As mobile payments gained traction, financial institutions, technology companies, and payment networks began exploring new ways to protect sensitive financial information. From biometric authentication to encryption technologies, these developments reflected an industry-wide effort to strengthen security while making digital transactions more convenient for consumers.
Three developments highlighted this evolution: Mastercard’s testing of fingerprint and facial recognition authentication, Apple’s exploration of person-to-person payments through its digital wallet, and updated point-to-point encryption standards from the PCI Security Standards Council. Although each initiative addressed a different aspect of payment security, all three demonstrated the growing importance of protecting customer identities, payment credentials, and transaction data as mobile commerce expanded.
Mobile Payment Security Takes Center Stage
Credit Union Times is reporting on three new developments in the mobile payments space and data security is at the heart of all of them.
Mastercard Tests Fingerprint and Facial Recognition Authentication
First, is the recent unveiling of a MasterCard pilot project to use fingerprint authentication and facial recognition to verify identity and authenticate payment transactions:
“During fingerprint authentication, the user simply touches the device. For facial recognition, the user takes a selfie, but must also blink to become authenticated. MasterCard’s security researchers determined blinking prevents crooks from just holding up a picture and tricking the system.”
“Bhalla said MasterCard doesn’t actually retain individual fingerprints or face images. Instead, the process converts fingerprint scans to codes retained on the device. The facial recognition instrument maps out faces, converts them to a series of 1s and 0s and transmits it over the Internet to MasterCard.”
Apple Explores Biometric Authentication for Person-to-Person Payments
Next up is Apple, which may be extending the functionality of its biometrically-secured Apple Wallet in an interesting way according to a recently filed patent:
“The new patent allows iPhone users to activate their Wallet app, select a stored card to make the money transfer and type in the amount. The payment authentication takes place using Touch ID or the iPhone’s passcode. The wallet system would also let the individual select the funds recipient from nearby iPhone users.
Then, an encrypted “packet” is sent to the person receiving the payment, including the amount, verification and a payment “credential,” which could embody the sender’s credit card details. A third party, the user’s financial institution or credit-card provider, would complete the transaction, and the payee would receive a notification that the payment had gone through successfully.”
PCI Updates Point-to-Point Encryption Security Standards
And finally, PCI SSC—the organization responsible for the ubiquitous payment card data security standards—published a major update regarding the development and use of point-to-point encryption (P2PE):
“One of the major features of the council’s new P2PE Version 2.0 is a stipulation that allows covered entities to employ and manage their own encryption tools at their POS systems provided the tools are compliant with PCI requirements.
“Malware that captures and steals data at the point-of-sale continues to threaten businesses and their ability to protect consumers’ payment information,” PCI Security Standards Council Chief Technology Officer Troy Leach said. “As these attacks become more sophisticated, it’s critical to find ways to devalue payment card data.”
These developments illustrate how payment security was evolving alongside the growing adoption of mobile and digital transactions. Mastercard’s biometric authentication pilot and Apple’s proposed wallet functionality highlighted opportunities to improve identity verification while simplifying the payment experience.
Meanwhile, the PCI Security Standards Council’s updated encryption requirements addressed another critical concern: protecting sensitive cardholder information from malware and other threats at the point of sale.
Together, these initiatives demonstrated the importance of combining stronger authentication with effective data protection. As mobile payments continued to expand, financial institutions and payment providers faced the challenge of delivering convenient transactions without compromising security.
Overview by Alex Johnson, Sr. Analyst, Credit Advisory Service at Mercator Advisory Service
Read the full story here
