This risk also applies to any card terminal where you pay contactlessly. In Europe, that effectively means every card terminal everywhere and a comfortable majo

This risk also applies to any card terminal where you pay contactlessly. In Europe, that effectively means every card terminal everywhere and a comfortable majority of card transactions (https://www.mastercard.com/news/europe/en-uk/newsroom/press-releases/en-gb/2020/march/mastercard-enables-contactless-limit-raise-across-29-countries-and-champions-permanent-increase/ https://www.mastercard.com/news/europe/en-uk/newsroom/press-... says 75% of mastercard transactions in Europe are contactless). The main protections against this are maximum limits for unverified contactless purchases (about €50, depending on the country) and banks outright guaranteeing customers against fraud (https://europa.eu/youreurope/citizens/consumers/financial-products-and-services/payments-transfers-cheques/index_en.htm#shortcut-2 https://europa.eu/youreurope/citizens/consumers/financial-pr...). No idea how that can translate directly onto phone-based terminals though. On cards, the extra-validation backup for suspicious/over the daily limit transactions is that the contactless machine asks you for your pin, but there's no way anybody should be typing their card pin into a random stranger's iPhone.