Trust in the cloud or trust in the phone: What next for mobile payments?
Posted on 06 November 2012.
Thales looks at the approaches for the successful mass adoption of mobile payments among issuers, card schemes, acquirers, merchants and consumers and asks whether the arrival of emerging mobile payment technologies and increasingly secure cloud services will act as a revolutionary or evolutionary force?


The payments industry was defined in an era before the internet, smartphones, the app store and the cloud. As a result any new payments ecosystem built around mobile and cloud connectivity could look very different to the world of payments we are currently familiar with – to both the industry and consumer alike.

To date the most widely discussed and broadly standardized approach to mobile payments has been evolutionary and has focused on effectively turning the phone into a credit card or a wallet full of credit cards. In this model, card issuers, card schemes and acquirers, play a familiar role despite ceding some control and power to new entrants such as Trusted Service Managers (TSMs), Mobile Network Operators (MNOs) and even handset manufacturers.

They collectively depend on the presence of a specialist security chip within the phone – known as the Secure Element – to protect the critical payment keys that enable the consumer to initiate a contactless mobile transaction at a point of sale terminal, just like the embedded chip in an EMV enabled plastic payment card world.

However, players such as PayPal, Google, Apple and a host of innovative start-ups like Square, take a different approach. Their trust lies in the cloud and the phone is simply a means of connecting to that cloud. The argument being that it is much easier to secure a common cloud service than millions of individual phones and much more in intuitive for users to simply log-on to a service – something they do every day.

Ian Hermon, mobile payment security specialist at Thales e-Security says: “As an industry we have been talking about the arrival of mobile payments for almost a decade now. Whilst we have seen big players in the retail market, such as Starbucks, invest in mobile payment platforms we are still a long way off from having one universally accepted model. Whether the industry moves to place its trust in the handset or in the cloud, one thing is for certain, the system as a whole will need to be protected from compromise or misuse.”





Spotlight

Operation Pawn Storm: Varied targets and attack vectors, next-level spear-phishing tactics

Posted on 23 October 2014.  |  Targets of the spear phishing emails included staff at the Ministry of Defense in France, in the Vatican Embassy in Iraq, military officials from a number of countries, and more.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Oct 24th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //