What happens if you tap a terminal you do not trust?
The card responds, because it has no way of judging what it is talking to. The protection sits one step further on: an exchange only becomes a payment if it reaches an acquiring bank through a merchant that bank accredited. A device that captures the exchange has captured something it cannot spend.
The card answers anything
A card has no notion of who is asking. It is powered, it is addressed, and it participates in the exchange it was built to participate in.
So a device shaped like a terminal, or no terminal at all, gets a response. There is no authentication of the reader by the card in the sense people assume.
This sounds alarming and is not, because the response is only worth something to somebody who can present it to a bank.
Where the protection sits
A payment is not a message from a card. It is a transaction submitted by a merchant, through an acquiring bank that has accepted that merchant, subject to rules the merchant agreed to.
An exchange captured by a device that is not part of that chain has nowhere to be submitted. Whoever holds it holds a record of an interaction.
The consequence is that the interesting attacker is not somebody with a hidden reader. It is somebody who has obtained merchant accreditation, which is a fraud against the banking system rather than against NFC.
How accreditation is granted and revoked, and what checks a scheme applies, belongs to the payment schemes rather than to a general guide.
The version of this that is real
A terminal displaying one amount and submitting another, or a merchant charging twice. Both are ordinary disputes and both are resolved through the bank rather than by any property of the card.
A terminal in a place where you would not choose to pay, which is a judgement about the merchant and not about the technology.
And a card tapped by accident against a terminal you were not intending to use, which is why a payment normally shows a confirmation and an amount.
None of these are solved by refusing to tap. They are solved by watching the amount and reading the statement.
What to do at a terminal
Look at the amount before presenting the card, which is the only check the technology cannot make for you.
Keep the card in your own hand rather than handing it over, since the ordinary risks around a card are physical rather than radio.
Prefer the phone where the amount is unusual, because the confirmation step is on your device rather than on theirs.
And if something is wrong, the recourse is the bank, promptly. That is where this class of problem is actually resolved.
Frequently asked questions
Can a fake terminal charge my card?
It can complete an exchange and cannot turn it into money, because submitting a transaction requires accreditation with an acquiring bank.
Does my card check the terminal?
No. The card answers whatever addresses it. The check happens further along the chain, not at the card.
What is the realistic risk at a terminal?
The amount being different from what was agreed, or a double charge. Both are disputes, resolved through the bank.
Should I avoid tapping in some places?
The judgement is about the merchant rather than the technology. Watch the amount and read the statement afterwards.