MasterCard PayPass requires pin. What's going wrong?

Question

Two days ago I was in Tampere and tried to pay with my credit card (it is Raiffeisen Bank MasterCard which supports PayPass technology). I have never paid using it before but I was pretty sure that it doesn't require entering pin code since it is PayPass (I have used another MasterCard PayPass a lot in Russia and it never asked me to enter a pin). But both in McDonald's and in souvenir shop reading devices proposed me to enter pin. I found that really strange. Could you please share an idea what was wrong? Was the problem in those devices, in my card or in my understanding of what does PayPass guarantee me? It would be especially great if you live in Tampere or have visited it recently and tried to use PayPass card there.

P.S. Please, note, that in both cases total amounts of money I should have paid were relatively small (less than 10 euro).

Answer 1

All the EMV contactless payment cards (paypass, expresspay, paywave etc) will sometimes 'request to go online' when making a transaction, which translates into asking for a PIN. The info you received with the card should have included something about this.

For example, the Mastercard information about PayPass includes the note

"Contactless" payments are tapped, not swiped. It's simple.

1. Look for your MasterCard PayPass logo on your card or the reader
2. Tap your card on this symbol PayPass locator
3. Look for the green lights, listen for the beep, and GO*
4. That's it, you're on your way. No need to enter a PIN †

[...]

† there may be some instances when you are asked to enter your PIN number for security reasons or for purchases above a certain amount.

You're not doing anything wrong; there's nothing wrong with the readers or your card; this is a standard feature of contactless.

If you're asking "why did my issuer's risk model instruct my card to go online for these particular transactions?", well, we can't answer that, and your issuer probably won't, 'for security reasons'.

---

Also, I've just seen that you say "I have never paid using it before" - I believe ALL contactless cards will require a successful PIN transaction before any contactless transaction can succeed - this is to stop someone who's intercepted your card in the mail from being able to spend your money...

Answer 2

EMV cards use an offline transaction counter to increase security. This counter is maintained inside the card and incremented every time a transaction is confirmed by the card.

• For (online) contact transactions, the card will usually receive feedback from its issuer, which (among other actions) will reset that counter to zero. For offline transactions, the card will increment the counter by one each time it is used.

• For contactless transactions, things are a bit different: Since contactless transactions usually do not maintain a connection between the card and the terminal long enough to transmit issuer feedback to the card, the counter cannot be reset that way. The counter will therefore even be incremented for online transactions.

The implications of this are dependent on what your issuer is actually doing with the contents of the offline counter: Some issuers use this as a safety measure for contactless cards and allow only a limited number of contactless transactions, since those usually do not require any cardholder verification method below a certain threshold (e.g. 25€ in many European countries), and the total risk in case of physical card theft can therefore be limited to <number of offline transactions>*<maximum contactless transaction amount>.

Usually, you would have to use your card in a contact-based transaction to reset the counter, and the terminal would display an according notice. It is indeed strange that the terminal instead requested your PIN.

If this happens again, you could try to use your card once via the contact interface and see if this resets your offline counters and allows you to pay without PIN entry for the next few transactions.