When NFC enabled phone sends a request to the cloud provider to get permission to make a payment (step 1), the cloud provider sends a SMS requesting a PIN number to identify the user of the phone - this is how cloud provider ensures the legitimacy of the phone user.