23 Oct 2023

Contactless cards explained

Contactless payments are quick and convenient, but are they safe? Find out everything you need to know about contactless cards in our expert guide.

Chiara CavaglieriSenior researcher & writer

In this article

Banks routinely issue customers with contactless cards, and 57% of all card transactions were contactless in 2022.

While the idea of paying without a Pin might seem risky, fraud rates are very low, equivalent to only 6% of overall card fraud losses.

So, should you be using your contactless cards?

How do contactless cards work?

Contactless debit or credit cards allow you to pay for items without entering your Pin, using wireless near-field communication (NFC) technology that enables one device to communicate with another.

Every contactless card has a small chip in it that emits radio waves. To pay for something, you hold the card near a payment terminal, which picks up a signal and processes the transaction.

You can tell whether your card is contactless by looking for a small logo on it which consists of four small curved lines, similar to the wi-fi symbol. The logo is also displayed on payment terminals that accept contactless payments.

The current contactless limit in the UK is £100.

Initially, you could typically only authorise contactless payments of £30 and under. The limit was then increased to £45 at the start of the coronavirus pandemic.

Following the March 2021 Budget, the limit is up to £100 though systems will need to be updated and it will be down to individual retailers to decide whether to accept the higher limit.

If you want to spend more than this, you'll be asked to make a chip and Pin transaction instead.

A handful of banks are letting customers set their own lower limits if they feel nervous about the increase, including Starling, Lloyds Bank, Halifax and Bank of Scotland. More on this in our news story.

Theoretically, Apple and Google Wallet users aren't subject to the contactless limit, however, some retailers don't distinguish between contactless cards and digital wallets so tap-and-go payments above the limit will be declined.

Barclays has contactless cash machines allowing its customers to withdraw money by tapping their Android smartphones or contactless debit cards.

The bank says this removes the risk of card skimming (fraudsters copying card details at the ATM).

RBS and NatWest customers can also withdraw money without a physical card by generating a Pin within their banking app.

But otherwise, you'll need to use chip and Pin at ATMs.

It is possible to pay for something without meaning to, but only when you're close to the reader.

The cashier needs to activate the terminal (or you need to select this option yourself at a self-service till) to accept contactless payments, reducing the risk of mistakes.

Contactless terminals are programmed to take one payment from one card for any one transaction.

Readers have also been designed to reject payment if two contactless cards are presented at the same time.

Do watch out for card clash on the Transport for London (TfL) network though.

If the reader detects more than one card, it could take payment from a card you didn't intend to pay with and you'll be charged the maximum fare for your journey.

If a thief steals your contactless card, or copies your card details, your bank should reimburse you.

Fraudulent transactions on contactless cards are protected by the same rules that apply to other card payments. For more, see our guide to fraudulent activity.

If you believe a transaction was fraudulent, it's the responsibility of the card provider to prove that you authorised the payment or were negligent in not taking reasonable care of your card's security features - and if it can't, then it must reimburse you.

Which? has previously revealed that card providers sometimes wrongly refuse refunds so if you feel that your bank has acted unfairly, refer your complaint to the financialombudsman.org.uk.

Find out more: Best banks if you have a disability

Where can I make contactless payments?

The vast majority of shops accept contactless cards and both Mastercard and Visa have set targets for terminals in every UK shop to accept contactless payments.

London commuters can use contactless cards through the entire transport network and Stagecoach has introduced contactless payments on its buses.

Charities have also started using 'tap-and-donate' card readers to boost donations.

The technology behind contactless cards

A contactless card contains a chip that holds your account information and an antenna (a loop of cooper wire around the edge of the card) which picks up power from the signal sent out by the card reader.
A card-reading terminal emits an electromagnetic field - when a card enters this field it is powered 'on'.
The chip and the reader communicate with each other using an encrypted language. The reader can then 'introduce itself' to the card.
Only when the card recognises the reader will it 'reply' with a coded data transfer.
The card terminal should then confirm that payment has been accepted - this usually happens instantly.

Contactless and Oyster on Transport for London (TfL)

In London you can travel around by bus, Tube, tram, DLR, London Overground, TfL Rail, Emirates Air Line, River Bus and most National Rail services using an Oyster card, a contactless card, or a mobile payments app.

An Oyster is a smartcard that you must either load with money to use as pay-as-you-go credit, or add your Travelcards and Bus & Tram Passes to.

Contactless debit or credit cards will also work on the TfL network, with the money taken directly from your account on a pay-as-you-go basis. At present, you can't add any Travelcards or Bus & Tram passes.

Using a mobile payments app such as Apple Pay or Google Wallet is no different to using contactless payment card, although make sure your default card is the same at the beginning and end of your journey to avoid being charged the maximum fare.

Contactless can be cheaper than Oyster

TfL applies daily capping to all Oyster and contactless pay-as-you-go journeys, which means that when the total cost reaches a pre-determined limit, you won't be charged for further journeys in the same zones for the rest of that day.

