Why do contactless payments without pin code seem to be regulated at national level rather than at bank / customer level?

Question

I have recently checked if I am able to change my contactless without pin limit and realized that this is not an option. So I quickly checked for other countries and it seems to be set by national bank regulation (or law, not really clear). Examples I could find about are Poland (100 PLN) and UK(£30)

Currently, individual contactless card transactions are limited to £30 but research commissioned by GoCompare Money, found that many users want the figure to rise to enable them to pay for a wider range of goods and services.

I will narrow down my question to UK because there the topic seems to be covered by more articles (or at least the search engine provided more for UK).

I am wondering how this limit is regulated? Is this by law or by national bank regulation? Why not allow the bank or even the final customer to set the limit?

Question: Why do contactless payments without pin code seem to be regulated at national level rather than at bank / customer level?

Answer 1

Government regulation is mostly effect of externality that may affect public interest. When dealing with possible financial fraud and fund reclamation, most of this regulated limit are negotiate between the bankers and the regulator. I.e. bankers will try to make more money (PIN verification will cause inconveniences compare to credit card) but shift cost and burden to the consumer ; while the regulator will want the bankers to bare more responsibility (e.g. compensate consumer on fraud, compulsory PIN ).

As shown in this story : "Thieves plundering contactless cards at a rate of £27 a minute: How to stop criminals making off with your cash" , Banks keep mum about the fund recovery and what happens to the merchant end. An older story Banks undermine chip and PIN security because they see profits rise faster than fraud tell about the profit story. So the UK £30 PIN cap requirement is probably a regulator compromised.

Answer 2

Unsure if this question is on topic or not for reasons outlined below:

It is not regulated nationally - industry groups have simply agreed on a limit

See below for an example of a card not affected by limits

https://www.theguardian.com/money/2019/mar/11/natwest-trials-fingerprint-debit-cards-to-remove-30-limit

Also - device payments (apple pay/android pay) have a higher limit but may prompt for an additional cardholder verification method (CVM*) for higher vale transactions i.e. phone must be unlocked by pin/pattern/faceid/fingerprint. This gives a clue as to why the limit was set at £30 for cards - chargebacks are easier for no CVM transactions because it is easier to argue the transaction was unauthorised - therefore banks be more likely to have to issue refunds at a proportionately higher rate for contactless transactions.

Other examples of CVMs are PIN code entry, signature comparison, chip&sign [chip and pin alternative for disabled customers], ID checks, CVC/CV2 codes [card not present (CNP) transactions only], 3D Secure, Postcode matching [CNP only].

How a transaction is 'verified' is an important element in pricing. An acquirer will charge more for less 'secure' verifications as the chargeback probability is higher - hence why they are reluctant to allow no CVM for high value transactions

Answer 3

Please note that a contactless card could be robbed from a distance without the owner being aware of it. A suitably modified device could contact a card several meters away. This drives the need for a limit when the PIN is not provided.