Who pays when a contactless payment is fraudulent?
In most consumer cases the loss falls on the bank or the merchant rather than on the cardholder, and that allocation comes from card scheme rules and consumer protection law rather than from anything about NFC. Reporting promptly is what preserves it, which is why it is the advice that matters.
What decides it
Not the technology. Whether a cardholder bears a fraudulent charge is settled by the rules of the card scheme and by consumer protection law, both of which existed before contactless and apply to it as to anything else.
The general shape, in consumer cases, is that an unauthorised transaction is not the cardholder's to bear, with exceptions for their own negligence or delay.
What counts as negligence, what the reporting deadlines are, and how the burden of proof is allocated differ by country and by the type of account, and the authority on that is national law and the account terms rather than this page.
The practical point stands regardless of jurisdiction: the person who decides is your bank, under rules, and the process is a claim rather than an argument about radio.
Why promptness is the variable
Almost every framework distinguishes between losses before a report and losses after it. After a report the liability is generally not the cardholder's at all.
So the window that matters is the one between the card going missing and the report being made, and it is the only part of this the cardholder controls.
This is why every piece of sound advice about card fraud ends with report immediately, and why it is worth more than any physical precaution.
It also explains why reading statements matters: a charge you have not noticed is a charge you have not reported.
Making the report
Contact the issuer through a route you already know, not a number in a message, since fraud around the reporting of fraud is itself common.
Say what you know plainly, including that you still hold the card if you do, since a card in your possession and a charge elsewhere is a strong fact.
Keep dates. When it went missing, when you noticed, when you reported.
And expect the card to be replaced as a matter of course, since the issuer has no way of knowing what else was exposed.
Why this reframes the worry
The anxiety about contactless is usually about money disappearing. The framework means that in the ordinary case the money comes back.
What does not come back is time, and the friction of a replaced card and updated subscriptions.
Which points at a different priority: not preventing an unlikely radio attack, but noticing quickly when something is wrong.
Statements weekly, alerts switched on, and a report the same day. That sequence outperforms every product sold for this.
Frequently asked questions
Am I liable for a fraudulent contactless charge?
In most consumer cases, no. It is decided by card scheme rules and consumer protection law rather than by the technology.
Does it depend where I live?
Yes. Deadlines, the definition of negligence and the burden of proof vary by country and by account type.
What is the one thing that matters?
Reporting promptly. Almost every framework treats losses after a report differently from those before it.
Should I keep the card if I still have it?
Yes, and say so. Holding the card while a charge appears elsewhere is a strong fact for the claim.