I unwittingly made my first contactless card payment a few days ago: the vendor took my bank card [current account debit card] (I assumed so that they could insert it into their "deskbound" payment terminal: I know that you are supposed to never hand over your card, but so many service counter staff still have ingrained old habits from the swipe and sign era, and/or poor quality payment terminals on too-short leashes to be easily accessible to the customer), and I was surprised not to then be given the terminal so that I could enter my PIN to make the payment. The vendor then said that they had processed the payment as a contactless payment.

I am somewhat concerned by this as I had been led to believe by my bank's publicity materials that contactless payment using my card would simply not be possible until I had authorised my first time contactless payment by entering my PIN.

This regrettably seems to confirm my main concern about contactless cards, specifically that a stolen card can indeed be used to spend your money until the thief encounters an occasional PIN security check. I had thought that I would be safe from this risk as long as I did not ever make and authorise a first contactless payment, so I am very concerned that this does not appear to be the case.

I will now be contacting my bank to request a card without contactless payment capability (and asking them to contact the vendor to remind them about card processing practice, as unfortunately I have learned the hard way (albeit without ill-effect) exactly why you should indeed never hand over your card!).

I have now reviewed my bank's website again, where the wording seems different to what I had previously understood: it seems that making any ATM or Chip card transaction is enough to enable contactless functionality (whether you like it or not), giving no protection whatsoever.

Can anyone clarify what the approved situation should be regarding the enabling of contactless cards?

closed as off-topic by Sjoerd, Steve, Xander, schroeder Mar 22 '17 at 17:31

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Which country are you in? – Sjoerd Mar 22 '17 at 15:21
  • 1
    @Ben It is a Chip and PIN card (the norm here for many years), the PIN is always required when making a (non-contactless) in-person purchase. (I am aware that this is a much more recent development in certain countries!) – dave559 Mar 22 '17 at 16:26
  • 1
    @NineBerry Sorry, I should have made it clearer in my most that the card is a debit card connected to my current account (where contactless payment can be used for "small" transactions, instead of Chip and PIN), rather than a credit card (original post now updated). – dave559 Mar 22 '17 at 16:28
  • 1
    @dave559 I was also referring to debit cards connected to existing bank accounts. Banks in Germany are currently rolling out new cards to replace the previous cards with contactless payment as a new feature. But as stated earlier, with most German banks you have a separate balance for contactless payment when using the same card that you would use with pin for unlimited payments. – NineBerry Mar 22 '17 at 17:09
  • 1
    @dave559 As I explained, their terms and conditions explicitly state they would, in fact, reimburse the money. – Relaxed Mar 24 '17 at 7:10

Browse other questions tagged or ask your own question.