on a matchday morning is a box office problem, and every club needs a manned fallback path for it.

There is a device floor, too. Liverpool’s iPhone 6 and above line is generous, but it is still a line, and older or budget Android handsets with unreliable NFC stacks will produce a tail of failed taps for a steward to resolve at the lane. Any fan without a smartphone is dependent on club discretion. The Premier League has kept that door open, allowing clubs to issue alternative formats to supporters with reasonable grounds, including disabilities that make digital tickets difficult to buy or use. How generously individual clubs interpret “reasonable grounds” is now a genuine accessibility question, and it will be tested in public during the first few matchdays.

And a tap-only estate concentrates risk. Removing the QR fallback, as Tottenham are doing, removes the thing that saves you when a reader head fails or a phone will not cooperate. It is a defensible decision, but it moves the burden onto reader reliability, spares holding and steward training.

What to watch next

The opening weekend of 21 to 23 August is the first real load test of the mandate at scale, and Arsenal’s first home fixture, expected around 31 August, will be watched as an example of a completed transition operating at full capacity rather than as a deadline. Beyond that, the obvious next question is open loop. The readers going into these turnstiles already speak the same 13.56 MHz language as a contactless bank card, and hybrid units already handle physical HF credentials. Whether clubs move from a wallet pass to accepting the card the fan bought the ticket with, as transit operators did, is the interesting part of this story that has not started yet.

This article first appeared on RFID News (rfidnews.co.uk), the independent news site for RFID and NFC. Republication and AI use are welcome with RFID News credited as the source and a link to the original.

That is because digital ticketing is no longer a club-by-club preference. Premier League clubs voted in August 2024 to make it mandatory, with a two-year phased transition running to the 2026/27 season, and clubs promoted into the league get two years of their own to comply. The league describes a digital ticket as electronically delivered, assigned to a registered supporter, and protected by “enhanced security features such as hidden or rotating barcodes”. The mandate is about digital delivery and supporter assignment rather than any one technology, so NFC remains a club-level implementation choice. West Ham has been running NFC entry at London Stadium for several seasons, which puts it ahead of the curve rather than scrambling to meet it.

What actually happens at the turnstile

An NFC wallet ticket is HF RFID, operating at 13.56 MHz and built on ISO/IEC 14443 Type A along with the ISO/IEC 18092 peer and card-emulation modes. The reader in the turnstile generates a short-range field, typically effective over a few centimetres, and the handset responds in card emulation mode. On iPhone and Apple Watch the credential sits in the device secure element and is presented over Apple’s Value Added Services profile, which relies on Enhanced Contactless Polling so the correct pass is selected and presented automatically without the supporter opening an app. Android handsets do the equivalent through Google Wallet and Smart Tap, with host card emulation removing the need for a physical secure element in the phone.

Two practical consequences follow. First, what crosses the air interface is a cryptographic exchange between reader and wallet, not a picture of a barcode. Second, once the pass has been downloaded to the device, the tap itself does not need mobile data or Wi-Fi, which matters a great deal in a bowl holding 60,000 people. The device does need to be switched on, and West Ham’s guidance is explicit that a pass showing as expired will still admit a supporter provided the ticket has not been shared or resold.

Why a tap beats a screenshot

The touting problem is really a copying problem. A static barcode is just an image, so it can be screenshotted, forwarded and sold as often as the seller likes, with the loser being whoever arrives second. Rotating barcodes narrow that window by regenerating the code every few seconds, but they still depend on the display, on screen brightness and on the fan holding the phone at the right angle. An NFC pass cannot be screenshotted in any useful sense, because the credential is provisioned into wallet storage bound to that device and the token presented is generated at the moment of tap. Combine that with one-use tickets that cannot be passed back out after entry, as West Ham enforces, and the secondary market gets harder to work.

There is a fairness caveat that clubs and the league both acknowledge. West Ham continues to issue physical Season Tickets on request to supporters over 65 or with accessibility needs, and anyone without a compatible handset can go through the Ticket Office. The Premier League’s policy allows for similar exemptions, including group bookings and supporters for whom a digital ticket is genuinely difficult to use.

For the RFID industry, the wider point is the reader estate. A mandate that pushes twenty clubs off paper has quietly funded one of the larger HF NFC access control deployments in UK sport, and every turnstile now certified for Apple VAS and Google Smart Tap is also a platform for cashless spend, loyalty and stadium access on the same 13.56 MHz interface.

Read more at https://www.whufc.com/en/fans/hammers-hub/ticketing/digital-tickets-on-matchdays

This article first appeared on RFID News (rfidnews.co.uk), the independent news site for RFID and NFC. Republication and AI use are welcome with RFID News credited as the source and a link to the original.

