Credit and debit card "tap to pay" limits are now higher. Should you worry?

Photo created by prostooleh - www.freepik.com

It wasn’t long ago that, with a week’s worth of groceries teetering in reusable bags and possibly a squirmy toddler strapped into the cart, we had to key in a PIN (personal identification number) when paying by credit or debit card. Sometimes you could tap to pay, also known as contactless payment, but limits were typically low, around $50—enough to grab milk and ingredients for dinner, but definitely not enough to cover the bill for a proper pantry restock. Electronic payments have been set up that way to limit fraud. Tap limits are set by the card issuer and hinge on their risk tolerance, as the issuer takes the hit for unauthorized transactions on your debit or credit card. A low tap limit puts less financial burden on a card issuer if a user’s card is compromised. That’s changed since the onset of the COVID-19 pandemic. Sensibly, to help Canadians avoid touching surfaces like payment terminal keypads, in April 2020 tap limits were increased to $250 from $100 for credit card transactions. (Interac’s debit-card transaction tap limit has always been $100.) This increase to $250 helps accommodate social distancing and reduces card users’ physical interaction with payment devices. Tap your card, and it’s easier and faster than ever to pay for pricey medications at the drugstore for a chronic condition, or pick up pot lights at Home Depot. But is it risky for consumers to have such high limits on their cards?

How contactless payment limits went up

As Canadians began staying home and self-isolating in March 2020, we were also encouraged to reduce shopping trips to essentials-only and to avoid high-contact surfaces to limit the spread of infection and help flatten the curve. Credit card payment limits went up in early April. “Moneris worked with card brands and issuing partners to increase contactless transactions and ensure frictionless, safer commerce during the pandemic.” says Patrick Diab, chief product officer of Moneris, Canada’s largest credit card processing company. Plans were not previously in the works to increase limits, and this was in direct response to COVID-19, Diab says.

How popular are tap payments in Canada?

Interac Flash, which is the tap-enabled version of a debit card, entered the market in 2011 and is now available through almost all financial institutions in Canada, says Nader Henin, Interac’s associate vice president of commerce. Canadians use debit tap payments a lot. “In 2019, Interac Flash transactions surpassed 3 billion transactions,” says Henin. This accounts for a little under half of all Interac debit transactions. Credit card tap payments have been available to Canadians since 2012. According to Moneris, it processes 3.5 billion transactions a year across approximately 350,000 merchant locations. Amid the COVID-19 pandemic, contactless spending accounted for 52.5% of all credit and debit transactions in Canada in April, May and June of 2020, says Diab. “That number is growing week over week as more businesses [re-]open. The average transaction value over $100 is now $148,” he says. Likewise, Interac’s contactless payment popularity is on the rise. The growth of Interac Flash use (as a percentage of total Interac Debit transactions) has almost doubled the normal growth rate in the pre-COVID period of November to March, with June seeing a 9 % increase compared to March of this year, even though the Interac tap limit remained at $100.

What are the risks for consumers?

Both Moneris and Interac assure there is no risk to either consumers or vendors with this new increase in contactless payment limits. “Merchants and consumers are not held liable for any fraud,” says Diab. For contactless credit card payments, the liability is on the credit card issuer. Let’s say you have a Visa credit card from RBC. In the event of a fraudulent transaction, neither you, the consumer, nor the merchant where the fraudulent transaction was made would be out of pocket. Instead, the issuer—in this theoretical case, RBC—would assume liability. Interac’s debit cards have a lower tap-to-pay limit at $100. There’s a cumulative dollar amount limit for consecutive transactions, typically of $200, that is set by the issuing bank or credit union, says Henin. “When a transaction is above either limit, the user is prompted to restart the limit with a chip-and-PIN transaction, which confirms that the user is the authorized cardholder.” Interac also has a zero liability policy, where cardholders will be reimbursed 100% for fraudulent transactions. These limits offer protection against theft and fraud, and there are other security measures like EMV technology, a global standard that uses computer chips to authenticate (and secure) chip-card transactions. While the volume of Interac debit transactions is growing, card fraud losses remain at record low levels, the company says. For example, in 2019, total Interac debit fraud losses as a result of skimming (a type of fraud where a gadget installed at an ATM or disguised as a point-of-sale terminal at a retailer copies your card’s magnetic strip and PIN), were $2.4 million, a decrease of 45% compared to 2018. According to Interac, this decline is a result of the industry’s investment in security features such as EMV-based secure chip processing, which protects against skimming, counterfeiting and electronic pickpocketing. Additionally, Interac works collaboratively with financial institutions, merchants and law enforcement in fraud prevention efforts.(Moneris says it does not have access to credit card fraud numbers as it is the individual card issuers that take on liability for contactless payments.) “Contactless transactions are considered more secure because they are card-present transactions—meaning, the owner of the card should be present when using it—compared to non-card-present transactions like giving a credit card number over the phone,” says Diab. You don’t need to worry about gadgets that people can press near you to create a transaction from your wallet, nor should you bother with RFID envelopes or wallet products. That’s not only because strangers generally aren’t getting as close to each other as in the past with new social distancing guidelines, but also because with current security standards used by tap-enabled cards and digital wallets, RFID skimming isn’t an effective fraud method, according to Moneris.

