Are mobile wallets safe?

Are mobile wallets safe?

(s4svisuals/Shutterstock)


Save Story
Leer en español

Estimated read time: 6-7 minutes

This archived news story is available only for your personal, non-commercial use. Information in the story may be outdated or superseded by additional information. Reading or replaying the story in its archived form does not constitute a republication of the story.

SALT LAKE CITY — Apple is in the news lately after the FBI obtained a court order requesting the company help unlock one of the alleged San Bernardino terrorist's iPhones. Apple is threatening to ignore the court order, so far, and many are wondering about cellphone encryption and security as a result.

If Apple can't unlock one of its user password protected phones without writing a "backdoor" program and the FBI has so far been unsuccessful, then the devices we increasingly rely on must be safe and secure. Right?

What's interesting in this debate is that many say they trust the security of their devices and fear for what could happen if Apple agrees to write the "backdoor" key that will provide the FBI a way to potentially access any password protected phone.

Despite this sense of security, most still don't trust the wallet functionality of their smartphones. The most comprehensive study of mobile wallet adoption was conducted in 2013 by First Data, a merchant services company. It found that only 18 percent of consumers had serious interest in using a mobile wallet.

Since then, Apple Pay and Samsung Pay have debuted, Softcard has folded and Google Wallet carries on. There are clear advantages to using a smartphone-based mobile wallet, including the ability to combine merchant reward programs and payments within the same system. Merchants are also able to target discounts and coupons to mobile wallet users in a very convenient way.

Samsung Pay has about five million registered users globally, according to Samsung. (Photo: Samsung Pay)
Samsung Pay has about five million registered users globally, according to Samsung. (Photo: Samsung Pay)

Still, the questions remain about security and what possible downsides exist when your credit card info is contained in your smartphone, a device that can easily be lost or stolen. Without getting into subtle differences between the mobile wallets mentioned above, let's discuss how a mobile wallet works and what security measures have been taken.

Mobile wallets use Near Field Communication and a secure SIM card to send payment data to a credit card terminal. NFC technology allows a smartphone to communicate with the credit card terminal, at the resister as long as the screen of the mobile device is turned on and the mobile wallet is open and signed into. The mobile device must be held closely to the payment terminal for the signal to be recognized. The limited range of NFC makes it an unlikely target of hackers.

The credit card information stored in the mobile wallet is passed to the terminal wirelessly, no different than if a debit or credit card were swiped physically. This mobile transaction, however, is safer than swiping a physical card for several reasons.

Industry standards

Payment Card Industry Security Council standards for the mobile payment terminal and transaction must be met, same as for physical credit card terminals. All merchants accepting mobile payments are subject to exacting standards that are subject to audit by PCI.

Use of an encrypted mobile network

Each of our smartphones are communicating with cellular towers using algorithms that effectively change the code used to connect with a cellular tower each time communication is initiated. Even though mobile payments use NFC technology, not cellular, the credit card data stored on the device would be difficult for a hacker to access via your cellular network.

Apple Pay provides a secure way for people to make purchases using their phone. (Photo: Apple)
Apple Pay provides a secure way for people to make purchases using their phone. (Photo: Apple)

Use of a secure SIM card

The secure SIM allows for your credit card data to be stored on an encrypted SIM, separate from your mobile device memory. The credit card data you enter into the wallet is nowhere to be found if a thief obtains your phone and can access the stored data inside. Apple Pay also uses a separate encrypted part of the phone's internal memory to house all of the Pay functions.

Use of an encrypted mobile device

Just as the FBI is having difficulty accessing an alleged terrorist's phone locked with either a numeric passcode or fingerprint, a thief or hacker would be hard pressed to get inside your mobile device even if they had it in their possession. Newer smartphones contain protection that will wipe the contents of a phone if an incorrect passcode is used too many times. If one uses mobile security functions provided by Google, Apple and Windows cloud based services, a phone can be remotely wiped if lost or stolen.

Use of revolving PINs

When one swipes a debit card to make a purchase, the same PIN is entered on the terminal every time a purchase is made. If a hacker has tampered with the credit card terminal they can obtain your credit card info and PIN. Mobile wallets use a revolving PIN system so every transaction is not only encrypted, but the PIN used is randomly assigned new each time you use the mobile wallet. It is not possible for a hacker to obtain a usable PIN via the payment terminal. In cases where a merchant's payment data is hacked within their corporate network, the PIN on record for your mobile wallet purchase is already invalid.

Encrypted payment data

Unlike a credit or debit card purchase made with a magnetic stripe on a physical card, the actual credit card data is never exposed to a mobile payment terminal. The data is scrambled via encryption and then unscrambled via encryption when the payment reaches its destination.

The number of security measures built into a mobile payment system are extensive and far exceed anything using a physical credit or debit card. When making a purchase, your phone itself must be unlocked using a PIN, pattern or fingerprint code. The mobile wallet app one is using must be unlocked using another user-selected PIN. Finally, the transaction itself is encrypted and contains a random revolving PIN and scrambled payment data.

One suggestion to make transactions even safer is to use a reloadable credit card, such as American Express Serve or a prepaid Visa or MasterCard. The number of bank cards that can be used in mobile wallets is growing constantly, but a reloadable card can be set up in such a way that it is tied to your debit card or bank account within the mobile wallet.

The reloadable card can be loaded manually within the wallet or can be set to pull funds automatically from your debit card or bank account with each transaction. For maximum security, only allow for manual reloads of the card. That way, even if a thief or hacker could bypass all the security measures above, he would only have access to the reloadable card and the remaining balance.

Mobile wallets are very safe and can provide for savings at your favorite merchants while eliminating the need to have a physical purse or wallet stuffed with credit, debit and merchant reward cards. People may have reasons for not wanting to try a mobile wallet, but security should not be one of them.


![](//img.ksl.com/slc/2583/258384/25838475\.jpg?filter=ksl/65x65)
About the Author: Mike Stapley ------------------------------

Mike Stapley is a father of two, a business sales manager for a telecom company and an aspiring novelist living in Salt Lake City. Contact him at mstapley4@gmail.com

Related stories

Most recent Features stories

STAY IN THE KNOW

Get informative articles and interesting stories delivered to your inbox weekly. Subscribe to the KSL.com Trending 5.
By subscribing, you acknowledge and agree to KSL.com's Terms of Use and Privacy Policy.

KSL Weather Forecast