Is it safe to let a device pay automatically?

It can be, if the device uses a network token instead of the real card number, has spending limits, and requires authentication such as a fingerprint or passkey for unusual purchases. Users should also get receipts and be able to dispute.

What makes automatic payments safer

• A network token bound to the device, so a compromised device does not expose the card number and the token can be suspended on its own.
• Limits on amount, frequency or merchant type, set by the owner.
• Step-up authentication when a purchase is outside the usual pattern.
• A clear record of every payment, with notifications.
• A simple way to pause or remove the device's payment access.

Where the risks are

A device with weak security can be taken over. A badly designed rule can trigger repeated purchases. And if the owner does not see receipts, unwanted payments may go unnoticed until the statement arrives. The safest setups treat the device like a separate card with its own limits.

The rules that still apply

Card payments made by a device remain covered by the usual dispute rights. Strong customer authentication rules also apply in Europe, with merchant-initiated payments handled under the agreed mandate.

What it means for payment operators

For your merchants in mobility, energy or connected services, device payments run as tokenized, often merchant-initiated transactions. Network tokens and recurring payment infrastructure with clear mandates give their customers the controls that make automatic payments acceptable.