Security flaws in contactless payments for transportation systems could lead to fraud for stolen devices, researchers find.