But only contactless journeys benefit from a weekly cap as well as a daily cap, calculated from Monday to Sunday.

If you create an online Oyster or contactless account with TfL you can easily report your card as lost, stolen, damaged or failed and apply for refunds if your journey is delayed (by at least 15 minutes on the Underground and DLR, or 30 minutes on the Overground and TfL Rail).

Are contactless cards safe?

Broadly, yes.

The £100-per-transaction limit is one safeguard, and card issuers also restrict the number of consecutive contactless transactions that can be made before the Pin is requested.

Contactless card fraud on payment cards and devices reached £34.9million in 2022. While this is an 82% increase on the level recorded in 2021, it amounts to only 6% of overall card fraud losses.

Year on year comparisons should also be viewed in the context of Covid-19 lockdowns which saw reduced opportunities for fraudsters.

How much could a thief spend on a stolen card?

In the UK, banks broadly follow the EU's second Payment Services Directive (PSD2) which means they must ask you to use chip and Pin for high value purchases, or once your cumulative contactless spend exceeds a certain level – to prove it's you using the card.

These safeguards are known as 'strong customer authentication' which also affects online banking.

The UK's departure from the EU means that we have set our own caps of:

single contactless payments of up to £100, and
cumulative contactless payments up to £300.

Digital wallets such as Apple Pay are exempt from the cap on transactions – though some retailers may apply the contactless limit – as are unattended payment terminals eg parking meters and transport systems.

Key Information

An even safer way to pay

Apple Pay and Google Wallet can be used anywhere contactless cards are accepted.

But they're arguably safer, because retailers never see your card number. Instead, a temporary number is generated.

Your phone (or other device) will also need to be unlocked in order to make payments. And you can remotely lock your phone if it is lost or stolen.

Find out more: Apple Pay and Google Wallet explained

Why was my contactless payment rejected?

Strong customer authentication rules means that you should be asked to use chip and Pin when your cumulative spend reaches £300.

The problem, however, is that the card machine will simply reject the payment –and as these extra security checks are relatively new, shop staff may think your card has been declined.

Monzo has told customers it will send a notification in the app asking you to retry the payment but for other card providers, it won't be so clear.

If a contactless payment is rejected, it's likely that you're making you have spent £300 across multiple contactless transactions – all you need to do is insert your card and enter your Pin.

Can contactless cards be skimmed?

Banking association UK Finance says there have been no verified reports of contactless fraud on cards still in the possession of the original owner.

In theory, skimming could take place. In 2015, Which? was able to easily and cheaply acquire contactless-card technology and use this to remotely 'steal' key card details from a contactless card. We were then able to order items online, one of which was a £3,000 TV.

Someone would probably have to be uncomfortably close to you to lift your card details without you knowing - in our tests, the card had to be touched against the mobile card reading device. Other readers might be more powerful, but a criminal would still have to obtain a retail reader and corresponding account.

It is worth noting that despite skimming the card details using the NFC technology in our investigation, this type of crime would be documented as 'remote purchase fraud' and not attributed specifically to contactless fraud, because the victim would not know how the details had been obtained.

If fraud that is directly attributable to the contactless functionality of payment cards cannot always be recorded as such, the industry may not be fully aware of the risks.

Previously, contactless cards could still be used even after they were reported stolen and cancelled. This is because some low-value payments could be made offline, meaning they were batched and processed without the store contacting your bank first.

A thief could potentially have used a cancelled contactless card without the retailer or bank realising.

Fraudulent offline payments should be stopped by a Pin request, assuming of course the fraudster doesn't know what it is, but some banks are slack when it comes to this security measure.

Now, the financial regulator has said that almost all contactless card transactions are processed 'online', which means they go to the bank for authorisation. Once the card 'checks in' online with the bank, it will disable a contactless card that has been reported stolen.

If a fraudster does manage to use a card that you've reported lost or stolen, it's your bank's responsibility to investigate and you shouldn't be left out of pocket.

How do I avoid contactless card fraud?

You can take simple step to minimise the risk of card fraud:

Never hand over your card

If your card is taken out of your sight someone could run it through a skimming device, which copies the data from its magnetic strip. Avoid keeping cards in pockets or open bags where they are easily accessible.

Ask for a receipt

Contactless users aren't always offered a receipt, so if you want to keep track of spending and make sure you aren't being overcharged, you may need to ask for one.

Check your statements

You should do this as regularly as possible to look for unusual transactions, including on lost or stolen cards as these can still be used after being cancelled.

Can I opt-out of having a contactless card?

Most banks send their customers contactless debit or credit cards by default.

If you don't want a contactless card, your provider may let you opt-out, although some big banks and credit card providers don't.

Firms aren't obliged to offer you a non-contactless card but the biggest high street providers have all previously told Which? they would allow customers to choose chip and Pin debit cards instead, including: Barclays, First Direct, HSBC, Lloyds Banking Group, Nationwide, NatWest Group, The Co-operative Bank, TSB and Virgin Money.