Contactless without a PIN: why the line is drawn at 50 euros and who decides it

The short answer

In Germany, contactless without a PIN works up to 50 euros per payment; after that the card demands a PIN again — under the rules of the Deutsche Kreditwirtschaft after five transactions or 150 euros cumulative since the last PIN entry at the latest. Both limits are set out in Article 11 of Delegated Regulation (EU) 2018/389 and not in your terminal contract: you cannot configure them, and neither can your payment network operator (Netzbetreiber).

What Article 11 actually says

The legal text is short and more precise than most summaries. The payment service provider may waive strong customer authentication if three conditions are met:

	Condition	Value
a)	individual amount of the contactless payment transaction	no more than 50 euros
b)	previous contactless transactions since the last strong authentication, taken together	no more than 150 euros
c)	number of consecutive contactless transactions since the last strong authentication	no more than five

Source: Delegated Regulation (EU) 2018/389 of 27.11.2017, Article 11, retrieved on 11 September 2026.

The legal detail that almost always gets lost in advice columns: the text of the regulation links a) with “and”, but b) and c) with “or”. So the regulation requires only one of the two counters. Which one is up to the card-issuing institution. Germany has opted for the stricter route — the Deutsche Kreditwirtschaft puts it this way in its announcement on the increase to 50 euros: cardholders “must still enter the PIN again after five transactions or after a cumulative total of a maximum of 150 euros at the latest” (BVR/Deutsche Kreditwirtschaft, 15.04.2020). Both counters, whichever comes first.

Austria has the same legal framework with the same 50-euro limit. The official portal oesterreich.gv.at no longer gives any figures for the counters today, only “after several contactless payments or after reaching a certain total amount”. That is correct, because the number depends on the institution — anyone promising a Vienna branch the same customer experience as in Munich is promising something they do not control.

Two limits, two places: terminal and card

This distinction explains the friction at the till.

• The single-transaction limit sits in the terminal. There it is called the CVM limit (Cardholder Verification Method) and is defined in the technical annex of the Deutsche Kreditwirtschaft; with TA 7.2 it was raised to 50 euros, together with girocard's own kernel for contactless payments (PAYONE, Was bedeutet TA 7.2?).
• The counters sit in the card, or in the wallet. They run across all shops, not across your terminal.

It follows that the same customer can pay at your terminal without a PIN in the morning and with a PIN at midday, without anything having changed at your end. They filled up the car in between. Swapping the terminal does not fix this.

On a smartphone it is different: anyone authorising with a fingerprint or face recognition has already provided strong authentication before holding the phone to the reader — possession plus inherence, two factors. The exception in Article 11 is then not needed. The prerequisite is that the terminal supports girocard contactless; otherwise the digital girocard fails even though the customer wants to pay.

How often your customers see the PIN — the calculation by ticket size

The average girocard payment amount in the first half of 2026 was 36.12 euros, and around 92 per cent of payments in June were contactless (EURO Kartensysteme, 25.08.2026). So the typical basket is below the single-transaction limit — which means PIN frequency is not decided by the 50 euros but by the counters.

Ticket size	Payments to reach 150 euros cumulative	Counter that bites first	PIN roughly every
5 euros (bakery)	30	five transactions	6th payment
12 euros (café)	12	five transactions	6th payment
25 euros (snack bar)	6	five transactions, only just	6th payment
36 euros (girocard average)	4	150-euro total	5th payment
50 euros (specialist retail)	3	150-euro total	4th payment
above 50 euros	—	single-transaction limit	every payment

The right-hand column is not guaranteed to the exact transaction, because the counting method depends on the institution; the order of magnitude holds. The pattern is the point: up to around 30 euros basket size the five-transaction counter binds, above that the 150-euro total. And the counters fill up at your competitors too, not only with you.

What that means at the till, as a model calculation with freely chosen assumptions: a bakery with 400 card payments a day, a PIN on roughly every sixth payment, six seconds of extra effort per entry. That works out at around 67 PIN entries and about seven minutes of till time per day. No disaster, but it explains why businesses with a queue at the counter experience the PIN prompt as a disruption while restaurants barely notice it: at a 60-euro basket the PIN is the normal case anyway, and nobody is queuing at the table.

One more question, because merchants ask it regularly: the verification method does not change the price. The fee depends on card type and amount, not on whether a PIN was entered.

No PIN, but with a payment guarantee

The real worry behind this is not a technical one: if nobody enters a PIN, who is liable if the card was stolen? With girocard the answer is clear. Number 5 of the merchant terms of the Deutsche Kreditwirtschaft ties the payment guarantee to the authorisation: with the positive authorisation of the transaction, the card-issuing institution “declares that it will settle the claim in the amount authorised at the girocard terminal […]” (merchant terms, April 2026 version). There is nothing there about a PIN. The conditions are an approved terminal, the agreed mode of operation and submission of the transaction within eight days — which is why a regular end-of-day close is not a formality.

The misuse risk therefore lies with the institution and, to a limited extent, with the cardholder, whose liability for unauthorised payments is in principle capped at 50 euros under section 675v (1) BGB (German Civil Code). The merchant is not the party carrying the default risk in this chain. That is precisely the difference from a direct debit without a guarantee.

What PSD3 and the PSR change about this

Nothing for now. Parliament and Council agreed on PSD3 and the Payment Services Regulation (PSR) at the end of November 2025; in mid-September 2026 the text had still not appeared in the Official Journal; entry into force is expected in autumn 2026 with roughly 21 months of transition for most requirements (it-finanzmagazin, 19.05.2026). Until then, 50, 150 and five apply unchanged. Anyone quoting new thresholds today is citing a text that is not yet official.

What to do now

1. Check the terminal software release. Only devices on TA 7.2 run the 50-euro CVM limit and girocard's own contactless kernel. Ask your payment network operator for the release status — in writing.
2. Check girocard contactless in your acceptance list. Without that acceptance, every digital girocard on a phone fails, and the customer pays cash or not at all.
3. Train staff, in one sentence. “Your card is now asking for the PIN” is correct; “our device is playing up” is wrong and costs trust.
4. Build a different process for baskets above 50 euros. The PIN is the normal case there — the terminal has to be able to come to the customer, not the customer to the till.
5. Read the price and services schedule properly. The fee depends on card type and amount. Any distinction by PIN or contactless deserves to be questioned.
6. If you see frequent declines, do not swap the hardware first. Check the kernel release, the acceptances and the card type before someone sells you a new device with a new contract term.
7. Do not promise branches in Austria an identical customer experience. The 50 euros apply there too, but the counters can differ.