Credit and debit card “tap to pay” limits are now higher. Should you worry?

Electronic payments have been set up that way to limit fraud. Tap limits are set by the card issuer and hinge on their risk tolerance, as the issuer takes the hit for unauthorized transactions on your debit or credit card. A low tap limit puts less financial burden on a card issuer if a user’s card is compromised. 

That’s changed since the onset of the COVID-19 pandemic. Sensibly, to help Canadians avoid touching surfaces like payment terminal keypads, in April 2020 tap limits were increased to $250 from $100 for credit card transactions. (Interac’s debit-card transaction tap limit has always been $100.) This increase to $250 helps accommodate social distancing and reduces card users’ physical interaction with payment devices. 

Tap your card, and it’s easier and faster than ever to pay for pricey medications at the drugstore for a chronic condition, or pick up pot lights at Home Depot. But is it risky for consumers to have such high limits on their cards?

How contactless payment limits went up

As Canadians began staying home and self-isolating in March 2020, we were also encouraged to reduce shopping trips to essentials-only and to avoid high-contact surfaces to limit the spread of infection and help flatten the curve. Credit card payment limits went up in early April. 

“Moneris worked with card brands and issuing partners to increase contactless transactions and ensure frictionless, safer commerce during the pandemic.” says Patrick Diab, chief product officer of Moneris, Canada’s largest credit card processing company. Plans were not previously in the works to increase limits, and this was in direct response to COVID-19, Diab says.

How popular are tap payments in Canada?

Interac Flash, which is the tap-enabled version of a debit card, entered the market in 2011 and is now available through almost all financial institutions in Canada, says Nader Henin, Interac’s associate vice president of commerce. Canadians use debit tap payments a lot. “In 2019, Interac Flash transactions surpassed 3 billion transactions,” says Henin. This accounts for a little under half of all Interac debit transactions.

Credit card tap payments have been available to Canadians since 2012. According to Moneris, it processes 3.5 billion transactions a year across approximately 350,000 merchant locations.

Amid the COVID-19 pandemic, contactless spending accounted for 52.5% of all credit and debit transactions in Canada in April, May and June of 2020, says Diab. “That number is growing week over week as more businesses [re-]open. The average transaction value over $100 is now $148,” he says.

Likewise, Interac’s contactless payment popularity is on the rise. The growth of Interac Flash use (as a percentage of total Interac Debit transactions) has almost doubled the normal growth rate in the pre-COVID period of November to March, with June seeing a 9 % increase compared to March of this year, even though the Interac tap limit remained at $100.

What are the risks for consumers?

Both Moneris and Interac assure there is no risk to either consumers or vendors with this new increase in contactless payment limits. “Merchants and consumers are not held liable for any fraud,” says Diab. For contactless credit card payments, the liability is on the credit card issuer.

Let’s say you have a Visa credit card from RBC. In the event of a fraudulent transaction, neither you, the consumer, nor the merchant where the fraudulent transaction was made would be out of pocket. Instead, the issuer—in this theoretical case, RBC—would assume liability.

Interac’s debit cards have a lower tap-to-pay limit at $100. There’s a cumulative dollar amount limit for consecutive transactions, typically of $200, that is set by the issuing bank or credit union, says Henin. “When a transaction is above either limit, the user is prompted to restart the limit with a chip-and-PIN transaction, which confirms that the user is the authorized cardholder.” Interac also has a zero liability policy, where cardholders will be reimbursed 100% for fraudulent transactions.

These limits offer protection against theft and fraud, and there are other security measures like EMV technology, a global standard that uses computer chips to authenticate (and secure) chip-card transactions.

While the volume of Interac debit transactions is growing, card fraud losses remain at record low levels, the company says. For example, in 2019, total Interac debit fraud losses as a result of skimming (a type of fraud where a gadget installed at an ATM or disguised as a point-of-sale terminal at a retailer copies your card’s magnetic strip and PIN), were $2.4 million, a decrease of 45% compared to 2018. According to Interac, this decline is a result of the industry’s investment in security features such as EMV-based secure chip processing, which protects against skimming, counterfeiting and electronic pickpocketing. Additionally, Interac works collaboratively with financial institutions, merchants and law enforcement in fraud prevention efforts.(Moneris says it does not have access to credit card fraud numbers as it is the individual card issuers that take on liability for contactless payments.)

“Contactless transactions are considered more secure because they are card-present transactions—meaning, the owner of the card should be present when using it—compared to non-card-present transactions like giving a credit card number over the phone,” says Diab.

You don’t need to worry about gadgets that people can press near you to create a transaction from your wallet, nor should you bother with RFID envelopes or wallet products. That’s not only because strangers generally aren’t getting as close to each other as in the past with new social distancing guidelines, but also because with current security standards used by tap-enabled cards and digital wallets, RFID skimming isn’t an effective fraud method, according to Moneris.

How to protect yourself and your payment cards

Hang on to your own credit and debit cards and don’t lend them to anyone. Also, don’t allow someone else to tap your cards for you; they should remain in your hands. A good practice is to keep your receipts after each transaction (you can ask the cashier to pop them into your shopping bag to limit contact). This way, you have a paper trail of all the transactions you’ve made.

Using a digital wallet, such as Apple Pay, Google Pay, Visa Checkout, Mastercard Masterpass, and Samsung Pay, along with digital cards actually adds a layer of security. Most digital wallets use tokenization which means the actual card number, expiry, and CVV are not exposed during payment. Instead, a token, which can only be used if your identity is verified, is used. 

Tokenization replaces credit card details with a unique identifier. The token, typically a randomly generated number, effectively hides your private information from your digital wallet app provider (Apple Pay, for instance) and the merchant (the pharmacy, for example) during payment. 

Once the transaction reaches your financial service provider and gets confirmed, the token is then “translated” into your banking information. That way, the only people who have access to the credit card details are the cardholder (you) and your card issuer. 

“Using a digital wallet for contactless payments also adds security with a password or biometric proof (fingerprint, facial scan) required to unlock your phone,” says Diab.

What to do in case of fraud

If you lose your card, call your card issuer or financial institution immediately and let them know and likewise if you notice unauthorized purchases. Your financial institution will begin an investigation. If fraud is found to have occurred, your funds will be returned to you by your financial institution, according to Interac’s zero liability policy. With credit cards, you will not be held liable for the charges.

MORE ABOUT SMART SPENDING:

• 6 things you didn’t know could be hurting your credit rating
• Compare the best savings accounts in Canada
• Canada’s best rewards credit cards

About Helen Racanelli

Helen Racanelli is a writer and independant insurance advisor based in Toronto. She writes a Substack humour newsletter called Helen Avery.

Linkedin Twitter Website