Banks and retailers are increasingly adopting tap and go or contactless card payments and consumers, who have access to the technology-enabled cards, are benefitting from the efficiency and ease that it offers. However, there is not much insight on how banks are mitigating the risks of these payments.
Galix Networking MD and qualified security assessor Simeon Tassev looks at how banks and retailers can utilize this convenient payment method without forgoing effective security measures.
“Tap and go cards are embedded with a specific chip that allows for near field communication (NFC) – a technology that enables compatible card readers to authenticate transactions by proximity to the card,” explains Tassev.
According to Tassev, the purpose of tap and go transactions was to do away with the time-consuming pin code and authorisation process, speeding up the payment process. The card does not necessarily need to come into physical contact with the machine, despite the requirement to ‘tap’ it; this action merely ensures that the card is close enough to the machine to be read.
More than half (53%) of global transactions at POS (Point of Sale) will be contactless within five years, compared to just 15% this year...
22 Aug 2017
How safe is a no-pin payment?
As no pin code is required, there is no true authentication and the cardholder is deemed to be the owner of the card. This is a daunting prospect, as it means that if a user’s card is stolen, the thief may make purchases using the tap and go function with ease. However, there are security parameters that have been put in place to counter this.
Tassev says: “Similar to the EMV (Europay, Mastercard, and Visa) chips, tap and go chips are very difficult to copy. Potential thieves need to physically be in possession of the card in order to make purchases using tap and go. Banks have also set payment limits, only allowing for smaller purchases to be made using this method, too. In South Africa, these are typically set between R200 and R500 per purchase.”
There is the chance of a thief stealing a tap and go card and making multiple purchases in succession, but the risk is smaller than a copied card being used to make large purchases. Of course, Tassev adds that online purchasing still carries the same risk as with regular chip and pin, or magnetic strip, cards.
Beyond limiting transactional amounts, banks can also impose random pin requests. While this may seem to defeat the purpose of tap and go, it adds a necessary measure of security and only occurs randomly every several transactions.
“Users can also enable SMS notifications for even the smallest transaction, ensuring that they are alerted to any unauthorised transaction taking place so, even if the card is stolen and used, they can be quick to report it and cancel their cards,” includes Tassev.
“Technically, the responsibility for transactions made on a stolen card can be proven to be the responsibility of the card user, as the user should be able to prove that there was no negligence on their part – something that’s not easy to do. However, most banks cover these losses themselves, as they value their customers’ business.”
Technology developments will continue to revolutionise payment in both the real and virtual worlds across the globe. As always, though, local conditions will dictate exactly how global trends affect local markets...
David Noel Lardin 13 Mar 2018
Onward and upward
The technology has seen a relatively slow global adoption, with larger markets exercising caution before rolling it out. Tassev says that markets such as America are now in the process of deploying tap and go across many major retail chains, establishing the technology as an acceptable payment method, and cementing the likelihood of it becoming commonly used.
In South Africa, several banks and retailers have begun deploying tap and go, and endorsements from recognised payment brands as well as the Payments Association of South Africa (PASA) have ensured that local adoption will only grow from here.
“Tap and go is convenient and the security risks are relatively low, especially when compared with other payment methods. It’s only a matter of time before tap and go payments are prerequisites for express checkouts, so customers can reap the maximum benefits from this technology. Meanwhile, users should simply exercise caution when using their card: keep it safe and don’t delay with blocking the card if it should fall into someone else’s hands,” Tassev concludes.