Contactless credit and debit cards have been the next step in the electronic payments landscape, moving us from swiping and PINs. However, with the uptick in card fraud as tap-to-pay cards are becoming more mainstream in the Caribbean region, it seems we may have to take a step backwards to manage the risk.

 

At a time when credit card fraud is high, tap-to-pay (contactless) credit cards can seem like a blessing. First, you do not need to enter your personal identification number (PIN) with every charge, for which you might not enjoy any privacy whilst doing so. Second, and perhaps more importantly, you alone handle your card, limiting the potential for surreptitious misdeeds to occur in someone else’s hands, such as the cashier, who (depending on the individual or the store) is expected to take your card to swipe or insert into the card machine before you enter your PIN.

However, in recent weeks, some stores in Jamaica are no longer allowing customers to tap their credit cards or bank cards, reportedly due to an upsurge in fraud that has been occurring Thus, customers are expected to enter their PIN to authorise transactions.

How and why fraud is occurring, which in many instances seems to be due to lost or stolen credit cards, may require a separate exploration. The bigger issue may be the fact that the benefits of having contactless credit cards will not be enjoyed if that capability is not used.

 

How do contactless cards work?

A contactless card, also known as a “tap-to-pay” card, is a type of payment card equipped with radio frequency identification (RFID) or near-field communication (NFC) technology. When you tap or hold your card against the payment terminal, the NFC/RFID chip on your card transmits the necessary payment information to the payment terminal wirelessly, such as the card number, a one-time code, and other transaction details the bank needs to authenticate and execute the transaction.

Contactless cards were introduced to address several needs of both consumers and merchants, and have several advantages, including the following:

  • Speed. Contactless payments allow for quick transactions, which could reduce checkout time.
  • Ease of use. These cards do not require additional steps such as selecting payment choices from a keypad or entering a PIN.
  • Improved card longevity. Unlike other cards with a magnetic stripe that must be swiped or those with a chip that must be inserted into a terminal and can deteriorate due to wear and tear, contactless cards are unlikely to become faulty over time.
  • Increased hygiene. Contactless cards reduce the need for physical contact with public surfaces, such as a keypad or card reading terminal, which would have been especially applicable during the height of the COVID-19 pandemic, but it would also be relevant for other public health concerns, such as during flu season.
  • Widespread adoption. Contactless terminals have been widely adopted, especially in more developed countries, to the point where chip and swipe payment options may not be as available. So for those travelling internationally, cards with tap-to-pay capabilities could be highly beneficial.

Having said this, some drawbacks of contactless cards should also be noted:

  • Transaction limits. Contactless payments may have a transaction limit, which can vary, usually depending on the issuing institution. For larger purchases, you may still need to use a card with a chip or magnetic stripe or enter a PIN.
  • Security risks. Contactless cards can be used without a PIN or signature, which can lead to unauthorised purchases if the card is lost or stolen, and may be the source of much of the recent fraud that has been reported in Jamaica.
  • Limited use. Contactless cards may not be accepted at all (or even most) merchants, thus limiting their effectiveness and utility.
  • Device security. Hackers can modify the NFC tags on smart devices, enabling the transfer of users’ private data to an unauthorised device.

 

Customers versus merchants

To be fair, contactless cards are still relatively new in the Caribbean region. Although they might have been available for around 10 years, it is only in the last few years – most likely due to the COVID-19 pandemic – that the issuance of cards with RFID/NFC technology has become the norm. Further, it is perhaps even more recently that merchants are being outfitted with card terminals that can facilitate contactless transactions. It may thus mean that consumers and merchants may not yet be as aware or as savvy as they ought to be when managing or interacting with these or other advanced technologies and ways to mitigate possible risks.

For example, card owners ought to manage their cards responsibly. Ideally, cards should be kept in a secure wallet or cardholder and never left unattended. It is also prudent not to allow others to handle your cards, as indicated earlier.

Second, card owners should be monitoring their transactions. Most Caribbean banks have online banking facilities, and the larger institutions may even have a mobile application. Hence, get into the habit of regularly reviewing your account transactions for any unfamiliar or unauthorised charges. Further, consider setting up transaction alerts, if the facility is available so that you can receive notifications of your card activity in real-time. Additionally, be prepared to report any lost or stolen cards or suspicious activity on your accounts to your financial institution as soon as possible.

Finally, it is strongly recommended that good digital hygiene, be implemented, such as using strong passwords for your online accounts and ensuring that you are using a secure network when going online to check your bank accounts. Strong passwords have been getting longer and tend to include special (non-alphanumeric) characters. Further, keep up to date on common scams and never provide personal or account information in response to unsolicited emails, text messages, or phone calls.

These practices will help card owners, at the very least, to be more vigilant, to manage their cards more responsibly, and to reduce their exposure to potential fraud.

However, merchants are also in a predicament. When card fraud occurs, it is usually the merchants who lose. Goods have been sold in good faith, but when fraudulent transactions are later identified, and the charges are reversed, merchants would have lost both their goods and revenue. Further, if these types of transactions occur (too) regularly, merchants could be blacklisted and possibly lose their privileges with credit companies, such as Visa and Mastercard.

The question thus is, “How to mitigate that risk?”

 

Managing the risk

An option that offers some rigour is to require customers to directly authorise the charges made, such as by entering a PIN. Further, to add another layer of security is to cross-check the name on the card with that on a government-issued identification (ID) card. So, customers would need to show an ID card and enter their PIN to authorise a transaction.  

Clearly, it does appear that we are taking a step backwards from tap-to-pay to entering PINs and showing IDs. However, card fraud is occurring, and on the rise generally, and more so in the Caribbean region. Further, the technologies used to facilitate contactless payments have not eliminated the risks to merchants. As a result, they may need to be more proactive and even restrictive in the types of payments they are prepared to accept.

Hence, although contactless payments might be here to stay, the Caribbean region may not be ready for their universal and almost exclusive adoption.

 

Image credit: wirestock (Freepik)