A surprising amount of encryption is optional in EMV (the underlying protocol for contactless and chip cards), because when it was originally developed (way bef

A surprising amount of encryption is optional in EMV (the underlying protocol for contactless and chip cards), because when it was originally developed (way before contactless was a thing), vanks were worried about the price of a chip capable of doing all the encryption. It's a source of all kinds of attacks on the protocol (though I don't know how bad it is now). For example, it's not at all uncommon for the reader to send your PIN to the chip in the clear, whoch makes skimming with a modified reader pretty easy (in general the readers have a lot of anti-tamper mechanisms, but they're designed to protect the operator's cryptographic keys, not the security of the card holder)