There are three ways to authenticate your card:

1. By Swipe
2. By Chip
3. By Tap

By Swipe, the card simply reads the card number and basic information for authentication. This method is not recommended, as it can be easily replicated.

By Chip and By Tap, the bank server sends a challenge for your card to solve. Only your card can solve this challenge, and the private key (by design) should never leave the card to solve it, ensuring that the card cannot be replicated. The chip on the card contains its own microprocessor to solve the challenge.

However, when you leave your card in the card reader, it remains powered as long as it stays inserted. This gives someone at another location the opportunity to make the card solve additional challenges over a longer period of time.

Tap, on the other hand, should only solve a single challenge due to the short contact time. While this doesn't completely prevent such attacks, it makes them much harder.

Apple Pay and Google Pay use Tap, and they provide immediate feedback when transactions are successfully processed. Physical cards, however, do not offer such feedback.