‘Tap to pay’ warning for South Africans

Criminals are targeting South Africans who use the tap-and-go functionality on their cards to make payments.

South Africa’s sophisticated banking system has allowed consumers and businesses to use a variety of payment methods, with many using digital payment methods.

That said, the increased use of convenient tap-and-go payments can put consumers in harm’s way.

“Imagine you’re paying for petrol and someone is standing near you,” said Richard Frost, Product Head from cyber security company Armata.

“They’re talking on their phone, it’s completely normal. Nothing to worry about, right? Well, until you tap the Point of Sale device with your card, that is.”

“As you tap, that person taps your card, and the money comes off twice—once for the petrol and once for the fraudster. It’s an incredibly easy scam to perpetrate as well. All you need is a credit card machine in your pocket, and you can take any amount you want from someone’s card.”

By the time the consumer gets the two notifications from their bank, the fraudster has disappeared.

A particular concern is that many cards don’t have a limit, with users allowed to pay upwards of R10,000 with a tap of their card.

That said, a transaction for larger amounts needs a verifying SMS from the bank, which could stop someone from falling victim to this scam.

“You can spend quite a lot of money in one tap, which means that the skimming devices designed to siphon the funds at the moment of payment can really hit people hard,” said Frost.

Some banks allow customers to disable the tap functionality in their cards, which Frost said is the best way to ensure financial security.

“Disable the function and keep your card as a backup, somewhere safe where nobody can find it,” Frost suggests.

“Only use it when you have to insert it into a machine and use your PIN. The best option is to use your mobile phone with a virtual card or one of the digital wallet payment services like Google Pay or Apple Wallet.”

“Your mobile phone has more security, and when you tap it, the phone will only allow the amount to come off once. After that, any additional taps will fail, which will prevent this type of fraud from happening.”

In addition, the phone has a time limit, which makes it harder for a criminal to come up and tap it.

“Then bolster this by making the tap amount on your phone small so you can protect yourself from the outset.”

“Then, for the worst-case scenario, use a private folder on your phone to hide your banking apps. There have been cases where people have been held at gunpoint and forced to do an EFT, so don’t have your account visible.”

Armata said that consumers should consider using the chip and PIN functions on their cards for expensive purchases while their mobile devices are used for quick tap-and-go purchases.

It’s also advised not to make any payments in a crowded space and to opt into payment solutions that require some form of authentication.

Read: Criminals are targetting ‘tap to pay’ in South Africa – what you need to know