'Tap 'n go' not as risky as many fear
"Would you like to tap?"
The Mr Price Home cashier posed the question tentatively as I handed her my debit card to pay for goods to the value of just over R400, prompting me to ask how customers generally respond to being asked to "tap" their cards rather than keying in their pin.
"Some are happy to, but many prefer not to," she said.
Some people aren't aware that their new credit or debit cards are "contactless enabled", or "tap 'n go".
Identified by a wireless symbol on the card, when lightly applied to a contactless point of sale terminal the card allows a payment to be processed without the need for a pin or signature, thanks to wireless chip technology.
As a security measure the "tap" only works for purchases of up to R500 - R200 in the case of Absa. Any more than that and the user is prompted to key in their pin.
While common in many countries, "tap 'n go" debit and credit cards are fairly new to South Africa - Nedbank and Absa, for example, only started introducing them to their clients last year.
Resistance to them, especially among older consumers, appears to be fairly widespread, if callers to a recent talk radio show are anything to go by, the fear being that without the need for a pin, the cards make their bank accounts vulnerable to fraudsters.
A news report published online in December claimed that many South African retailers choose not to use the technology so as not to alarm security-conscious customers.
But Tshipi Alexander, head of consumer issuing at Absa Card, says it is not true that retailers are not using the technology.
"Retailers in general have responded positively as it reduces queueing times and is an enhanced convenience for customers," he says.
"A number of large retailers will be enabling contactless functionality in 2018 as this payment mechanism gains popularity."
Absa began issuing credit cards with "tap" functionality last October and debit cards with this facility a few months ago. As for how customers were advised of the new capability, Alexander says this was done via a brochure sent with the card or an SMS explaining the functionality "and possible exposure".
Hang on to that card
Guard your "tap 'n go" card carefully. It appears that the only way fraud can be committed through the contactless function, albeit for small amounts and probably very few transactions, would be if the card is stolen.
Immediately report your card's loss or theft to the bank. All transactions made after you have reported the card stolen or missing are for your bank's account.
And make sure you are using your bank's SMS notification service so you will be alerted to any transactions if your card is stolen and used without your knowledge.
But fears that "tap 'n go" cards will make consumers more vulnerable to having their bank accounts raided are unfounded, Alexander says - a view shared by other South African banks and banking organisations.
"These cards have not been targeted by criminals.
"It is true that someone could possibly tap your card for low-value transactions and not be asked to enter the pin, but to mitigate this risk there is a series of security measures built into the contactless process.
"For example, not every transaction will go through without asking for a pin. At any given time some transactions will ask for a pin, making it very difficult for a fraudster to use the card with confidence."
Cloning a contactless card is also very difficult, he says, as this involves cloning the card's chip.
Internationally there is no known instance of a chip being successfully cloned and used fraudulently.
"Some reports claim that contactless cards can be remotely 'read' by someone close to you, but tests have shown that the data that can be retrieved in that way is not sufficient to be used in fraudulent transactions - the chip cryptograms are just too strong," Alexander says.
Fraudsters do still copy or clone the magnetic strip on cards and use that in countries where chip technology is not fully in use, he says, "but in this regard, contactless cards are actually less vulnerable to cloning as the plastic never leaves the customer's hand".
Standard Bank agrees. "The increase in fraud-related incidents where fraudsters skim credit card details when handing the card to a merchant makes the contactless card option a safe alternative," a bank spokesman says.
Kalyani Pillay, CEO of the South African Banking Risk Information Centre, says the organisation has not received any reports of "tap 'n go" cards being specifically targeted and exploited by fraudsters.
"Should a cardholder's payment card be stolen, a perpetrator would only be able to conduct a limited number of low-value transactions," she says.
"It's unlikely that organised criminals will be targeting this capability as the reward will be insignificant compared to other modus operandi at their disposal."
Newly appointed banking services ombudsman Reana Steyn agrees that there is no indication that "tap 'n go" cards are a particular fraud risk.
The Payments Association of South Africa, which increased the "tap 'n go" transaction limit to R500 in May, has not detected "any noticeable increase" in card fraud linked to contactless transactions, says CEO Walter Volker.
"A number of markets have progressed down this path far more extensively than we have, specifically Australia, New Zealand, the UK and the EU, and in all those markets no increased fraud levels have been detected.
"Many big retailers already support contactless technology - including Pick n Pay, Engen, McDonald's and Mr Price - and a number of retail stores plan to deploy contactless functionality in the near future."