What is contactless payment?¶

Contactless payment allows a card or compatible device to communicate with a payment terminal at close range without inserting the card.

Avoid this assumption: A contactless record proves the named cardholder physically made the payment.

The transaction may use the physical card, a phone, watch or another device containing a payment token.

For lower-value payments, the system may not require a PIN or other fresh authentication for every transaction.

Providers may apply cumulative limits, risk checks or occasional verification requirements.

Relevant records may include terminal ID, merchant location, timestamp, amount, card or token identifier, contactless indicator, authorisation result and any later verification event.

A mobile-wallet contactless payment may use a device-specific token rather than the printed card number.

This can help identify the device-payment relationship, but not necessarily the person holding the device.

A stolen card can be used contactlessly. A family member or associate may also use the card with permission.

Repeated low-value payments may be significant, but they do not automatically prove fraud or a testing pattern.

Compare transaction records with CCTV, device or wallet provisioning records, card possession, reported loss times and other activity.

Ask the issuer whether the payment used the physical card or a tokenised device and whether any risk or verification event occurred.

Preserve the exact merchant descriptor, terminal information, transaction reference, date and time.

Do not treat lack of PIN use as system failure. It may be normal for the transaction type.

When reporting, state that the card or token was used contactlessly at the recorded terminal rather than asserting who presented it.

Operational takeaway¶

Identify whether contactless activity involved the physical card or a tokenised device, then use CCTV, possession and provisioning evidence to establish the user.