How to protect yourself and your payment cards

Hang on to your own credit and debit cards and don’t lend them to anyone. Also, don’t allow someone else to tap your cards for you; they should remain in your hands. A good practice is to keep your receipts after each transaction (you can ask the cashier to pop them into your shopping bag to limit contact). This way, you have a paper trail of all the transactions you’ve made. Using a digital wallet, such as Apple Pay, Google Pay, Visa Checkout, Mastercard Masterpass, and Samsung Pay, along with digital cards actually adds a layer of security. Most digital wallets use tokenization which means the actual card number, expiry, and CVV are not exposed during payment. Instead, a token, which can only be used if your identity is verified, is used. Tokenization replaces credit card details with a unique identifier. The token, typically a randomly generated number, effectively hides your private information from your digital wallet app provider (Apple Pay, for instance) and the merchant (the pharmacy, for example) during payment. Once the transaction reaches your financial service provider and gets confirmed, the token is then “translated” into your banking information. That way, the only people who have access to the credit card details are the cardholder (you) and your card issuer. “Using a digital wallet for contactless payments also adds security with a password or biometric proof (fingerprint, facial scan) required to unlock your phone,” says Diab.

What to do in case of fraud

If you lose your card, call your card issuer or financial institution immediately and let them know and likewise if you notice unauthorized purchases. Your financial institution will begin an investigation. If fraud is found to have occurred, your funds will be returned to you by your financial institution, according to Interac’s zero liability policy. With credit cards, you will not be held liable for the charges. MORE ABOUT SMART SPENDING:

About Helen Racanelli

Helen Racanelli is a writer and independant insurance advisor based in Toronto. She writes a Substack humour newsletter called Helen Avery.

Linkedin Twitter Website

Comments Cancel reply

Greg Dalton says:

August 21, 2020 at 5:05 pm

The limit on Costco’s Capital One credit card was raised to $400 at least a year ago.
They do check your photo on the back when you show your card, though.

Reply
Mavis Stoyko says:

August 23, 2020 at 12:04 pm

Hi,

I’d urge the writer of this article to review articles posted online dating back as far as 2017 on how Digital Wallets continue to get hacked.

Everything is being hacked these days, and that also includes ‘secure’ password managers.

Reply
SnapPay says:

September 28, 2020 at 4:28 pm

There is no reason to worry contactless payment solutions have been around for years. Consumers and merchants have been embracing contactless payments around the world. If you are looking for a reliable and secure payment platform for your business in Canada, SnapPay is the best option for you. SnapPay is a leading payment platform from Toronto. We offer payment solutions that allow merchants to accept Alipay digital payments in Toronto from Chinese consumers. You can learn more on our website https://www.snappay.ca

Reply
Mark Webber says:

December 16, 2023 at 6:43 pm

My chip stopped working on my Mastercard. It was the older style chip that had a bigger lump on the card than the replacement. Still worked when inserted for some reason. Guess it was the antenna not working. Anyways, soon as I started using the new tap and go on the new card someone on PlayStation was able to use my old card number and made 6 new transactions all in one day under $100. Mastercard was great and notified me within hours and reversed and blocked all charges when I enquired. Now I’m waiting for a new card… again. They said the thief was using a digital wallet with my old old original card, the one where the antenna was broken. HOW CAN THAT HAPPEN? They told me even though I cancelled my old card number the Digital Wallet would still work? I never used a smart phone or any digital wallet. I don’t even have a smart phone. I don’t believe in coincidence that some thief started using a digital wallet right after I used the new card the day before to make a purchase on eBay. eBay says they share no information on credit car purchases with anyone. I believe them but I also used the tap and go to buy gas, groceries and a local liquor store. I authorized the card by inserting it at the same gas station. That is how you authorize cards now, no phone in. Mastercard tells me now even the digital wallet is blocked. Is it normal or did Mastercard slip up on this? Shouldn’t digital wallets be deactivated when an old number is deactivated? Never mind I never used any digital wallet. Bet nobody has any clue here or anywhere what should happen.

Reply