As Mondato Insight discussed previously, fraud is a fact of life that is never going to disappear until humans do (and even then it is likely to live on in the animal kingdom). Fraud and theft are like water, in that they follow the path of least resistance. So just as the introduction of EMV-standard chips into U.S. debit and credit cards precipitated a drift away from in-person fraud and a rise in online fraud, the increase in contactless (NFC) card numbers has meant that there are more opportunities for fraudsters to "tap-and-pay" using funds that are not theirs.

In some markets, the scale of the criminal opportunity is huge. In the UK, Barclays Bank reports that 50% of eligible Barclaycard transactions (under £30) are now made using contactless payments (a category that includes various "X-Pay" mobile platforms).

Contactless cards are even more dominant in Canada, which is card-heavy but mobile-pay light. Apple Pay and Samsung Pay arrived much later in Canada than in the United States, ceding much of the country's mature digital payment ecosystem (70% of all personal purchases in Canada are card-based) to plastic cards, increasingly NFC-based. Canada seems headed for the impressive and psychologically important tipping point of 50% of all transactions being made using NFC by the end of this year.

Canadians are continuing to take advantage of the growing number of contactless payment options available to them, driving a year-over-year increase of 36.29 percent in total contactless dollar volume this quarter. The share of transactions made using contactless payments continues to rise at a consistent pace. In the second quarter of 2017, nearly 40 percent (39.50 percent) of all transactions made were with tap-and-pay methods, up from 30.86 percent in the second quarter of 2016. Moneris predicts close to 50 percent of all transactions will be made using contactless payments by the end of 2017.
Moneris analysis, July 2017

These two markets, then, offer useful case studies in assessing the risks posed by contactless, given rising levels of hysteria in the press (and even the judiciary) over the "ludicrous" "dangers" posed by contactless cards. And the reality is that in Canada, despite the boom in contactless payments, debit card fraud is at an all-time low, with just CA$11.4m of fraud recorded by the Interac network in 2016.

It should be noted, however, that Interac does not permit card-not-present (CNP) transactions in Canada - a move that consumers and merchants elsewhere may not be ready for - but one that Interac is proud to have implemented.

Card-not-present fraud weakest link. CNP fraud doubled in Canada since chip began. INTERAC transactions protected from CNP #2014FraudConf

— INTERAC (@INTERAC) April 30, 2014

Bad PR

Most Mondato Insight readers will be aware that there is no connection between CNP and contactless fraud, but contactless payment methods are guilty of the dual sins of being both novel and involving technology. Consequently, they fall victim to sensationalist headlines and ill-considered ignorance (which when mixed make quite a potent bad-PR brew. See below).

From the BBC:
This regional story followed on the back of a local judge's comments (see below)

From the Daily Mail
Financial website of the year

BBC Devon
The judge chose to highlight £23 using contactless from a £2000 fraud spree.

Of course, journalists taking figures and statistics out of context to create headlines is not a new phenomenon, even though it may have become even more widespread in the era of click-bait. And neither, for that matter, is a crusty old judge making off-hand comments.

Nevertheless, when it comes to the subject of money, and specifically, the security of customer funds placed with the country's little-loved banks, uninformed pronouncements from the judicial bench (and the like) make for good newspaper fodder, and serve to heighten consumer suspicions of new technologies. This is likely a partial explanation for why, in Canada at least, consumer concern about debit card fraud has had an inverse relationship to actual fraud levels.

Despite these record-low fraud numbers, however, a recent survey for Interac Association/ Acxsys Corporation (Interac) found Canadians are increasingly concerned about fraudulent activities such as skimming and electronic pickpocketing. For example, 75 percent of debit cardholders said they were somewhat or very concerned about skimming, up from the 49 percent of cardholders who expressed similar concerns in 2015, while 71 percent were somewhat or very concerned about electronic pickpocketing, up from 40 percent the year before. Joanna Schoneveld, Senior Manager of Fraud Programs at Interac, says these findings suggest a misperception among Canadians about the risk of debit card fraud in Canada.
Interac, February 27,2017

Help Is At Hand

Of course, it is not just a PR battle that contactless payments need to fight: banks are already waging a high-tech war against fraud in an effort to maintain the relatively high levels of security (even if imperfect) that debit card payments offer. Real time analytics, machine learning and artificial intelligence are among the most powerful pieces of weaponry available to banks for detecting card fraud.

And while it does sound somewhat Big Brotherish, the profiles that banks build of what constitutes each consumer's "normal" purchasing habits, such as time, location, frequency and spend, are an increasingly important element in the struggle to balance security and convenience.

Moreover, the ubiquitous nature of the mobile phone, as an adjunct to a contactless payment card, creates the possibility for easy-to-implement two-factor authentication, potentially requiring both PIN and further authentication via a push notification/ text/ call. Taken together, the opportunities for successful in-person fraud are small, in comparison to the skimming-rich and signature-faking thievery of pre-chip days.

Additionally, in the EU at least, regulation is helping to forge a unified front in the fight against contactless payments fraud. PSD2 includes a requirement to apply a maximum cumulative amount that can be spent between authenticating the identity of a contactless card user. In practice, a cumulative spend of €150 through contactless, or five consecutive individual payments, will automatically trigger the requirement for a PIN, limiting the practical use of stolen contactless cards.

Help or Hindrance?

All things considered, the future looks contactless, so long as consumers keep calm and carry on consuming and purchasing using their NFC cards. But a big question mark remains hanging over the connection between the success of contactless cards and the growth of mobile-based contactless payments.

On the face of it, a well-developed contactless network lays the groundwork for the growth of mobile payment platforms. But there is a catch: the ease of use of contactless cards seriously undercuts part of the value proposition of mobile payments. It is, as yet, too early to draw concrete conclusions, but anecdotal evidence (including from within Mondato) has pointed at even die-hard Apple Payers succumbing to the ease of "tap-and-go" at Tim Horton's or PetroCanada.

Some mobile payments advocates may have believed that contactless payments would grease the engine for the growth of mobile payments. Without further investment and legwork from mobile's stakeholders, though, the convenience and security of contactless cards could well have ended up greasing the pole for them instead.

Image courtesy of Amit Gupta.

Click here to subscribe and receive a weekly Mondato Insight direct to your inbox.