Contactless payments are secure for most everyday transactions, but the protection depends on how much you're spending and which fraud safeguards your card issuer has in place
When you tap or wave your card at a reader, your card number and expiration date do not leave your card. Instead, a unique, one-time code is generated for that single transaction. This means a thief who intercepts the signal cannot reuse that code for another purchase — it is locked to that specific store, amount, and moment. The technology itself is harder to exploit than swiping or inserting a chip card.
However, contactless payments do carry real risks that you should understand. A thief standing near you with a reader can capture a transaction without your knowledge. Your card issuer may not catch every fraudulent tap. And if someone steals your physical card, they can make contactless purchases without a PIN or signature up to a limit set by your bank — often $25 to $100 per transaction, though this varies by issuer.
Key Takeaways
- Contactless transactions use one-time codes that cannot be reused, making them harder to exploit than magnetic stripe cards but not risk-free.
- Thieves can capture contactless signals from a distance, but most card issuers monitor for unusual patterns and will refund fraudulent charges.
- If your card is lost or stolen, a thief can make contactless purchases up to your bank's limit without entering a PIN, so report the card immediately.
- Your fraud protection comes from your card issuer's monitoring system, not from the contactless technology itself, so the strength of protection varies by bank.
- For high-value purchases, contactless payments may require a PIN or signature depending on the amount and your bank's rules.
How the one-time code stops repeat fraud
Each contactless transaction generates a unique cryptogram — a code that is valid only for that purchase at that moment. The code includes information about the amount, the merchant, and a timestamp. If a criminal intercepts the signal and tries to use that same code at a different store or later, the payment network rejects it because the code no longer matches the transaction details.
This is different from a magnetic stripe card, where your actual card number travels with every swipe and can be copied and reused. With contactless, the card itself stays locked; only a one-time token leaves your card. The payment network — Visa, Mastercard, or American Express — verifies the code before the money moves.
That said, the one-time code does not protect you if a thief uses your stolen card in person. They can tap your card repeatedly up to your bank's contactless limit without needing your PIN. This is why reporting a lost or stolen card within 24 hours is critical.
What happens when someone intercepts a contactless signal
A contactless card broadcasts a radio signal over a short distance — typically a few inches to a few feet, depending on the reader and card. In theory, a thief with a specialized reader could stand near you in a crowd and capture that signal without your knowledge. This attack is called skimming.
In practice, skimming contactless cards is harder than it sounds. The thief needs a reader powerful enough to capture the signal, the card must be close enough, and the transaction must complete before your card or the reader times out. More importantly, even if a thief captures the one-time code, they cannot reuse it — they would need to be physically present with a reader at a merchant terminal to attempt a new transaction, and most card issuers flag unusual patterns (multiple transactions in different locations within minutes, for example) and block the card.
Your card issuer's fraud detection system is your main defense here. Banks monitor for transactions that do not match your usual spending pattern — different location, unusual merchant category, rapid-fire purchases — and will contact you or decline the transaction. If fraud does occur, your card issuer is responsible for refunding it under the Fair Credit Billing Act, as long as you report it within 60 days.
The difference between contactless and mobile wallet security
Contactless cards and mobile wallets (Apple Pay, Google Pay, Samsung Pay) use similar one-time code technology, but mobile wallets add an extra layer: tokenization. Your actual card number is never stored on your phone. Instead, the payment network creates a token — a substitute number — that is tied to your phone and your identity. If your phone is stolen, a thief cannot use your payment information without unlocking the phone first.
Mobile wallets also require biometric authentication (fingerprint or face recognition) or a PIN before each transaction, depending on the amount and your bank's rules. Contactless cards do not. This makes mobile wallets slightly more secure against theft, because a thief needs both your phone and your biometric data or PIN to make a purchase.
However, both methods rely on your card issuer's fraud monitoring. If someone does make an unauthorized purchase through either method, your liability and refund process are the same: report it within 60 days and your bank will investigate and refund the charge if it is fraudulent.
