With just the press of a button, consumers can pay at countless e-commerce sites without having to repeatedly enter personal or payment credentials. Digital wallets have made online shopping faster and more seamless, but that convenience comes with a growing security risk. The centralized payment layers that simplify transactions have also created new vulnerabilities, especially when cards are reissued.
One of the biggest challenges to securing digital wallets comes from an increasingly sophisticated tool used by bad actors: infostealers. Once installed on a device, this type of malware can secretly collect sensitive information, including passwords, browser cookies, payment details, and wallet data, before transmitting it to cybercriminals.
As Tracy Goldberg, Director of Cybersecurity at Javelin Strategy & Research, examined in the Card Account Updaters and Digital Wallets: The Hidden Cyber Advantage for Crime report, the combination of infostealers and emerging encryption-cracking technologies has created a formidable threat to digital wallets.
This growing risk is pushing financial institutions to find new ways to protect consumers in the digital world—and could ultimately prompt a departure from some longstanding cybersecurity practices.
Compromised Via Update
Beyond digital wallets, conventional login procedure have become another security pain point. One challenge is the continued reliance on usernames and passwords, as well as password managers that store sensitive user information.
Infostealers can capture this information and, in some cases, take screenshots of users’ browsing activity. The data they collect can include autofill information, such as login credentials, personally identifiable information (PII), and details used by card account updater services.
Account updaters are services that merchants rely on to keep payment credentials current when a card expires or is replaced because of theft or loss. By automatically providing updated card details, these services can reduce false declines and help ensure recurring payments continue without interruption.
But the convenience comes with a security trade-off: compromised credentials and personal information can expose another layer of consumers’ digital payment activity.
“If you have a card that’s saved in that wallet and you have fraudulent transactions on that card, you notify your card issuing bank and they reissue the card,” Goldberg said. “The card typically automatically updates digitally, so you can have the card updated across all of your digital wallets before you get the new card in hand.”
“Even if you have a secure login to a digital wallet, if the wallet itself is compromised by an infostealer, when it automatically updates in the digital wallet cybercriminals have access to the digital wallet, and they have access to the new card,” she said.
A Continual Reassessment
The challenge is compounded by consumers’ expanding digital footprint. Many now maintain multiple digital and mobile wallets alongside an increasing number of payment cards, creating more potential points of exposure for infostealers to capture sensitive information. This growing threat is prompting issuers to reconsider how they approach authentication and account security.
“We have to treat the card replacement as just one part of the remediation,” Goldberg said. “Just reissuing the card isn’t going to remove the infostealer, the infection on the device, or repair a wallet that’s been compromised. There has to be a unique way of verifying the authenticity of that transaction every time it’s conducted.”
Addressing the problem will require a multi-faceted approach. One potential strategy is to reduce reliance on autofill by requiring users to authenticate each time they access their wallets.
Some institutions are taking this a step further by incorporating hardware authentication keys. These physical devices provide an additional layer of security, requiring consumers to possess a separate token to access certain banking and wallet services.
Institutions can also improve wallet protections by gradually moving away from password-based authentication and requiring users to reauthenticate at regular intervals.
“You want to continually reassess devices, sessions, and transactions,” Goldberg said. “For the issuing institution, they should be combining device health, malware exposure, the age of the session, behavioral analytics, internet protocols, and intelligence. All those things to determine if a transaction is being conducted from a previously recognized session.”
“A browsing session should be challenged and compared to the device that’s initiating the transaction or the behavioral context around the transaction, so you can verify the authenticity of the user behind the transaction,” she said. “If you have a compromised digital wallet—if it’s being accessed from a different device or a different IP address—that could raise a flag.”
The Challenges to Encryption
The need for continual reassessment is underscored by the rapid pace of technological change. Cybercriminals have advanced infostealer capabilities to the point where many variants can bypass security controls that were once considered effective.
Another significant concern for digital wallet security is the evolving threat to encryption itself. Among the most consequential developments is quantum computing, which harnesses the principles of quantum mechanics to tackle complex computational problems.
Quantum computing holds considerable promise across industries, including cybersecurity. However, its potential also presents a significant risk. Bad actors could eventually exploit its capabilities to undermine widely used encryption standards. This has brought renewed attention to what is known as Quantum Day, or Q-Day—the point at which quantum computers become powerful enough to break widely used public-key cryptographic systems.
The prospect of Q-Day is forcing organizations to reconsider how they protect and store sensitive data. For example, banks must assess how long they retain encrypted customer PII and whether that information could be exposed in the future. They will also need to scrutinize their relationships with vendors and third-party systems to identify potential vulnerabilities.
Ultimately, the priority is to ensure institutions are prepared to withstand a potential breakdown in existing encryption standards and can continue protecting sensitive customer information as the threat landscape evolves.
“We know that Quantum Day will come,” Goldberg said. “There’s no question about that. We are going to get to a point where the existing encryption that we’re using will be broken. I guess you could roll the dice and assume that that could be five years out, but we don’t know when that could happen.”
“It’s not a question of if, it’s just a question of when,” she said. “If you roll the dice and say, ‘Let’s put that down the road and worry about updating encryption later’ and it happens in two years, that you’re going to lose the bet on that one.”
