You know the moment. You tap your card for a coffee or a supermarket shop, expecting the usual beep, and suddenly the terminal asks you to insert the card and enter your PIN. Nothing looks wrong. The card worked five minutes ago. It feels a bit random.
It isn’t completely random. Contactless payment is simply a way for your card to communicate with the payment terminal over a very short distance, without physically inserting it. In the UK, individual contactless card payments are currently limited to £100, while additional security checks can also be triggered after a number of payments or a certain amount has been spent. UK Finance says those background limits can require a PIN before cumulative contactless spending goes beyond £300.
The reason is fairly sensible. If somebody steals your card, contactless makes small purchases extremely convenient for them too. Asking for the PIN occasionally is a way of checking that the person carrying the card is still the person who is supposed to have it. Think of it as the payment system occasionally asking, “Still you?”
Your bank can also apply its own checks, so the exact moment you are asked for a PIN may differ from one card to another. The Financial Conduct Authority has rules around how many unauthenticated contactless payments can happen before an extra check is needed, and banks can choose stricter controls within those limits.
Phones and watches can feel different because they often verify you before the payment even happens, using your face, fingerprint or device passcode. That extra check can make the experience look almost frictionless. Underneath, though, the principle is the same: the payment system is trying to balance two things we all want, speed and proof that the person paying is actually authorised to do it.
I actually like these tiny interruptions once you know why they happen. Ten seconds entering a PIN can feel annoying when there is a queue behind you, but most security is like that. When it works properly, the inconvenience is visible and the problem it prevented isn’t.
