You tap your card at a coffee counter, hear a beep, and walk away. The whole exchange takes about a second. What happened in that second matters, because the protections around tap-to-pay are real, and so is one scam that borrows the same technology.
What protects a contactless payment
Digital wallets use tokenization, encryption and biometric checks, so the actual card number is not stored or sent with every transaction. Visa's explainer on wallets says this can reduce exposure of payment details. Less data in the exchange means less for a criminal to grab.
Tokenization swaps sensitive card data for a stand-in value that is useless on its own. Rambus notes that this approach has long protected cardholder data and personal information sitting in merchant databases. It also makes conveniences like recurring billing and one-click ordering possible. You can read more in Rambus's comparison of network and PCI tokenization.
One caution from the same wallet source: these safeguards are one layer. They do not replace other fraud controls. What you actually experience depends on how your issuer, the merchant and your device work together, and no single piece carries the whole load.
How relay fraud works
Relay fraud is specific to contactless. It uses near-field communication, the short-range radio behind tap-to-pay, to push unauthorized transactions through in near real time.
Picture the scenario Visa describes. You get a text or call from someone posing as your bank. Your account, they say, is compromised. They steer you to install an app that looks like a banking app. Behind it sits open-source NFC code that turns your phone into a makeshift payment terminal.
Then comes the ask: tap your card on your phone to "verify your identity." The app relays the card's payment details to the scammer's device. The attacker can then transact as if your card were in their hand. Notice what the victim did here. Nobody stole a number off a counter. The victim cooperated, one step at a time, because the story sounded urgent.
That is why a verification step that involves tapping a card on your phone is a warning sign, not a security measure. A real tap happens at a payment terminal when you are buying something.
How the industry responds
Card networks describe layered defenses. Visa says it uses risk scoring, shares intelligence with financial institution clients for transaction monitoring, and tracks anomalies that could point to relay patterns. It also says relay fraud is rising but isolated, since it does not scale easily. Visa reports its risk and control team helped block over $40 billion in fraud attempts in fiscal 2023. Those are the company's own figures, and they tell you about network-level effort, not about your odds on any given day. Its write-up is Relaying the message on relay fraud.
Standards bodies play a part too. The PCI Security Standards Council publishes standards covering contactless payments on commercial off-the-shelf devices and tokenization service providers, listed at its token service provider page. The material available here says little about how those standards touch you directly.
Regulators are looking as well. The CFPB asked for public comment in January 2025 on how the Electronic Fund Transfer Act applies to newer digital payment mechanisms, described in its announcement. In 2023 it also published an analysis of how mobile operating systems control NFC access for tap-to-pay.
Protecting yourself and what remains unclear
Before acting on any unexpected contact, ask two questions. Can I verify this caller or message through a number or website I already trust? Am I being asked to download an app or enter my card PIN for someone I cannot verify? Relay fraud depends on a yes to the second one.
- Unsolicited texts or calls saying your account is compromised
- Requests to install an app that resembles your bank's
- Instructions to tap your card on your phone to verify identity
- Requests for payment details or a PIN over the phone
- Links in unexpected messages from unknown senders
Now the gaps, because they matter. The sources reviewed do not explain how fraud liability and dispute rights apply to unauthorized contactless credit card charges, including any dollar limits or reporting deadlines. They do not name the federal rule that governs contactless credit card transactions specifically. The Electronic Fund Transfer Act discussion does not settle that question. They also do not cover turning off contactless payments, setting alerts, lowering a contactless limit, or reporting relay fraud and replacing a card.
So check your card issuer's terms for those details, and look at the CFPB's and FTC's consumer resources. This article is educational only and is not advice for your situation.
Please seek a professional. This article is general information, not financial, tax or insurance advice. Please seek a licensed financial, tax or insurance professional about your own situation.
