Tap, Pay, and Worry: Users' Perceptions of Contactless Payment Attacks Versus Technical Feasibility

Contactless payment is one of the most popular payment methods, accessible through contactless cards, mobile phones, and wearable devices. However, there are several vulnerabilities associated with this payment method, leading to various attacks. While the technical aspects of these attacks have been extensively studied in the literature, the user perspective remains relatively under-explored. In this paper, we study users' perceptions about contactless payment attacks and vulnerabilities. We assess the technical feasibility of the existing attacks on contactless payment systems, and present a user survey involving 150 participants from the UK, examining their perceptions of contactless payment systems and attacks. We compare users' perceptions with our evaluation of the technical feasibility of contactless payment attacks and find that while users accurately interpret some attacks, they tend to overestimate certain attacks while underestimating others. Additionally, we find that despite available protective measures, users typically take only basic precautions. This highlights a gap between user perceptions and the technical feasibility of contactless payment attacks. We recommend improving contactless payment security and providing targeted user education.