Sunday, November 1

Why Your Tap-to-Pay Limit Exists, and What Happens When It Rises

A customer tapping a phone on a payment terminal at a shop counter, a daily use of contactless payment limits
Image: RuinDig/Yuki Uchida / Wikimedia Commons, CC BY 4.0

You are queuing for a coffee, a sandwich and a phone charger, and the till asks for a PIN because the total crossed some invisible line. Anyone who has tapped a card in Britain or most of Europe knows that moment. That line is one of the contactless payment limits built into the system, and it is a lot more deliberate than it looks.

A cap set by banks, not by the phone

The first thing worth knowing is that the number on your card is not really a feature of the card. Contactless payment limits are set by payment networks, national banking bodies and regulators, and they differ from country to country. Each issuer then decides how to apply them to your account. The terminal at the shop also has its own configuration.

Contactless payment limits - A customer tapping a phone on a payment terminal at a shop counter, a daily use
Image: Basile Morin / Wikimedia Commons, CC BY-SA 4.0

Phone payments sit slightly apart. When you pay with a wallet on a phone or watch, you usually unlock the device with a face scan, fingerprint or passcode first. That counts as a stronger check than simply tapping a plastic card, which is why wallet payments are often allowed to go well past the card limit at terminals that support it. The phone proves you are you, so the cap matters less.

The trade-off behind contactless payment limits

Contactless payment limits are a bet about risk. Set it low and a lost card can only be used for small purchases, but shoppers get irritated and queues grow. Set it high and checkouts move faster, but a thief who finds a wallet could spend more before anyone notices.

Banks have another tool alongside contactless payment limits: the counter. Most cards track how many contactless payments, or how much total value, you have made since last using the chip and PIN. After a certain point the card insists on a PIN to reset itself. You may have had this happen out of the blue on a small purchase. It is a safeguard, not a fault.

Fraud losses on contactless payments have historically been a small slice of card fraud overall, and a good deal of the rest happens online. So the pressure over the years has been mostly toward convenience. Retailers like quick transactions. Transport operators like gates that open instantly. Customers like not fumbling for a PIN. Raising a ceiling is the sort of change that looks minor and still affects millions of daily purchases.

What a higher ceiling means for you

If contactless payment limits go up, nothing about your existing protection changes. In the UK and many other places, unauthorised card payments are generally covered by consumer protection rules, so you are not expected to eat the loss on a stolen card if you report it promptly. What changes is the exposure window: the amount a stranger could take in a single tap before you freeze the card.

That points to some habits worth building, whatever the number is.

  • Turn on transaction alerts in your banking app, so a purchase you did not make pings you within seconds.
  • Learn where the freeze or lock-card switch lives in the app before you need it.
  • Keep a wallet on your phone if you can, and use it as your default. A stolen phone is locked, a stolen card often is not.
  • Check whether your bank lets you lower your own contactless allowance or switch the feature off. Many do.

A simple example shows how the pieces fit together. Say you buy a newspaper, then a coffee, then lunch, all by tapping the same card. Each purchase is under the cap, so each goes through. Around the fourth or fifth tap, the card’s running counter trips and the terminal asks for your PIN. Nothing is wrong with the card. The rules behind contactless payment limits usually include both a per-payment ceiling and a cumulative check, and you have simply reached the second one.

Why wallets feel safer than cards

There is a technical reason, too. A physical card sends your actual card number, or something close to it, to the terminal. A phone wallet normally sends a token, a stand-in number that works only for that device and that merchant relationship. Each payment also carries a one-time code. Even if someone captured the data in transit, it would be of little use for later fraud.

Tokens also make it simple to replace a lost phone. You remove the card from the wallet remotely and the token dies, while your underlying account continues as before. That is much easier than waiting for a replacement plastic card to arrive in the post.

On the other side of the counter, a terminal has to be recent enough to handle the newer rules. Older readers may reject a legitimate tap above their configured cap, which is one reason you sometimes hit an odd decline even though your account is fine. If a payment fails, try the phone instead of the card, or the other way round, before assuming something is wrong with your money.

Some businesses also add their own friction. A shop may set the reader lower than the legal maximum because it wants more PIN checks on high-value items. Others, like transit gates, use special processing that lets you travel first and settles the fare afterward.

Reading these changes sensibly

When you see a headline about a bigger tap limit, resist both panic and cheering. Contactless payment limits are a dial that financial institutions turn every few years as fraud data, customer habits and technology shift. The dial matters less than the controls you keep within reach: alerts, a lock switch, a wallet and a bank that responds quickly. Set those up this week and the next change, whenever it arrives, will be a non-event. If you want the business side of payments, read how African payment companies get their valuations and why fintech startups fail, and see the background on contactless payment.

Image: RuinDig/Yuki Uchida / Wikimedia Commons, CC BY 4.0.