×

We've got news for you.

Register on Sunday Times at no cost to receive newsletters, read exclusive articles & more.
Register now

Contactless or reckless? Tap and pause to think about your ...

Ideas

IN YOUR CORNER

Contactless or reckless? Tap and pause to think about your card’s security

I asked a number of banks whether Tap and Go card fraud is a problem and what the adoption rates were

Consumer journalist
All you have to do is wave or tap your contactless card against any of the secure contactless readers and your payment will be processed.
All you have to do is wave or tap your contactless card against any of the secure contactless readers and your payment will be processed.
Image: Gallo Images/iStock

It was an anonymous message about what a fraudster did with someone’s “contactless” Tap and Go bank card that got me investigating to what extent these cards allow thieves to tap into people’s accounts.

It went like this: “My friend had his card used 50 times in less than an hour, with the same vendor — R500 each time.

“He was away from SA and didn’t have his cellphone, so couldn’t see the SMSs.

“The bank denies any liability.”

SA banks have been issuing RFID (Radio Frequency ID) credit and debit cards for some time. They are the ones with a wifi-type symbol on them.

Tap and Go cards were introduced by banks worldwide as a fast, contactless way to pay. No signature or PIN is required for purchases under R500.

All you have to do is wave or tap your contactless card against any of the secure contactless readers and your payment will be processed.

You are someone in possession of your bank card, that is. And that’s what has so many people worried.

It is true someone could possibly tap your card for low-value transactions and not be asked to enter the PIN‚ but to mitigate this risk‚ there is a series of security measures built into the contactless process.

Not every transaction will go through without asking for a PIN. At any given time some transactions will ask for a PIN‚ making it very difficult for a fraudster to use the card with any level of confidence.

This week I asked the ombudsman for banking services (OBS) if that office receives many complaints from people who had been defrauded by someone using their Tap and Go cards.

Data, information and operations manager Edrich Buytendorp said the office doesn’t keep specific statistics on Tap and Go transactions.

“We estimate that in the past year we have dealt with between 20 and 30 complaints,” he said.

Those would have been people whose banks took no liability for their losses, prompting them to lodge a complaint with the OBS in the hope that its adjudicators would overturn that decision.

“When we investigate these complaints we consider factors such as whether the complainant was aware they had this facility and how it works and the bank’s terms and conditions around this functionality,” Buytendorp said.

In a recent case the OBS dealt with, a bank customer complained that R400 was taken from her account in two amounts — R100 and R200 — after she lost her card.

The OBS ruled in favour of the bank, because the fraud was reported by the woman some time after the transactions had taken place and therefore “the bank was not in a position to prevent the loss suffered”.

Interestingly, what none of the banks mentioned was that Visa and Mastercard offer global zero liability protection to credit card holders.

The bank’s terms and conditions require its customers to immediately notify their bank should their card be lost or stolen.

I asked a number of banks whether Tap and Go card fraud of the lost or stolen card kind was a problem and what the adoption rates were.

Interestingly, what none of them mentioned was that Visa and Mastercard offer global zero liability protection to credit card holders — they will refund losses “provided you have used reasonable care in protecting your card from loss or theft”.

“Reasonable care” is a subjective term, but it’s worth remembering that should someone tap up a credit in your name.

Importantly, the OBS is of the view that banks should be able to deactivate the Tap and Go functionality on their cards if the cardholder doesn’t want it.

Interestingly, FNB confirmed to me it does not allow its customers to do this.

Other banks, such as Nedbank, allow its customers to switch off Tap and Go on its Money App or via online banking.

ABSA

“Fraud incidences pertaining to contactless card transactions remain minimal — customers who have either lost or misplaced their cards can lock and unlock the card in the Absa banking app, preventing usage when the card is not in their possession.

“Last year we saw in-store contactless card volumes for debit and credit cards increase by 230% and transactional value rising by 180%.”

Last month 47% of all card transactions were contactless.

To thwart thieves using a stolen contactless card from going on a tapping spree — limiting each transaction to no more than R500 a time — Absa encourages its customers to register for its NotifyMe service to ensure they keep a close eye on all activity in their account, regardless of the transaction value.

FNB

During March 2022, 59% of card-present transactions (in-store) were contactless compared with 48% last March.

Contactless fraud is relatively low; over the past year there has been fewer than 5% in contactless fraud.

The bank does, however, expect contactless cards to transition quickly to contactless NFC device payments over the coming years. FNB has to date enabled Apple Pay, Samsung Pay, Garmin Pay, Fitbit Pay and the Android-based FNB Pay solution.

All FNB cards are contactless enabled and the function can’t be disabled as it is a core feature of the product.

“We encourage our customers to transition to device NFC payments and the use of virtual cards as the next evolution of payment convenience and security.”

NEDBANK

About 13% of its card transactions are now contactless.

Nedbank has rules in place to detect suspicious spend — value and velocity — for contactless transactions, but it’s important to note that a contactless card is just like cash.

If your contactless card is used without a PIN, you will not be able to dispute the transaction and you will be held accountable, unless you have reported your card as lost or stolen before the contactless payment was done.

On average 19% of its clients use contactless methods of transacting, with a slightly stronger adoption from the credit card client base than cheque card clients.

STANDARD BANK

“We have seen strong adoption of contactless transactions with almost half of all physical transactions now being contactless.

“Our credit card clients’ contactless transactions now account for more than 70% of all physical transactions.

“The industry spend limit of R500, combined with additional internal-risk triggers, parameter checks and the fact that contactless transactions go online, assists us in combating fraudsters and mitigating impact.

“A cardholder can also use various methods to report and prevent fraudulent activity, including their banking app.

“The most prevalent way fraudsters come into the possession of a stolen card is via ATM card swapping, and we therefore urge heightened awareness when doing ATM transactions.”

CONTACT WENDY: E-mail: consumer@knowler.co.za; Twitter: @wendyknowler; Facebook: wendyknowlerconsumer

Support independent journalism by subscribing to the Sunday Times. Just R20 for the first month.

subscribe

Previous Article

On Russia, SA is its own worst enemy

By William Gumede
5 min read