Features added to contactless payments to boost convenience include allowing offline transactions, transport modes that let commuters move quickly through barriers without unlocking their phones, and region-specific rules on how a PIN is input for high-value transactions.
However, the study found these features could lead to insecurities and, in turn, the possibility to make fraudulent payments.
In practice, researchers were able to demonstrate ways to trick terminals into accepting a plastic card when only a phone should have been allowed, or to process payments above a contactless limit without PIN or biometric checks.
In one case, a payment terminal was made to accept a fraudulent £25,000 payment, the University of Surrey said.