What is a Wallet Card, and how does it work?

Setup in native.cards describes it in one line: "The Wallet Card is what customers see on their phone: your logo, colours, their balance and the code staff scan." The balance is whatever your program counts: Points, Stamps or Visits. A Stamp card draws its stamps as circles, with the reward as the last one, and a full card reads "Card complete. Claim your reward at the counter".

Each issued card gets its own code, and the card shows the member ID too. The code is only a reference. It holds no name, no email address and no balance. Those stay in your records, and the Counter looks them up when staff scan the code. That is why the Counter needs an internet connection. Every card also carries a Manage membership link back to your Business page, where the member signs in to their account with you.

The logo, colours, picture and wording are yours. The layout is Apple's on an iPhone and Google's on Android, so the two cards look different: see How to design a Wallet Card customers recognise and Apple Wallet vs Google Wallet: what your customers see.

Your records hold the membership: who the member is, what they have earned, which rewards are theirs. The card shows the member's balance and is updated when it changes. The Issued Cards page says it in a sentence: "A member gets a card when they add it to Apple Wallet or Google Wallet; their membership works without one."

• A member who never adds the card is still a member. Staff find them by typing a member ID or phone number.
• A member who changes phones signs in again with the same email address. The program form lists the field as Email (always asked) and gives the reason: "So they can sign in and get a lost card back."
• A member can remove the card from the Wallet, or turn its notifications off. Neither ends the membership.

You can also stop a card. Under Issued Cards an owner or admin can Suspend card, and the confirmation says: "The card stops working in native.cards straight away."

In Malaysia "e-wallet" already means something else. In May 2025 Ipsos surveyed a nationally representative sample of 1,034 Malaysians aged 18 to 74. Of those who had made a non-cash payment in the past three months, 54% had used an e-wallet. Among those e-wallet users, 78% had used Touch 'n Go eWallet and 44% MAE. No other brand was above 10%. Three in four had paid with an e-wallet at a food or drink outlet. Apple and Google appear nowhere in the release. It is a survey of how people pay. It cannot tell you how many Malaysians keep cards in Apple Wallet or Google Wallet, and we found no sound public figure for that.

So a sign that says "wallet" makes customers ask "do I have to top up?" The answer is no. Apple describes Wallet as "where you store and access all your boarding passes, movie tickets, retail coupons, rewards cards, and more". Bank cards used with Apple Pay are kept there too: Apple lists eight issuers for Malaysia, among them Maybank, CIMB and Hong Leong Bank. Google separates the two ideas itself. Google Wallet "is a safe way to store and use your cards, tickets, passes, keys, and IDs", while "Google Pay is how you easily pay for things". Your card lives in Apple or Google Wallet, beside the cards they pay with, ready at the counter without a login. It is not one of the cards they pay with.

The Points on it are not money either. They do not pay a bill. A member with enough of them claims a reward, and staff hand it over.

Bank Negara Malaysia's FAQ on electronic money, last updated on 31 January 2025, answers the question of loyalty points in Part B, question 5. Whether they count as e-money "depends on whether the rewards fulfil both the definition of e-money": that "there is element of exchange of funds with the issuer", and that they "can be used to make payment to a person other than the issuer". A footnote adds: "if the fund is sourced from the issuer, it is not deemed as e-money."

In native.cards your business gives Points, Stamps and Visits for purchases. A member cannot buy them, nothing can be loaded onto the card, and they are used only with you. This is general information, not legal advice. If you plan to sell stored credit or prepaid packages, by any means, ask a lawyer about your own case.

There is no app. The card sits inside the Wallet app that Apple or Google provides, and your Business page is a web page. A customer joins by scanning a sign and confirming an email address. There is nothing of yours to download and no password to set. You do not need Apple or Google developer accounts.

The trade-off is that a card does far less than an app. It has no screens of its own and takes no orders or payments. It puts no icon of yours on the home screen: the member opens the Wallet to find it. On Android it also depends on Google Wallet. Google's help page says "Users need Android 9 to download and use the app", with Google Play services up to date. Paper card, app or Wallet Card: which is best for you? compares the three.

A customer who pays by tapping a phone may expect to tap this card too. Tapping uses NFC, the short-range radio in the phone, and both companies restrict it. Apple's developer documentation says "Adding NFC to a Pass requires a special entitlement issued by Apple", and describes the tap as data the phone passes "to an Apple Pay terminal". Google's version, Smart Tap, is "a Google proprietary near-field communication protocol", and "You must be certified in order to use this protocol."

Instead, staff open the Scanner and hold the customer's card up to the camera, and the member's name appears on the serving screen. If the phone has no battery or was left at home, staff choose ID or phone, type the member ID or phone number and read the name back. The member ID is always typed, never scanned. If one arrives from a scanner, the Counter answers: "Type the member ID. A scanner reads the code on the card."

The code on a card stays the same from day to day. A screenshot or a photo of the card holds the same code, and the scanner cannot tell that copy from the card. The copy shows the balance as it was when the picture was taken. It gets no notifications and is never updated.

A copy can even sit in the Wallet. Apple's support page describes how to "scan a barcode or QR code, or take a screenshot of a digital code, to create and store passes in the Wallet app", on an iPhone 15 Pro or later that supports Apple Intelligence. Google's says "You can take a picture or upload a photo of your pass or barcode to add it to your Google Wallet." A pass made that way comes from a picture, not from you, and nothing in either description connects it to your records.

So ask for the card in the Wallet, the one in your colours. Then check the name on the serving screen, because a copied code opens the account of the member it was copied from.

On a Stamp card the risk is small. Whoever holds the copy can add to that member's stamps or ask for that member's reward, and each of those still needs a staff PIN. If a member tells you their code has been copied, an owner or admin can Revoke permanently under Issued Cards. The confirmation says to use it when the card "is compromised, duplicated or must never be accepted again", and adds "A replacement must be issued as a new card."

The picture of the card on your Business page is not a card either. It shows your design, and its code is not the member's.