My bank gave me a debit card I can use to run small errands, especially online. I recently started using it for paying also meals and/or drinks.
I noticed that sometimes it is not necessary for the owner of the card (me) to enter the PIN number in order to get the card to process the payment. This happened:
- At the bar, using contactless payment.
- On some online stores where neither the CVV2 nor any PIN where required.
- At some places, such as highway toll stations, where asking for the PIN number would be a burden for both customers and seller (the customer line would simply increase due to the time spent entering the PIN not to mention the need to give a pinpad to someone in a car).
I thought the CVV2 or the PIN were required for a payment to be authorized in case the physical card is not detected by a payment device. This is clearly not true and now I'm afraid that if some online store leaks my data (as it often happens nowadays), the card might be used from someone else. The risk is contained since there is always not a lot of money on the card, but still, I'd have to make a lot of paperwork. I know I can use Paypal, but not every store online accepts it (sadly for us customers, but understandably for them because of the high fees).
Can someone enlighten me as to when and how companies (especially online ones) are authorized to process a payment made through a debit card without asking for the PIN number? Are all online stores able to do this? I'm not that concerned with physical shops accepting cards without requesting PIN since if you loose your card then you immediately block it.
By the way, the card uses the Maestro circuit.