Tap, Pay, and Worry: Users' Perceptions of Contactless Payment Attacks versus Technical Feasibility

Abstract Contactless payment remains one of the most popular payment methods in the UK, accessible through contactless cards, mobile phones, and wearable devices. However, there are several vulnerabilities associated with this payment method, leading to various attacks. While the technical aspects of these attacks have been extensively studied in the literature, the user perspective remains relatively under-explored.In this paper, we study users' perceptions about contactless payment attacks and vulnerabilities. Initially, we assess the technical feasibility of the existing attacks on contactless payment systems. Subsequently, we present a user survey involving 150 participants from the UK, examining their perceptions of contactless payment systems and attacks. We explore their familiarity with the system, their concerns and understanding of the attack categories, and the protective steps they take. Finally, we compare users' perceptions with our evaluation of the technical feasibility of contactless payment attacks. We find that while users accurately interpret some attacks, they tend to overestimate certain attacks while underestimating others. In addition, in terms of protective actions, we find that despite the availability of effective protective measures, users tend to employ only basic steps to protect against attacks. These findings highlight a gap between the user's perception of contactless payment attacks and their technical feasibility. We offer a set of recommendations, including enhancements to the security of contactless payment systems as well as targeted education for users.