Contactless payments are as secure as chip cards for most transactions, but the safety depends on what you're protecting and which fraud happens after the payment leaves your terminal
Contactless payments—tap, phone, or watch—use the same encryption and fraud protection as chip card readers. The payment data itself is protected in transit. But "safe for your business" is not the same as "no fraud will happen." Contactless fraud exists, it takes different forms than chip fraud, and your liability depends on whether you've set up your terminal correctly and whether the person paying actually owns the card they're using.
The real risk is not that someone will intercept the signal between a card and your reader. The real risks are: a stolen card used at your register, a compromised online account where someone orders with a contactless-enabled card on file, or a customer disputing a charge after the transaction completes. Contactless does not prevent any of these. What it does is move the fraud detection burden partly onto the card network and partly onto you.
Key Takeaways
- Contactless payments encrypt data the same way chip cards do, so the payment itself is not easier to intercept or forge than a chip transaction.
- A stolen card can be used contactless without a PIN, which is why card networks set transaction limits—usually $25 to $100 per tap—to cap the damage from a single fraudulent use.
- You are liable for contactless fraud only if your terminal is not certified for contactless, so verify your equipment meets your processor's standards before accepting tap payments.
- Contactless fraud disputes follow the same chargeback process as any other card payment, and your proof of delivery or service is your defense.
- The biggest contactless risk for most businesses is account takeover—someone accessing a customer's digital wallet or saved card online—which has nothing to do with your terminal.
How contactless encryption works and why it matters
Contactless payments use tokenization: the card data is never sent in full. Instead, a unique token is generated for each transaction and encrypted before it leaves the card or phone. Your terminal receives the token, not the card number. The card network decrypts it on their end and processes the payment. This is the same process chip cards use, which is why contactless and chip have similar fraud rates.
The encryption happens at the moment of the tap. Someone standing next to your customer with a reader cannot intercept the full card number because it is not being transmitted. The token is one-time use and worthless if intercepted. This is why skimming—the classic fraud of reading card data wirelessly—is not a practical threat to contactless payments the way it was to older magnetic stripe cards.
What this does not protect against: a thief using a stolen card at your register, a hacker accessing someone's digital wallet through a compromised phone, or a customer disputing a charge they made themselves. Encryption protects the data in motion. It does not verify that the person holding the card owns it.
Stolen card fraud and transaction limits
A contactless card does not require a PIN. This is a convenience feature and also a vulnerability. If someone steals a physical card, they can tap it at any contactless reader without knowing the PIN. Card networks know this, which is why they impose transaction limits on contactless payments. Visa and Mastercard typically cap a single contactless transaction at $25 to $100, depending on the card issuer and the country. Some issuers require a PIN after a certain number of consecutive contactless transactions—often five—to force verification.
These limits exist to cap the damage from a single stolen card. If a thief taps your card ten times at ten different stores, they can steal up to $1,000 (at $100 per transaction), but they cannot drain your account in one tap. The cardholder is protected by their bank's fraud monitoring and by zero-liability policies. You are not liable for the fraud—the card issuer is—as long as your terminal is certified and you followed your processor's procedures.
The catch: if your terminal is not certified for contactless, or if you accepted a contactless payment without proper encryption, you become liable for fraud on that transaction. This is why you need to verify that your equipment is certified by your payment processor and that you are using a terminal that meets Visa, Mastercard, and your processor's security standards.
Account takeover and digital wallet fraud
The fastest-growing contactless fraud is not at your register. It is account takeover: a criminal gains access to a customer's phone, email, or digital wallet and uses the saved card to make purchases online or in-app. The customer taps their phone at your register, but the card on file has been compromised. The transaction goes through because the phone is authenticated to the account. The fraud happens later, when the customer notices charges they did not make.
This is not your fault and not your terminal's fault. It is a problem between the customer, their bank, and the digital wallet provider. But it will result in a chargeback, and you will have to defend it. Your defense is proof that the transaction occurred at your location—a receipt, a timestamp, a video if you have it—and that the person who made the payment had the phone or card in their possession at the time. For in-person transactions, this is usually enough to win a dispute.
The risk to your business is operational, not financial. You will process the transaction, receive the money, and then lose it weeks later when the chargeback is filed. You will have to provide documentation to your processor. You will lose the merchandise or service. The best protection is to keep clear records of every transaction: time, amount, description of what was sold, and ideally a photo or video of the customer at the register.
