Contactless payment limits and fraud liability work on two separate tracks. The limits decide when a tap goes through without a PIN, and the liability rules decide how much you could lose if someone else uses your card or phone. On a single tap, most systems cap you at £100 in the UK, €50 across much of the Eurozone, and whatever your issuer sets in the United States. On fraud, a credit card caps your loss at $50, while a debit card can leave you facing unlimited liability if you wait too long to report.
How Much You Can Tap Before a PIN Is Required
Every contactless card has a per-transaction ceiling. Go over it and the terminal will ask you to insert the card and enter a PIN.
In the United Kingdom, the ceiling is £100 per transaction.1UK Finance. Contactless Cards Information Across much of the Eurozone, the standard is €50. The United States has no federally mandated cap. Individual issuers and merchants set their own thresholds, so the amount you can tap without verification varies by bank and even by store. Some U.S. issuers let you adjust your contactless limit through their banking app.
Merchants can always set a lower limit than the regional default. A store selling expensive electronics might require a PIN on every tap regardless of amount. Enforcement is automatic: the caps are programmed into both the card chip and the terminal software.
The Hidden Ceiling: Cumulative and Velocity Limits
Per-transaction caps only stop one big unauthorized purchase. To catch a thief making a series of small taps that each fall under the single-transaction limit, payment systems also track how many contactless taps you have strung together without a PIN, and their running total.
Under the European Union’s framework for payment services, issuers can exempt contactless taps from strong customer authentication only if the number of consecutive taps since your last PIN entry stays at five or fewer, and the cumulative amount stays under €150.2European Banking Authority. Contactless Payments at Point of Sale – Applications of Strong Customer Authentication Cross either threshold and the next tap gets declined until you insert your card and enter a PIN. It doesn’t matter whether the taps happened at one store or five.
Once you complete a PIN-verified transaction, the counters reset. Mastercard’s merchant guidance describes this as a risk-management counter that forces a contact transaction whenever the issuer’s limits are reached.3Mastercard. Contactless Toolkit for Merchants If you’re using a phone rather than a card, you may be prompted for an online PIN instead of inserting anything.
Why Phone Taps Behave Differently from Card Taps
A plastic card verifies you through the store’s keypad. A mobile wallet like Apple Pay or Google Pay verifies you on your own device before the tap happens, usually through a fingerprint or facial scan. The industry calls this Consumer Device Cardholder Verification Method. Your biometric data never leaves the phone, and each tap generates a unique token in place of your real card number.
Because the biometric check happens before the tap, many issuers treat mobile wallet transactions as higher-assurance than card taps. A phone tap may sail through for a larger amount than a card tap at the same terminal. This also changes what a thief can do with stolen hardware. A picked-up locked phone generally cannot make contactless purchases at all, because each tap requires biometric authentication. A stolen card can be tapped freely at any terminal until the cumulative velocity limits kick in or you report it lost.
Your Liability for Unauthorized Credit Card Taps
Federal law caps your liability for unauthorized credit card charges at $50, and that ceiling applies regardless of how long it takes you to notice.4Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Most major networks go further. Visa’s Zero Liability policy covers lost, stolen, or fraudulently used cards for any transaction processed through the Visa network, contactless taps included. You have to have used reasonable care in protecting your card and report unauthorized charges promptly.5Visa. Zero Liability Certain commercial cards and anonymous prepaid cards fall outside these network policies.
Your Liability for Unauthorized Debit Card Taps
Debit cards operate under Regulation E, and the liability climbs with delay.6Consumer Financial Protection Bureau. 12 CFR Part 1005 (Regulation E) – Liability of Consumer for Unauthorized Transfers Three windows determine what you owe:
- Report within 2 business days of learning of the loss or theft, and your liability is capped at $50 or the amount of unauthorized transfers before you reported, whichever is less.7eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
- Report after 2 business days but within 60 days of your statement, and liability rises to as much as $500.
- Report after 60 days from the statement date, and you face potentially unlimited liability for unauthorized transfers that occur after that 60-day window closes and before you notify your bank.6Consumer Financial Protection Bureau. 12 CFR Part 1005 (Regulation E) – Liability of Consumer for Unauthorized Transfers
The jump from $50 to unlimited based purely on reporting speed is where most people get burned. A thief with a stolen debit card can drain an account through small taps that each stay under the single-tap cap, and once the 60-day window closes on those transactions, recovering the money becomes far harder. Checking bank statements regularly and turning on transaction alerts are the practical defenses.
What to Do When a Card or Phone Goes Missing
Call your card issuer to freeze or cancel the card. Most banking apps also let you lock a card instantly from your phone, which buys you time before the formal cancellation call.
If a phone with a mobile wallet is missing, you can disable payments remotely. For Apple Pay, sign in to your Apple Account from another device or a browser, select the lost device, and remove your cards from Wallet & Apple Pay.8Apple. Remove Cards and Passes in Wallet on iPhone For Google Wallet, remove the lost device’s access through your Google Account’s device activity page rather than deleting individual cards, because deleting a card removes it from all your devices.9Google Wallet Help. Remotely Disable Google Wallet or Added Card in My Lost Device You can also call your card issuers to suspend the tokenized card numbers linked to the wallet.
For a debit card in particular, the clock on your liability starts the moment you learn the card is gone. The two-day window is short, and the difference between calling today and calling next week can be the difference between $50 and $500.