I unwittingly made my first contactless card payment a few days ago: the vendor took my bank card [current account debit card] (I assumed so that they could insert it into their "deskbound" payment terminal: I know that you are supposed to never hand over your card, but so many service counter staff still have ingrained old habits from the swipe and sign era, and/or poor quality payment terminals on too-short leashes to be easily accessible to the customer), and I was surprised not to then be given the terminal so that I could enter my PIN to make the payment. The vendor then said that they had processed the payment as a contactless payment.
I am somewhat concerned by this as I had been led to believe by my bank's publicity materials that contactless payment using my card would simply not be possible until I had authorised my first time contactless payment by entering my PIN.
This regrettably seems to confirm my main concern about contactless cards, specifically that a stolen card can indeed be used to spend your money until the thief encounters an occasional PIN security check. I had thought that I would be safe from this risk as long as I did not ever make and authorise a first contactless payment, so I am very concerned that this does not appear to be the case.
I will now be contacting my bank to request a card without contactless payment capability (and asking them to contact the vendor to remind them about card processing practice, as unfortunately I have learned the hard way (albeit without ill-effect) exactly why you should indeed never hand over your card!).
I have now reviewed my bank's website again, where the wording seems different to what I had previously understood: it seems that making any ATM or Chip card transaction is enough to enable contactless functionality (whether you like it or not), giving no protection whatsoever.
Can anyone clarify what the approved situation should be regarding the enabling of contactless cards?