Chargebacks and your liability
When a customer disputes a contactless charge, the card network investigates and decides who pays. The process is the same as for any other card payment. The customer's bank submits evidence that the charge was unauthorized. Your processor asks you for proof that the transaction was legitimate. You submit your receipt, delivery confirmation, or service record. The network decides based on the evidence.
For in-person contactless payments, you have a strong defense: the customer was physically present, they initiated the tap, and you have a timestamp and location. For online or phone orders where the customer used a contactless-enabled card on file, your defense is weaker if the customer claims they never authorized the charge. This is why keeping detailed records matters. A receipt with a time, amount, and description of the service is often enough to win.
You are liable for chargebacks only if you cannot prove the transaction was legitimate or if your terminal was not certified for contactless. If your equipment is certified and your records are clear, the card network will usually rule in your favor. If you accepted contactless on an uncertified terminal, you lose the chargeback automatically.
What to check before accepting contactless payments
Verify that your terminal is certified for contactless by your payment processor. This means the equipment meets encryption standards set by Visa, Mastercard, and your processor. Your processor should provide documentation of certification. If you are unsure, call them and ask: "Is my terminal certified for contactless payments?" They will tell you yes or no. If it is not, you should not accept contactless payments, or you should upgrade your terminal.
Check your processor's fraud monitoring settings. Some processors allow you to set velocity limits—how many transactions per card per day, for example—or to require a PIN for transactions above a certain amount. These are optional, but they add a layer of protection against stolen card fraud. Ask your processor what options are available.
Keep clear transaction records. Every receipt should include the date, time, amount, description of what was sold, and ideally the last four digits of the card used. If you use a point-of-sale system, make sure it logs this information automatically. If you use a mobile reader, take a screenshot or photo of the receipt. These records are your defense in a chargeback dispute.
Train your staff to check the cardholder's face if the amount is large or the transaction seems unusual. Contactless does not require a signature or ID, but you can ask for one if you are suspicious. You are not required to accept a payment you do not trust. If someone is using a card that does not match their appearance or name, you can decline and ask for a different payment method.
Contactless versus chip: which is safer for your business
Contactless and chip have the same encryption and the same fraud rate. The difference is convenience versus verification. Chip requires the cardholder to insert the card and wait for the transaction to complete, which takes a few seconds longer. Contactless is faster—the tap is instant—but it does not require a PIN or signature, so there is less verification that the person using the card owns it.
For your business, the choice depends on your priorities. If speed is critical—a coffee shop, a transit system, a busy retail location—contactless reduces checkout time and customer friction. If verification is critical—a high-ticket sale, a transaction with a new customer, a situation where fraud is common—chip or PIN is safer because it requires the cardholder to prove they have the card and know the PIN.
Most businesses accept both. Your terminal can read chip and contactless on the same device. You can let the customer choose. If you are concerned about a specific transaction, you can ask the customer to use chip or to provide ID. You are not locked into one method.
Frequently Asked Questions
Can someone read my card data if I use contactless near a criminal's reader?
No. Contactless payments use tokenization, which means a unique, one-time code is sent instead of your card number. Even if someone intercepts the signal, they get a token that is worthless without the decryption key, which only the card network has. This is why skimming is not a practical threat to contactless cards.
What happens if someone uses my stolen card contactlessly?
The card network's transaction limit—usually $25 to $100 per tap—caps the damage from a single fraudulent use. Your bank's fraud monitoring will flag unusual activity, and you are protected by zero-liability policies. You are not responsible for the fraud. The card issuer covers the loss.
Am I liable if a customer disputes a contactless charge?
Only if you cannot prove the transaction was legitimate or if your terminal is not certified for contactless. For in-person payments, a receipt with a timestamp and description of what was sold is usually enough to win the dispute. If your terminal is not certified, you lose automatically.
Is contactless payment safe for high-ticket sales?
Contactless is as secure as chip for the payment itself, but it does not require a PIN or signature. For large purchases, you can ask the customer to use chip or to provide ID. You are not required to accept contactless if you are uncomfortable with the transaction.
What should I do if I see a chargeback for a contactless payment?
Gather your receipt, timestamp, and any proof that the customer was present at your location. Submit this to your processor within the dispute window—usually 10 to 30 days. If your terminal is certified and your records are clear, you will likely win. If you cannot prove the transaction was legitimate, you will lose and have to refund the customer.