On the security of contactless payment systems