1

I have recently checked if I am able to change my contactless without pin limit and realized that this is not an option. So I quickly checked for other countries and it seems to be set by national bank regulation (or law, not really clear). Examples I could find about are Poland (100 PLN) and UK(£30)

Currently, individual contactless card transactions are limited to £30 but research commissioned by GoCompare Money, found that many users want the figure to rise to enable them to pay for a wider range of goods and services.

I will narrow down my question to UK because there the topic seems to be covered by more articles (or at least the search engine provided more for UK).

I am wondering how this limit is regulated? Is this by law or by national bank regulation? Why not allow the bank or even the final customer to set the limit?

Question: Why do contactless payments without pin code seem to be regulated at national level rather than at bank / customer level?

  • @Abigail - yes, it makes sense. Although where I live most will just ask for contactless payment. If it is above the limit the POS will ask for the PIN. The retail staff does not care or maybe I am missing something. – Alexei Apr 23 at 7:18
2

Government regulation is mostly effect of externality that may affect public interest. When dealing with possible financial fraud and fund reclamation, most of this regulated limit are negotiate between the bankers and the regulator. I.e. bankers will try to make more money (PIN verification will cause inconveniences compare to credit card) but shift cost and burden to the consumer ; while the regulator will want the bankers to bare more responsibility (e.g. compensate consumer on fraud, compulsory PIN ).

As shown in this story : "Thieves plundering contactless cards at a rate of £27 a minute: How to stop criminals making off with your cash" , Banks keep mum about the fund recovery and what happens to the merchant end. An older story Banks undermine chip and PIN security because they see profits rise faster than fraud tell about the profit story. So the UK £30 PIN cap requirement is probably a regulator compromised.

2

Unsure if this question is on topic or not for reasons outlined below:

It is not regulated nationally - industry groups have simply agreed on a limit

See below for an example of a card not affected by limits

https://www.theguardian.com/money/2019/mar/11/natwest-trials-fingerprint-debit-cards-to-remove-30-limit

Also - device payments (apple pay/android pay) have a higher limit but may prompt for an additional cardholder verification method (CVM*) for higher vale transactions i.e. phone must be unlocked by pin/pattern/faceid/fingerprint. This gives a clue as to why the limit was set at £30 for cards - chargebacks are easier for no CVM transactions because it is easier to argue the transaction was unauthorised - therefore banks be more likely to have to issue refunds at a proportionately higher rate for contactless transactions.

Other examples of CVMs are PIN code entry, signature comparison, chip&sign [chip and pin alternative for disabled customers], ID checks, CVC/CV2 codes [card not present (CNP) transactions only], 3D Secure, Postcode matching [CNP only].

How a transaction is 'verified' is an important element in pricing. An acquirer will charge more for less 'secure' verifications as the chargeback probability is higher - hence why they are reluctant to allow no CVM for high value transactions

  • So, if I understood correctly, there is no national entity that regulates these limits (per country), but agreed at some bank association level or similar. Thanks for the clarification. – Alexei Apr 23 at 12:41
  • That is my understanding but I am open to correction. I think it has actually been codified in law as part of PSD2 [1] [2] but that is not in effect yet 1. ec.europa.eu/info/law/… 2. barclaycard.co.uk/business/news-and-insights/what-is-psd2 – unknown__ Apr 23 at 12:45
  • Surely there are also some national / European regulations governing this? – JJJ Apr 23 at 12:46
  • @JJJ Why? Banks have an inherent interest to limit possible loss and protect their customers. – Martin Schröder Apr 23 at 19:09
  • @MartinSchröder why? If there are no laws governing them, they will just want to maximise profits like all the other companies. – JJJ Apr 23 at 21:20
0

Please note that a contactless card could be robbed from a distance without the owner being aware of it. A suitably modified device could contact a card several meters away. This drives the need for a limit when the PIN is not provided.

  • This is true and I think a limit is needed. However, I am wondering about the rigidity surrounding it. – Alexei Apr 24 at 9:17
  • The regulator is concerned with a massive attack that could threaten the stability of the system. – Jonathan Rosenne Apr 24 at 9:53
  • 1
    No need to go high tech. A skilled pickpocket can take my wallet without me being aware of it, and take as much money as the card limit allows. – gnasher729 Apr 24 at 14:50
  • It isn't the same level of risk. A skilled technical guy can pick thousands of cards electronically in half an hour. – Jonathan Rosenne Apr 24 at 18:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.