UK Card Association asserts that more than half of all debit card transactions will be contactless by 2026. We are already seeing a boom in contactless payments, with many banks automatically issuing contactless cards. Contactless payments offer a quick way to pay for goods, and while generally they only allow payments up to £30, many people still choose it over traditional credit or debit cards. However, not everyone considers the risks involved with having a contactless card. 
When contactless payments first appeared, many raised questions about how safe they are exactly. Banks encourage their use but skeptics warn they aren’t without risks. Reportedly, because of the raising popularity of contactless payments, £14 million were taken from contactless cards in 2017 in the UK, almost double the amount stolen in 2016. While these numbers may see alarming, contactless payment frauds are still relatively rare, particularly compared to other scams. However, with banks aiming to increase the transaction limit and allow people to withdraw up to £100 from cash machines, these scams may become a bigger problem.
Besides the obvious concerns about thieves freely using stolen contactless cards, there are other things to consider as well.
Chip & PIN devices
Every once in a while, a photo or video will surface on the Internet, showing scammers trying to steal from people using contactless cards via a Chip & PIN devices. The whole process looks quite simple, which is perhaps why it is scary. Scammers get close to someone, touch their Chip & PIN devices to places where people tend to keep their cards, the contactless card reacts and a transaction is made. Seems simple enough, but not getting caught doing this would be quite difficult.
First of all, before they can be used to charge cards, Chip & PIN devices have to be linked to a bank account as well as be registered with a payment vendor. And taking into account how carefully monitored such transactions are, it’s unlikely scammers would be able to get away with stealing money this way for very long.
So while scams using a Chip & PIN device definitely do exist, they are not very common due to how difficult it may be to get away with carrying out one. Nevertheless, if you find yourself a victim of such a scam, your bank should refund you in full.
Contactless “skimming”
Skimming is considered to be a bigger issue. Criminals could wirelessly scan your contactless card data without charging you, and later create a clone card. And there is no need to use sophisticated equipment to do the skimming, a smartphone app would be enough. While the skimming device (or smartphone if an app is used) needs to be very close to the card, that is not difficult to achieve in crowded places. In addition, this skimming process leaves no traces, as no transactions are made. So your card could have been skimmed and you wouldn’t even know. And since you would not notice, you would have no reasons to inform your bank about fraudulent transactions or cancel your card.
Skimming devices can steal information such as card type and number, expiry date, card owner’s name. Using the acquired information, a clone card could be made and used at vendors or websites with bad security. And paying online with a contactless card would not be limited to £30. Or the data collected from multiple cards could be sold.
What happens after a contactless card is reported stolen/lost?
First thing you do when you realize someone has stolen your card, whether it’s contactless or not, or when an unknown transaction is made from you account is contact the bank to cancel your card and try to get the stolen money refunded. In theory, as soon as you report the theft or suspicious transaction, the card should be blocked by the bank. In practice, however, it’s not so easy. Several UK banks have admitted that because of a weakness in the system, stolen contactless cards can still be used after they’ve been reported stolen/lost for offline transactions. While banks seem to be very aware of the weakness, they are yet to fix it.
How to protect yourself against contactless payment scams?
While contactless cards do pose certain risk, they are very convenient for small purchases. However, if you intend to use one, you need to take precautions so that you don’t end up unknowingly becoming a victim of fraud. Here are a few tips:
- Consider investing into RFID-blocking wallet or just use some tinfoil. The special wallets may be more expensive than regular ones but if you believe you need one, it may be worth looking into.
- Do not keep your wallet in easily accessible places, like your back pocket. Not only can it be easily stolen, it creates crooks ideal conditions to skim it. Instead, keep it out of sight..
- Regularly check your bank statements for suspicious transactions and if something is amiss, immediately inform the bank. Bank statements should be checked at least a couple of times a month.
If you do not trust contactless cards but want to use the convenient feature, try ApplePay or Google Wallet. They can be used in the same way as contactless cards but provide more security. ApplePay, for example, asks for a passcode or fingerprint in order to confirm a transaction. Or you could stick to regular cards. Generally, if you request a bank to issue you a non-contactless card, your request should be granted. But if it is not possible for some reason, you should be able to switch the feature off by going to the bank or accessing your online bank account.