Security of contactless payment apps in the light of new proposed upper spend limit

robinwales

There's already a thread on contactless limits here, but I didn't want to hijack the thread
https://forums.moneysavingexpert.com/discussion/6247154/contactless-limit
The proposal to increase the spend limit on contactless cards was reported on the BBC the other day here  https://www.bbc.co.uk/news/business-55826118 I was surprised at the number of objections to this proposal, with people voicing security fears. I've been using the G-Pay app for about a year which is linked to my Santander debit card, and last week Santander allowed credit cards (contactless) to also be added. A lot of people seem to think these apps, or how they are used are not secure. My smartphone (Samsung A71) has biometric security, which I have set, and a backup of a pin number. If someone found my lost phone, or stole it, I fail to see how they could use it for contactless purchases. You can't even open the homescreen unless it recognizes my face. If on the other hand I ditched the app and went back to using cards, and someone found my lost wallet they could go into the nearest store and buy what they wanted without any checks. Which do you think is more secure? The spend limit on G-Pay is unlimited, I think. You also get useful electronic receipts.

I appreciate not everyone has a smartphone, or debit/credit cards.

colsten

I don't know the ins and outs of GPay, SamsungPay and GarminPay, but the limits on ApplePay has always been much higher than the limit on contactless cards. Although some retailers choose / are forced by card providers to limit mobile payment methods to the same amount as contactless card limits (e.g. ASDA).

The reason for this is that the mobile payment methods (on phones, tablets or watches) are a lot more secure than contactless cards. I am with you and I almost exclusively use mobile payments now. I now don't even take any card with me when I go shopping, and I generally pay for everything from my watch, so I don't need to take the phone, either.

jon81uk

Apple Pay is not a "contactless card" and subject to the £45 (changing to £100) limit. I assume Google/Samsung Pay is the same. This is because it needs two factors (the phone and the fingerprint/face/PIN) whereas a contactless card is a single factor (card only). We've used Apple Pay to make payments of thousands before.

[Deleted User]

Google Pay is limited to country limits on spending - currently £45 - if your phone is locked e.g. you can hold the power button and tap the phone if you want that option on. If you unlock it there is no limit

PRAISETHESUN

I personally don't have an issue with increasing the contactless limit, although I can see why some might have concerns. That said in my mind an app capable of contactless transactions is at the very least just as, but in many ways much more secure than a contactless debit/credit card. If you lose your card there is no security but at least if you lose your phone then there are several levels of security you can opt into. Even in the worst case scenario that you lose your phone, you don't have a screen lock, and your payment app doesn't have a passcode/other security, then it's just as bad as a lost card. At least the battery will eventually go dead meaning it can't be used weeks down the line if it's loss doesn't get noticed... unlike a card. I feel the banks could work to give people the option of setting their own contactless limits, similar to how we can freeze/unfreeze our cards now via online banking, but I feel there isn't really any sort of push to make something like that happen anytime soon.

colsten

PRAISETHESUN said:

 I feel the banks could work to give people the option of setting their own contactless limits

I think that's a super idea (within the overall contactless limits approved). This would make many people feel more in control. Even a crude 'contactless enabled Yes/No' would be an improvement.

Chino

colsten said:

I think that's a super idea (within the overall contactless limits approved). This would make many people feel more in control. Even a crude 'contactless enabled Yes/No' would be an improvement.

Except when people forget their self-imposed limits resulting in retailers and banks having to field complaints from people that their cards don't work.

colsten

Chino said:

colsten said:

I think that's a super idea (within the overall contactless limits approved). This would make many people feel more in control. Even a crude 'contactless enabled Yes/No' would be an improvement.

Except when people forget their self-imposed limits resulting in retailers and banks having to field complaints from people that their cards don't work.

I reckon it would not be very difficult to display a message for the retailer that says "Contactless not enabled on card" or similar.

robinwales

colsten said:

I don't know the ins and outs of GPay, SamsungPay and GarminPay, but the limits on ApplePay has always been much higher than the limit on contactless cards. Although some retailers choose / are forced by card providers to limit mobile payment methods to the same amount as contactless card limits (e.g. ASDA).

The reason for this is that the mobile payment methods (on phones, tablets or watches) are a lot more secure than contactless cards. I am with you and I almost exclusively use mobile payments now. I now don't even take any card with me when I go shopping, and I generally pay for everything from my watch, so I don't need to take the phone, either.

There doesn't seem to be a limit on G-Pay. I paid for a car service recently which was £250. You use a watch to pay!!! You are obviously ahead of the curve compared to me.   

ratechaser

I was a total ApplePay convert until I found that it can sometimes break the chain when it comes to retailer offers - can't recall if it was Avios or Virgin Miles, but my registered cards for earning in Caffè Nero would only work if used directly and not through ApplePay.

pollypenny

I've just set up Apple Pay on my new phone, succeeding with my credit card as it was registered previously. I wanted to add my debit card, opted for text verification, but couldn't get back to input it after reading the text.  😩