[rjmunro]

What do you mean by using your PIN "feels more secure". It's more secure for the retailer, but it's less secure for you.

Any time you have to enter your PIN you are putting yourself at risk of someone seeing it. It could even be a fake PIN pad, so covering with your other hand won't help. If they can then steal the card from you, they can spend freely at merchants and withdraw cash at any ATM up to 2X your daily limit (once at 23:59, once at 00:01).

If they steal your card without a PIN, they can use it contactlessly only for small transactions up to the contactless limit, and only for a limited amount before the card will stop working (if you make too many contactless transactions in a row, the bank will refuse one and demand a PIN transaction). (At least in the UK), you are not liable for the contactless transactions made after your card was stolen.

[elric]

You raise a good point about the limits -- although the contactless limits have been raised here due to the pandemic. But I think you're underestimating the physical security of the payment infrastructure. Card terminals (here at least) are extremely secure. They are highly tamper resistant; they cannot access the network if they've been tampered with.

These NFC terminals on the other hand, I have my doubts about many of them. Especially the ones that are basically glorified phones.

Stealing a PIN and a card would be a targeted attack (or an extremely lucky break). When that happens, depending on the bank, taking out money might even be dumbest course of action. Many banks have online services that can be accessed using a card reader (and the card, and the pin). Limits there tend to be much higher, and there won't be an ATM camera filming you.

[rjmunro]

The tamper resistance is less important if you don't have to enter your PIN. The protocols are secured from the card to the bank - the card has a CPU on board.

Tampering with the NFC reader doesn't really get you anything. Tampering with a PIN pad does let you copy someones PIN.