Credit card tap convenience versus worries about security

MasterCard calls it PayPass, Visa calls it payWave. Interac calls it Flash. Users of recent-era credit cards and debit cards have the option of paying for purchases by tapping their card or placing it near terminals designed to accept them. There is a ceiling on the amount that can be paid via tap, typically $100.

Card issuers promote tap as a convenience. You tap, get a receipt, and you’re done. No need to slide your card into a slot, type in your PIN, and wait for authorization.

But many cardholders are skeptical, judging from comments I’ve heard from colleagues and from postings on banking forums on the Internet.

Their primary objection: If a card is lost or stolen, the finder/thief can spend, spend, spend without having to provide a PIN. You have to check constantly to make sure you’ve still got the card so that you can immediately call to cancel if it’s missing. There’s no PIN to slow down the thief.

Also irksome, if you’re opposed to tap because of paranoia or principle, you may have trouble turning it off. My bank says they can turn off tap on my debit card, which they control, but not on my credit card, which they issue in partnership with Visa. Their Visa agreement doesn’t allow for payWave to be disabled.

Tap objectors tell me that they are careful to never use tap because that way they can establish a pattern in case their card is ever lost or stolen. If they never use tap, they say, they’ll have a stronger case arguing that they were not responsible if their card gets into the wrong hands and suddenly goes on a tap spree.

But I’ve also heard this argument: Use tap for small purchases. Reserve PIN-authorized payment for large purchases. That way, there’s less chance that your PIN will be compromised.

For me, both the tap and PIN systems don’t feel secure. They are susceptible to relatively easy theft. A thief can peek over your shoulder if you carelessly enter a PIN in a moment of inattention and then pickpocket your card. PINs and card numbers can be stolen in volume through a hijacked payment terminal.

Card issuers say there is zero liability if a card is stolen. But there would be plenty of hassle if you had to challenge a pile of charges that you didn’t make.

New services like RBC Wallet, Apple Pay and Google Wallet look promising, though availability in Canada is limited. With Apple Pay, available only in the U.S. so far, you use a recent-generation iPhone that’s linked to your credit card account. Payments are made by holding the iPhone close to a payment terminal and are authorized by a customer placing a finger on the iPhone’s fingerprint scanner. Apple says the credit card number is not transmitted in the process; instead, one-time tokens or codes are used, and the merchant never gets access to your personal information, including your name and card number. That information isn’t even stored on your phone.

Tap is still unfamiliar to many people. I’ve witnessed confusion at payment terminals about how tap is supposed to work. Tap cards are being sent out as old cards expire or are replaced for other reasons. In Canada, they started to appear in 2011. Mine arrived when old cards expired; there was no choice. A lot of businesses still don’t have payment terminals that can accept them. But, in an indication that their use is becoming common, I’m seeing a lot of terminals with homemade stickers saying “No Tap” or something similar. That suggests that the merchant is getting a little tired of being repeatedly asked why their terminal won’t accept tap. (When I asked at a few places about the lack of tap I was given these replies: company policy, that’s the machine they gave us, new terminals are expensive, what’s tap?, I don’t know.)

- - -

Update: At the Times Colonist Book Sale, which raised $156,978 over two days for Island literacy programs, 63% of payments were made with a credit card or debit card and 37% were with cash, says the crew who looked after the money side.

They did not have statistics about how many people used tap. I was a volunteer at one of the payment stations, and I’d guess that about 10% of card users opted for tap. Many people, when offered the option, said they didn’t like the feature, or didn’t think their card was capable of tap.

Tap transactions took under 20 seconds from the moment of tap to the receipt being handed over. Transactions where a card was inserted into a payment terminal, prompts appeared on screen and a PIN was entered took at least 30 seconds and sometimes stretched to a minute.

The book sale, where donated books are sold at bargain prices, was on May 2 and 3 and was held at the Victoria Curling Club. The charity fundraiser is an annual event, so look for the 2016 version next spring.

- - -

Here’s a discussion on a TD Canada Trust forum where customers ask about disabling tap. They are told that it’s not possible, and reassured that there is “zero liability” if there’s fraud. That answer doesn’t go over well.

And a story from The Hamilton Spectator: Don’t let Money thieves “tap out” your credit or debit card

Plenty of venom in this posting; I am not recommending that you adopt the suggestions here.

RBC answers questions about its Visa payWave card
http://www.rbcroyalbank.com/credit-cards/visapaywave/questions.html

Apple explains Apple Pay.

- - -

CIBC has this assurance, with a footnote.

Contactless transactions offer multiple levels of security. Cards and smartphones can only be read when they’re 1.5“ from a secure merchant terminal and there is a special encryption process to protect against fraudulent use. Even if you hold your card or phone over the merchant terminal twice, you will only get billed once. In addition, contactless payments are processed through the same reliable network as PIN or swipe transactions, and if your card or smartphone is ever lost or stolen you are protected with zero liability protection[1] for unauthorized purchases.

[1] You are not liable for unauthorized credit card transactions as long as you comply with the CIBC Cardholder Agreement, which includes reviewing each monthly statement and reporting possible unauthorized or fraudulent transactions to CIBC within 30 days of the statement period shown on the front of your monthly statements.

- - -

My previous posts are here.

- - -

Most-popular posts:

Running a smartphone for $10 a month

Puzzling over why some income tax services are free

Via rolls out rooms with double bed on Vancouver-Toronto train

Accidentally at the forefront of fashion with L.L. Bean boots

Favourite restaurant meals of 2014

10 gadgets that were worth buying

To stay cool, leave house windows closed or open?

A guide to public toilets in downtown Victoria

How to block unwanted text messages