What is Contactless Payment Fraud?
Contactless payment fraud in NFC and tap‑to‑pay channels focus on relay attacks to extend range, compromised phones with weak device locks, illicit token provisioning, and merchant spoofing via tampered terminals. Contactless convenience makes users feel transactions are “risk free,” but attackers disagree.
Potential attacks include on‑device malware to sniff OTPs, social engineering to enroll the wallet, and “bump” charges at venues with high limits and crowds. Compromised terminals can skim PAN tokens or reroute charges to attacker accounts. Controls: Enforce strong device security and biometrics for wallet access; detect abnormal token provisioning (new devices, excessive retries, risky ASNs); and monitor terminal health and firmware integrity. The ecommerce equivalents (card‑on‑file taps, tokenized rails) are treated analogously to CNP: velocity, device graphs, BIN/country scoring. If contactless use links to account creation or payout updates, require identity verification and tighten checkout rules—see payment fraud prevention—so “easy” payments don’t mean “easy” losses.
