Based on my reading, there definitely are challenge/response protocols, but they also seem quite dependent on the specific merchant/POS (and issuer) as to wheth

Based on my reading, there definitely are challenge/response protocols, but they also seem quite dependent on the specific merchant/POS (and issuer) as to whether or not they are enforced or effective (for example, there could be an offline-purchase system that reconciles latter in the day instead of with every transaction, or the issuer might use a static/clonable challenge). I'm still learning... Interestingly, CBC had an article a few years ago anticipating today's: http://www.cbc.ca/news/technology/story/2010/05/31/f-rfid-credit-cards-security-concerns.html http://www.cbc.ca/news/technology/story/2010/05/31/f-rfid-cr... It outlines a few interesting hacks (ex, anticipatory challenge/response gathering). Mostly, it just seems very easy to get the card number and expiry - and apparently that's not a secret, or anything to be concerned about, as far as the credit card company is concerned.