EMV has PIN Try Counter. Failed offline PIN attempt decrements the counter and remains persistent across sessions. So even if you cancel the transaction after 2 failed attempts, it won't reset the counter. Next time when you will reinsert the card you will only have one attempt left.

Before VERIFY_PIN is issued, PIN Try Counter is retrieved by GET DATA command. If the value of PIN Try Counter is zero before verifying the PIN, terminal will go for online PIN verification as next supported cardholder verification method (CVM).

Nowadays online PIN verification is mandatory because of custom cardholder PIN. In some cases where terminal cannot go online, then only terminal chooses offline PIN verification as next supported CVM. Offline PIN can be updated with the post-issuance command by Issuer-to-Card Script Processing whenever a next transaction will be online.

Online PIN is sent with transaction authorization request to the issuer. The authorization response from the issuer contains transaction approval/rejection and optionally Card Status Update which can reset PIN Try Counter or can block the card.

Given that the person will enter the building on a regular basis and that the number of available PIN attempts is reset each time the payment card is used in a Point of Sale terminal or ATM, the attacker can have unlimited attempts to guess a card’s PIN.

I don't think this is possible today. Contactless cards have a threshold counter above which the next transaction has to be a contact payment.

EMV Contactless Book A, 5.9.3 - CVM Selection and Cardholder Verification

Methods that may be supported are online PIN and signature – offline PIN is not suitable due to the “card in field” timing issues.

Cardholder puts the card near to the PoS and pulls it back. Offline PIN verification will require the card to be remain in the field until PIN verification completes.

The specifications for contactless transactions specifically exclude the use of offline PIN verification (full details in [6] Book A section 5.9.3). Contactess offline PIN verification requires the PIN to be transmitted wirelessly to the card which poses a security risk from eavesdropping. Surprisingly many of the contact- less cards currently in circulation in the UK allow access to offline verify PIN.

This is completely out of specification if UK banks were/are allowing offline PIN without persistent PIN Try Counter and unlimited consecutive contactless payments.

EMV contact/contactless cards have 3-5 year validity. So modern NFC cards might be complying with the specifications, atleast in countries where NFC payment support has just arrived.

EMV has PIN Try Counter. Failed offline PIN attempt decrements the counter and remains persistent across sessions. So even if you cancel the transaction after 2 failed attempts, it won't reset the counter. Next time when you will reinsert the card you will only have one attempt left.

Before VERIFY_PIN is issued, PIN Try Counter is retrieved by GET DATA command. If the value of PIN Try Counter is zero before verifying the PIN, terminal will go for online PIN verification as next supported cardholder verification method (CVM).

Nowadays online PIN verification is mandatory because of custom cardholder PIN. In some cases where terminal cannot go online, then only terminal chooses offline PIN verification as next supported CVM. Offline PIN can be updated with the post-issuance command by Issuer-to-Card Script Processing whenever a next transaction will be online.

Online PIN is sent with transaction authorization request to the issuer. The authorization response from the issuer contains transaction approval/rejection and optionally Card Status Update which can reset PIN Try Counter or can block the card.

Given that the person will enter the building on a regular basis and that the number of available PIN attempts is reset each time the payment card is used in a Point of Sale terminal or ATM, the attacker can have unlimited attempts to guess a card’s PIN.

I don't think this is possible today. Contactless cards have a threshold counter above which the next transaction has to be a contact payment or in some countries may still be operational in contactless mode with an online verification of the PIN code. (12:18)

EMV Contactless Book A, 5.9.3 - CVM Selection and Cardholder Verification

Methods that may be supported are online PIN and signature – offline PIN is not suitable due to the “card in field” timing issues.

Cardholder puts the card near to the PoS and pulls it back. Offline PIN verification will require the card to be remain in the field until PIN verification completes.

The specifications for contactless transactions specifically exclude the use of offline PIN verification (full details in [6] Book A section 5.9.3). Contactess offline PIN verification requires the PIN to be transmitted wirelessly to the card which poses a security risk from eavesdropping. Surprisingly many of the contact- less cards currently in circulation in the UK allow access to offline verify PIN.

This is completely out of specification if UK banks were/are allowing offline PIN without persistent PIN Try Counter and unlimited consecutive contactless payments.

EMV contact/contactless cards have 3-5 year validity. So modern NFC cards might be complying with the specifications, atleast in countries where NFC payment support has just arrived.