Comment Re:Have a card without a PIN (Score 1) 225
At least in Europe cards are not stored by retailers - card tokens are. And tokens can only be used by same retailer - they will not work it different merchant ID. It is actually so secure that tokens are considered non-sensitive. I've emailed a spreadsheet full of them to payment provider once.
Also majority of retailers use hosted payment pages - they redirect you to payment provided page or use iframe and they cannot even see your card info. They only get back bunch of codes and token (if requested and part of contract). Any follow up payments can be done using token.
Nobody wants to touch card info - too much hassle for no realistic gain. There are some that used to due to legacy reasons, but are moving off it. I helped design migration like this for one of them.
Physical payments are other issue. There are practical attacks - most common are skimmers installed on/in cash machines. Damn common - i've seen few of them just around my place in London. Thus I never use street facing cash points - always ones inside shops or banks.
There are also replay attacks for contactless ones. The only thing to protect yourself is to keep your card in metal wallet. Or just use your phone - it doesn't transmit until screen is on - thus makes it much harder to skim.
There is also PSD2 that is slowly coming in EU (and UK). That pushes security up - for example requiring strong customer verification (PIN or biometric) every 5th transaction.