4 steps to ensure mobile payment security | TechTarget (2024)

How do mobile payments work?

Regardless of the device type, mobile payments work essentially the same for all end users. Consumers add their credit or debit cards to a mobile payment app such as Apple Wallet. The app encrypts the consumer's financial information and replaces it with a token or virtual identifier. Then, the consumer will have a mobile payment option when shopping online or checking out at a store.

In stores, instead of pulling out their credit or debit card to make a purchase, consumers can tap their mobile device to the point of sale (POS) terminal. The payment app on their mobile device then transmits a token via near-field communication or Bluetooth to the store's POS without exposing their actual account details, including their card number. The third-party payment processor serving the store validates the transaction, and funds transfer from the consumer's account to the merchant's account.

Merchants must have the IT infrastructure to accept mobile payments securely. That starts with having mobile payment terminals in their stores. Quite often, this involves upgrading their existing software. The organization must partner with third-party payment processors that support mobile payments, such as Stripe or Google Pay. The payment processor uses encryption to process the transaction securely and deposit funds into the organization's account, typically within a few days.

Security concerns for mobile payments

Mobile payments involve customers' personal and financial data, including bank account numbers, credit card details and identification information. However, mobile payments do reduce some risks at the point of sale compared to traditional payment methods. When a consumer swipes their credit card at a payment terminal, it transmits the actual credit card number to the merchant. This leaves the credit card information open to skimming and data breach attacks. A mobile payment, by contrast, never transmits actual card numbers during a transaction.

The involvement of payment information further complicates issues such as data breaches, malware and unauthorized access due to weak authentication.

Many concerns around mobile payments have to do with end-user cybersecurity hygiene. For example, device loss or theft can open a mobile payment app to compromise if it's not secure. Phishing attacks can also trick consumers into sharing authentication details for their mobile payment accounts. Still, there are some issues that IT must address to ensure the security of mobile payments.

Security risks throughout the transaction

Mobile payments face an array of security threats. A key challenge is that the involvement of payment information further complicates common mobile security issues. These issues include data breaches, malware and unauthorized access due to weak authentication. Man-in-the-middle attacks can co-opt unsecured Wi-Fi networks to intercept the data a consumer's device transmits during a mobile payment. Malware or fraudulent apps can also mimic payment apps to steal data or complete unauthorized transactions.

To deal with these risks, IT teams must focus on encryption, tokenization of payment details and secure coding practices.

Unpatched or out-of-date software

Outdated mobile OSes or payment apps might have vulnerabilities that hackers can exploit. Organizations should have a strategy for regular software updates and patch management to protect against known threats on their internal systems and ensure compliance.

It's also essential to remind customers to update their software. Include this messaging in social campaigns and other customer documentation.

Legal and compliance issues

Supporting mobile payments can have legal consequences, including penalties for failing to comply with data protection regulations. For financial data in particular, organizations must follow the Payment Card Industry Data Security Standard (PCI DSS). SMBs can be especially susceptible to noncompliance penalties, as they often don't have the extensive in-house cybersecurity and legal resources of a large organization.

To meet the requirements of standards such as PCI DSS, GDPR and related laws, advocate for continuous compliance monitoring and legal consultation.

4 steps to ensure mobile payment security

While mobile payment security involves several moving parts, there are some best practices that can mitigate risks across organizations of all sizes. IT should follow a few crucial steps to keep mobile payments secure.

1. Educate staff and customers on mobile payment security

Retail management must understand the risks of mobile payment. For the retailer, this means conducting ongoing risk assessments and security audits. Consumers must understand how the wallet app on their mobile device works as well.

Another key part of this is training staff in mobile payment security. Create a training plan that takes the following considerations into account:

• Security operations center staff or the cybersecurity team will require training in tooling, reporting and other new security processes.
• Frontline retail staff need to understand their organization's security policies to protect customers from fraud and other threats while using wallet apps.
• Consumer outreach should include security tips for using mobile wallets in the organization.

2. Choose a reputable and secure payment processor

Organizations must select a payment processor or payment service provider with strong security protocols in place. Reputable payment processors apply advanced security measures and adhere to policies such as PCI DSS.

It's important to carefully research and set criteria for choosing a provider. Factors to evaluate include certifications and security track records. Working with consulting firms that specialize in payment systems is essential, especially for smaller organizations. They should have the partnerships in place with vendors that the organization doesn't have.

3. Set up and secure a mobile payment system

Implementing a mobile payment system often requires a third-party consultancy, even for medium to large merchants. Strong authentication methods such as two-factor authentication and biometrics come into play during this step.

Organizations must have secure network connections between their storefronts and their payment providers to protect against data breaches and other cyberattacks.

4. Manage and monitor mobile payment transactions

To track, detect and react to potentially fraudulent activity against customers, organizations must implement real-time mobile payment transaction monitoring. This also entails working with mobile payment providers and in-house security teams to put the proper alerts, reports and tooling in place. Then, security and anti-fraud teams can communicate with stakeholders, retail teams and payment providers in real time.

Will Kelly is a freelance writer and content strategist who has written about cloud, DevOps, AI and enterprise mobility.