4/11/2012 – Guest post written by Siva G. Narendra
Consumers use payment cards with merchants in the real world and in the virtual world. The real world, of course, existed before payment cards were invented, and so had to fit within the expectation of merchants transacting based on physical proof of the consumer’s money, be it paper or plastic. These ‘what you have’ factors of authentication are carried by the consumer in his or her physical wallet.
“The advantage of a mobile wallet is that your information is securely stored, decentralized inside the smartcard chip, released only by your password and readable only by the bank who issued your account. Such decentralized mobile wallets make even the recent major hack on a third party Visa/Mastercard credit card processor highly unlikely. Centralized cloud-based digital wallets, on the other hand, have serious limitations when it comes to minimizing potential massive loss,” points out Yankee Group’s Holland.
“The advantage of a mobile wallet is that your information is securely stored, decentralized inside the smartcard chip, released only by your password and readable only by the bank who issued your account. Such decentralized mobile wallets make even the recent major hack on a third party Visa/Mastercard credit card processor highly unlikely. Centralized cloud-based digital wallets, on the other hand, have serious limitations when it comes to minimizing potential massive loss,” points out Yankee Group’s Holland.
- A thief will have to steal one Mobile Wallet at a time…vs. a thief can hack the Cloud once to steal millions of “wallets” or accounts (e.g. Zappos).
- When you lose your Mobile Wallet you will likely notice within 15 minutes vs. You may not know that your data was lost from the Cloud until charges show on your bill, in some cases weeks later.
- Smartcard security (the same as DoD uses) in Mobile Wallets vs. “Just trust us” security in the Cloud
In contrast, the virtual world was created after payment cards were in use – it was a clean slate in terms of setting merchant-consumer interaction expectations. The virtual world, by choice, was built to not rely on physical proof. Payment proof relied purely on a ‘what you know’ factor of authentication, such as 16-digit card number or username and password that was mapped to one or more card numbers. This mapping is stored in the cloud and it is referred to as the Digital Wallet.
The challenge with the Digital Wallet is that the cloud creates a high concentration of card numbers, producing a perfect target for thieves. These card numbers can be stolen remotely and cloned instantly – all in a single hacking event. Remote stealing of a high concentration of card numbers from physical wallets in the real world is virtually infeasible.
“Criminals will always choose the weakest link. Many digital wallets are coming to market, some from companies with no experience in physical world payments. A well-placed hack on a weak cloud wallet could reap billions of dollars internationally,” says Nick Holland, senior analyst at Yankee Group.
The payment industry dealt with this dramatic risk difference by making the cloud transaction fee (card not present) more expensive than the card present, real world transaction fee – on average 70% more expensive.
That is why, when I read the recent Forbes.com guest article written by Prashanth Ranganathan titled “Mobile Payments: Life Is More Secure In The Cloud,” I could not help but rearrange the title to more accurately reflect reality. Life Is More Secure In The Cloud should be rearranged as The Cloud Life is More Insecure.
It is worth noting that, as per the U.S. census bureau at the end of 2011, online transactions amounted to less than 5% of total transactions. Mobile phones are always online, and unlike your computer, mobile phones are always on you and therefore used for both online (5%) and real world (95%) transactions. Merchants cannot tolerate an increase in fraud or increase in transaction fees in the real world should cloud-based, card not present transaction be the method of choice for Mobile Wallets.
While Ranganathan took one step forward in articulating well that physical Mobile Wallets are not the same as virtual Digital Wallets, he subsequently took two steps back in explaining how centralized storage of accessible information in the cloud is somehow more secure than distributed storage of information inside a secure mobile device. To quote Ranganathan: “A Mobile Wallet refers to when the actual mobile phone becomes the wallet” and “Digital Wallets exist in the cloud…sensitive financial information is stored in the cloud, not on the actual device.” To add some missing pieces of information – in the case of a Mobile Wallet, financial information is stored inside a smartcard chip, akin to what Department of Defense employees use. So it is as secure as it gets – and each consumer carries their information with them, just like the physical wallet of today. Visa and MasterCard have fostered smartcard chip technology globally and recently have set a timeline for merchant adoption completion by 2015 in the U.S., along with merchant incentives for adoption starting in 2012.
With that as background, let us compare the real security of Digital Wallets versus Mobile Wallets by using the “lost my phone” example of Ranganathan. He explains in the case of a Mobile Wallet, if you lose your phone and the thief makes transactions using your phone it would almost be impossible to tell if it was really you. However he fails to mention that in the case of the Digital Wallet, you really don’t even have to lose your phone and a thief can still steal your information from the Cloud to make transactions. So, it would not only be just as impossible to tell if it is really you, worse, you would not even know (at least for some time) that your information has been compromised.
“Hacking one mobile wallet at a time is not lucrative business for thieves compared to hacking accounts by the thousands, or even millions, in one go as is the case with cloud based digital wallets,” adds Holland.
So, in summary, when one compares the physical and distributed Mobile Wallet with the virtual and centralized Digital Wallet we conclude the following:
Cloud based mobile wallets – secure or insecure – you decide
