Apple Pay fraud is highlighting an important challenge for financial institutions as mobile payments introduce new ways for consumers to use existing credit and debit card accounts. Although mobile wallets can incorporate sophisticated security technologies, fraud can still occur when criminals successfully add stolen card information to a device.
For banks, this means security cannot depend solely on the protections built into the mobile wallet itself. Strong verification during card enrollment and provisioning is also essential, particularly as financial institutions expand into mobile wallets, P2P payments, and other emerging digital payment channels.
High incidences of fraud with Apple’s mobile payment app may require banks to adapt their security measures in new ways, according to experts.
A report in the Wall Street Journal on Monday said that banks were seeing a growing incidence of fraud with the Apple Pay app, and quoted mobile payment expert Cherian Abraham as saying that payment fraud was “growing like a weed.”
But to pin the problem on Apple Pay is to misunderstand the system, according to John Pironti, a risk and security advisor at ISACA and president of the security firm IP Architects. In fact, Pironti told VICE News that Apple’s security protections are some of the best in the business.
“The Apple Pay model is based on really good practice of layered approaches, limiting where card data can be present in the device, encrypting things appropriately, doing everything we could reasonably ask someone to do in a commercial payment system. Apple is doing it,” Pironti said. “That doesn’t mean we haven’t got creative guys thinking about ways to take advantage, to leverage the device, the network it’s traveling over, or interfaces with banks.”
The real problem, he said, is that the banks that anchor the transactions aren’t secure enough. When users first enter credit card data into the Apple Pay system, banks should make multiple verification steps to make sure that the person entering the data is the card owner and phone owner.
Banks Face New Mobile Payment Fraud Challenges
With financial institutions looking for ways to expand their product offerings to include various forms of payments, they will need to be vigilant about potential threats in the marketplace. These threats go beyond mobile banking and will likely include such areas as P2Ppayments and mobile wallets. FIs and software, hardware, and other solutions providers will have to ramp up their fraud protection efforts even further than has been the case to date, as fraudsters become more brazen and creative.
The emergence of new payment technologies changes where financial institutions need to focus their fraud prevention efforts. Even when a mobile wallet incorporates strong security protections, weaknesses elsewhere in the payment process can provide opportunities for criminals.
As mobile wallets and other digital payment services expand, banks will need to strengthen cardholder verification and continually reassess their security practices. Addressing Apple Pay fraud and similar threats will require financial institutions and their technology partners to adapt as quickly as fraudsters find new ways to exploit emerging payment channels.
Overview by Ed O’Brien, Director, Banking Channels for Mercator Advisory Group