A transaction method, applied to a transaction terminal having a trusted execution environment, TEE, wherein the transaction terminal comprises a secure function module, a check module, and at least one transaction application module, the secure function module runs in the TEE, and the method comprises: generating, by the at least one transaction application module, a first transaction message, wherein the first transaction message comprises a first identifier and/or a secure transaction data requirement parameter, the first identifier is used to identify a virtual card currently used by the transaction application module, and the secure transaction data requirement parameter is used to instruct the secure function module to provide secure transaction data corresponding to the secure transaction data requirement parameter wherein the virtual card is a virtual card of a host card emulation system; determining, by the check module according to the first identifier and/or the secure transaction data requirement parameter of the first transaction message, that a security check needs to be performed; performing, by the check module, a security check, wherein the security check includes at least one of a password check or a biological feature check; determining, by the check module, that a result of the security check is success; receiving, by the secure function module, the first transaction message sent by the transaction application module when the result of the security check is success;; locally obtaining, by the secure function module from the transaction terminal, the secure transaction data according to the first transaction message, or according to the first transaction message and a second identifier, wherein the second identifier is used to uniquely identify the secure function module and wherein the first identifier is independent of the secure transaction data and the secure transaction data comprises a transition token that can be used during a transaction to enhance security; sending, by the secure function module, the secure transaction data to the transaction application module; and sending, by the transaction application module, a second transaction message to an acquiring terminal, wherein the second transaction message comprises the secure transaction data, the first identifier, and a third identifier, and the third identifier is used to identify the transaction terminal. generating, by the at least one transaction application module, a first transaction message, wherein the first transaction message comprises a first identifier and/or a secure transaction data requirement parameter, the first identifier is used to identify a virtual card currently used by the transaction application module, and the secure transaction data requirement parameter is used to instruct the secure function module to provide secure transaction data corresponding to the secure transaction data requirement parameter wherein the virtual card is a virtual card of a host card emulation system; determining, by the check module according to the first identifier and/or the secure transaction data requirement parameter of the first transaction message, that a security check needs to be performed; performing, by the check module, a security check, wherein the security check includes at least one of a password check or a biological feature check; determining, by the check module, that a result of the security check is success; receiving, by the secure function module, the first transaction message sent by the transaction application module when the result of the security check is success;; locally obtaining, by the secure function module from the transaction terminal, the secure transaction data according to the first transaction message, or according to the first transaction message and a second identifier, wherein the second identifier is used to uniquely identify the secure function module and wherein the first identifier is independent of the secure transaction data and the secure transaction data comprises a transition token that can be used during a transaction to enhance security; sending, by the secure function module, the secure transaction data to the transaction application module; and sending, by the transaction application module, a second transaction message to an acquiring terminal, wherein the second transaction message comprises the secure transaction data, the first identifier, and a third identifier, and the third identifier is used to identify the transaction terminal.