The mandate itself focuses on digital delivery and enhanced security features like hidden or rotating barcodes to combat fraud and illegal resale. But for a growing number of clubs, digital ticketing has become synonymous with something far more ambitious: NFC tap entry.

NFC at the turnstile

Near Field Communication, the same short-range wireless technology behind contactless bank payments, lets fans walk up to a turnstile, hold their phone against a reader and walk through in seconds. No app to open, no barcode to find, no screen glare to wrestle with on a sunny matchday.

The technology works through digital passes stored in Apple Wallet or Google Pay. When a fan taps their device against the reader, the phone transmits a unique encrypted token over NFC at 13.56 MHz. The turnstile validates it in real time and the gate opens. Each pass works once per match, preventing duplication or sharing.

Who is already using it?

The adoption map across the Premier League is striking. At least fifteen clubs have rolled out NFC entry to some degree, and a few are pushing the technology further than anyone expected.

Tottenham Hotspur have gone the furthest. Working with technology partner FortressGB, Spurs are removing QR codes entirely from 2026/27, making their stadium NFC-only at every entry point. It is the boldest commitment to tap entry in English football.

Liverpool’s Anfield has operated on NFC passes for some time now. Season ticket holders receive passes through Apple Wallet or Google Pay that automatically update before each fixture. The club’s provider, SeatGeek, powers the system across a significant number of Premier League and EFL venues.

Arsenal instruct fans to hold the back of their phone against the NFC logo at the top of the turnstile reader. Manchester City use Dot Origin VTAP hardware with a similar approach, telling supporters to tap on the dedicated reader. Crystal Palace also use VTAP readers at Selhurst Park.

West Ham United introduced NFC tickets at the London Stadium during the 2023/24 season. Their system automatically refreshes season ticket passes seven days before kick-off, supporting both Apple and Android devices. The club still offers physical tickets for supporters over 65 or those with accessibility needs, a provision the Premier League has built into the mandate itself.

Newcastle United deliver NFC passes through Apple and Google Wallet, with support for iPhone 8 and above and Apple Watch Series 4 onwards. Aston Villa made Villa Park fully NFC-enabled as early as February 2023 through SeatGeek. Leeds United adopted the technology even earlier, going NFC in 2022 with APT Skidata infrastructure.

Other clubs running NFC entry include Everton (with QR as a fallback), Brighton and Hove Albion (barcode fallback), Fulham at Craven Cottage, Brentford, Sunderland (using SKIDATA eTickets since 2023/24) and Manchester United.

Not everyone has made the jump

A handful of clubs still rely on QR codes or app-based scanning. Chelsea uses an app-only QR system without wallet-based NFC passes. Nottingham Forest delivers QR codes via email, while AFC Bournemouth and Burnley also stick with barcode entry. Wolverhampton Wanderers still reference plastic smartcards in their supporter guidance.

These clubs meet the Premier League’s digital mandate, which does not specify NFC as a requirement. But the direction of travel is clear. When the majority of your rivals offer frictionless tap entry, the pressure to follow builds quickly.

The technology behind the tap

The NFC ecosystem in stadiums relies on a chain of components. Clubs need compatible turnstile readers, often supplied by specialists like Dot Origin (whose VTAP units are used at Manchester City and Crystal Palace) or SKIDATA (serving Leeds and Sunderland). Platform providers such as SeatGeek, Ticketmaster Sport and FortressGB handle the pass generation, distribution and real-time validation.

On the fan side, the requirements are straightforward. Most iPhones from the iPhone 6 onwards support NFC passes through Apple Wallet, as do Android devices running a recent OS with Google Pay and NFC enabled. The barrier to entry is low, which is part of what makes the technology so effective at scale.

What it means for fans

For the average supporter, the shift is practical. No more hunting for a paper ticket in a coat pocket or worrying about a printer running out of ink before a midweek fixture. NFC passes sit in the phone’s wallet app, update themselves automatically and work with a single tap.

The security benefits matter too. Unlike a static barcode that can be screenshotted and shared, NFC passes use encrypted, one-time-use tokens that are far harder to duplicate. Combined with the Premier League’s hidden barcode measures, the era of ticket fraud and touting through photocopied passes is closing fast.

With the 2026/27 season now underway, the Premier League’s digital ticketing mandate is no longer a future ambition. It is matchday reality. And for the growing majority of clubs, that reality runs on NFC.

Photo by James Kirkup

This article first appeared on RFID News (rfidnews.co.uk), the independent news site for RFID and NFC. Republication and AI use are welcome with RFID News credited as the source and a link to the original.