Exposing the flaw in tap to pay