When your bank requires a PIN for contactless payments
Most contactless transactions under a certain amount do not require a PIN or signature. This limit varies by card issuer and payment network — some banks set it at $25, others at $100 or higher. The limit also changes depending on how many contactless transactions you have made recently; after a certain number of PIN-free taps, your bank may require a PIN for the next one as a security check.
For transactions above your bank's contactless limit, the terminal will prompt you to insert your chip card or enter a PIN. This is a built-in safeguard: high-value purchases require proof that you authorized them. If you see a PIN prompt and you did not initiate the transaction, do not enter it — stop the transaction and contact your bank.
Some merchants also require a PIN or signature for certain categories of purchases (gas stations, for example) regardless of amount. This is the merchant's choice, not your bank's, and it adds another layer of verification.
What to do if your contactless card is lost or stolen
Call your card issuer immediately — do not wait. Most banks have a 24-hour fraud line on the back of your card or on their website. Report the card as lost or stolen and ask them to cancel it and issue a replacement. Under federal law, your liability for unauthorized charges is capped at $50 if you report the loss before any fraudulent charges are made, and $0 if you report it after fraudulent charges appear but within 60 days of receiving your statement.
While you wait for the replacement card, ask your bank whether they can issue a temporary digital card number you can use in mobile wallets or online. Many banks offer this service and it takes minutes. You can also request a rush replacement card if you need it urgently.
Check your statements for the next two to three months for any unauthorized charges. If you spot fraud, report it to your bank in writing within 60 days of the statement date. Your bank will investigate and refund the charge if it is fraudulent. Keep copies of all correspondence.
Comparing contactless security to other payment methods
| Payment Method | One-Time Code | Requires PIN for Theft | Fraud Liability Cap |
|---|---|---|---|
| Contactless Card | Yes | No (up to limit) | $50 (or $0 if reported within 60 days) |
| Mobile Wallet | Yes | Yes (biometric or PIN) | $50 (or $0 if reported within 60 days) |
| Chip Card (Inserted) | Yes | Yes (PIN required) | $50 (or $0 if reported within 60 days) |
| Magnetic Stripe (Swiped) | No | No | $50 (or $0 if reported within 60 days) |
Contactless cards are more secure than magnetic stripe cards because they use one-time codes. They are roughly as secure as chip cards in terms of fraud protection, but chip cards require a PIN for in-person theft, while contactless cards do not (up to a limit). Mobile wallets are the most secure option for in-person purchases because they require biometric authentication or a PIN before every transaction.
All four methods offer the same federal fraud protection: your bank refunds unauthorized charges if you report them within 60 days. The difference is in how hard it is for a thief to make an unauthorized purchase in the first place. Contactless is convenient and reasonably secure for everyday transactions, but it is not bulletproof.
Frequently Asked Questions
Can someone steal my card information just by standing next to me?
A thief would need a specialized reader and your card would need to be very close to it. Even if they captured the signal, they would get a one-time code that cannot be reused. Most card issuers also monitor for suspicious patterns and would block the card before a second fraudulent transaction went through. The risk is real but low for everyday use.
Do I need to report contactless fraud differently than other fraud?
No. Call your card issuer's fraud line, report the unauthorized transaction, and follow up in writing within 60 days of receiving your statement. Your bank will investigate and refund the charge if it is fraudulent. The process is the same regardless of how the fraud occurred.
What is the maximum I can spend contactless without a PIN?
This varies by bank and payment network. Most issuers set the limit between $25 and $100 per transaction, and some require a PIN after a certain number of PIN-free transactions in a row. Check your bank's website or call the number on your card to find out your specific limit.
Is contactless payment safer than using my phone to pay?
Mobile wallets are slightly safer because they require biometric authentication or a PIN before each transaction. Contactless cards do not. However, both use one-time codes and both offer the same fraud refund protection, so the difference is modest for most people.
What should I do if I see a contactless charge I did not make?
Call your bank's fraud line immediately and report the unauthorized charge. Do not wait for your statement. Your bank will cancel your card, investigate the charge, and issue a refund if it is fraudulent. Report it in writing as well to start the formal dispute process.