Contactless payments have become the convenient villain of card fraud: the fear is a hidden reader skimming a card through a pocket and cloning it. The evidence is more nuanced. European supervisors and researchers agree contactless has limits, but most card fraud happens elsewhere—mainly in remote payments and schemes that persuade the cardholder to act.
- Remote fraud dominates: About 83% of EU/EEA card-fraud value in 2024 was remote, versus 28% of total card value.
- Contactless has brakes: No-PIN payments cap at €50 and a €150 or five-transaction ceiling.
- “Pocket cloning” is largely myth: NFC readers can capture close-range data, but single-use codes and tokenisation limit reuse.
- Real risks are human: Fraudsters trick victims into tapping infected phones, manipulate ATMs, or steal wallets.
What the fraud data shows
A December 2025 joint report by the European Banking Authority and the European Central Bank put fraud involving EU/EEA-issued cards at €1.3 billion in 2024—just 0.033% of transaction value. About 83% of fraud value was remote, though those payments were only around 28% of card value.
Under Article 11 of Delegated Regulation (EU) 2018/389, in force since 14 September 2019, a bank may waive strong customer authentication for contactless payments only below €50 and if, since the last PIN entry, the customer has not exceeded either €150 cumulative or five consecutive transactions. Issuers choose one counter.
In practice, the system demands a PIN before an account is drained. The Bank of Spain’s customer portal notes that above €50 the PIN is required; below it, check the terminal screen, since a mistyped amount is likelier than a criminal reading the card. On a phone, set a PIN threshold—€50 by default—and lock the handset.
Why “clone from a pocket” falls short
The myth has a grain of truth. INCIBE, Spain’s cybersecurity institute, acknowledges that NFC readers can obtain card data from less than 15 centimetres in seconds. But reading data is not making a payment.
EMVCo, which maintains the payment-chip standard, says every contactless transaction generates a single-use security code. A stealth reader may capture it but cannot turn it into a card that pays repeatedly like a cloned magnetic stripe. Counterfeit cards accounted for only 11% of in-person fraud value, versus 42% for lost or stolen cards.
Mobile payments add tokenisation: the Bank of Spain highlights it, and EMVCo says a token replaces the card number with a value restricted to a merchant, device or scenario, making reuse hard.
Contactless is not invulnerable. In 2020, ETH Zurich researchers described contactless EMV flaws that, on Visa cards, allowed payments above the limit without a PIN, according to INCIBE-CERT. Exploiting it required the card or an NFC phone close by.
The risks that are real
1. Tricking the cardholder into tapping. In May 2025, INCIBE-CERT described SuperCard X, Android malware found in an Italian campaign. Criminals used SMS and calls to persuade victims to install an app; when a card was tapped on the infected phone, it relayed NFC communication in real time to an attacker’s device, which made purchases or withdrew cash. The weak point was the call asking victims to “verify” a card. No bank needs that.
2. The manipulated ATM. In March 2023, Spain’s National Police warned of a “contactless scam” at cash machines. Criminals blocked the slot; one offered to help an elderly customer while another withdrew between €200 and €1,150. Do not accept help, go accompanied if needed, and cover the keypad.
3. A stolen wallet. With a physical card, a thief can string together small payments until the PIN requirement kicks in. Ask the bank for an alert on every charge and know how to block the card.
RFID sleeves and where attention belongs
An RFID-blocking sleeve is cheap and harmless, but it does not address the main risk. INCIBE lists it among tips, alongside switching off phone NFC when unused and, where banks allow, disabling card contactless. Reviewing transactions regularly matters more.
For genuine exposure, the bigger front is online: the European report found card fraud was 17 times higher when the merchant was outside the EEA, where strong authentication is not mandatory. That is where virtual cards, dynamic CVVs and 3D Secure earn their keep.
Contactless has become the scapegoat for fraud that mostly happens elsewhere. The data shows that €50 and €150 limits, single-use codes and tokenisation work. Criminals no longer read pockets—they call, persuade, or offer ATM help. A card belongs on a shop’s terminal, never on a phone because someone asked.