How safe is contactless payment, really?
Safer than the magnetic stripe it replaced and safer than handing a card over. The exchange cannot be replayed, it requires an accredited terminal, and it works only on contact. What remains is a small loss if a card is found and used, and routes that never touch the card at all.
The shape of the answer
Three properties do most of the work, and they hold together rather than separately.
The exchange is specific to one transaction, so recording it yields nothing that can be used again. Money moves only through a terminal an acquiring bank has accredited, so a captured exchange has nowhere to go. And the card has to be within a couple of centimetres, which is a limit of the field rather than of the software.
The mechanism behind those, and the two layers a contactless card is built from, are set out on the standards side of the site rather than repeated here.
What follows from them is that the scenario people describe, somebody taking money in a crowd, requires all three to fail at once.
What actually remains
A card that is lost or stolen can be tapped by whoever holds it, up to whatever limit applies before verification is demanded. That is a real loss and it is the risk the limits exist to bound.
A merchant can charge more than agreed, or charge twice, which is a dispute rather than an attack and is resolved through the bank.
And a phone can be compromised, which is a different subject from the radio and a more serious one, since a compromised phone is a problem long before it is a payment problem.
Notice that none of these three is affected by shielding a wallet, which is where most protective spending goes.
The risks that are not about NFC
Card details entered on a website, taken from a breach, or given away over the telephone. None of these involve the card being present at all.
Account takeover, where the attacker never touches a card and never needs to.
And persuasion: somebody convinced to authorise a payment themselves, which defeats every technical control because the control was satisfied.
These routes exist precisely because the card present path was closed. Fraud went where the defences were not, which is what fraud always does.
What is worth doing
Read statements, which catches every route at once regardless of how it happened, and report anything unrecognised without delay.
Prefer paying by phone where you can, for reasons set out separately, since it adds a check no plastic card can offer.
Report a lost card immediately rather than searching for it first, because the window before reporting is the window that matters.
And spend nothing on shielding until you have decided which of the risks above it addresses. The answer is that it addresses the smallest one.
Frequently asked questions
Can somebody take money by standing near me?
No. It needs proximity of a couple of centimetres, an accredited terminal, and an exchange that cannot be replayed. All three would have to fail.
What is the real risk then?
A lost or stolen card being tapped before it is reported, and routes that never involve the card at all, such as details from a breach.
Is paying by phone safer?
Yes, for two reasons that compound: the phone checks who is holding it, and what it presents is specific to that device.
Does a shielded wallet help?
Against the smallest of the risks. Reading statements and reporting promptly addresses all of them.