Mobile payment systems vulnerable despite rise in use

A survey of 900 cybersecurity experts shows an overwhelming majority (87 per cent) expect an increase in mobile payment data breaches over the next 12 months, yet 42 per cent have used this payment method in 2015.

The 2015 Mobile Payment Security Study from global cybersecurity association ISACA suggests that cybersecurity professionals are willing to balance benefits with perceived security risks of mobile payments.

Only 23 per cent believe that mobile payments are secure in keeping personal information safe.

Nearly half (47 per cent) say mobile payments are not secure.

At 89 per cent, cash was deemed the most secure payment method, but only 9 per cent prefer to use it.

“Mobile payments represent the latest frontier for the choice we make to balance security and privacy risk and convenience,” said John Pironti, risk advisor with ISACA and president of IP Architects. “ISACA members, who are some of the most cyber-aware professionals in the world, are using mobile payments while simultaneously identifying and contemplating their potential security risks. This shows that fear of identity theft or a data breach is not slowing down adoption - and it shouldn’t - as long as risk is properly managed and effective and appropriate security features are in place.”

The global mobile payment transaction market, including Apple Pay, Google Wallet, PayPal and Venmo, will be worth US $2.8 trillion by 2020, according to Future Market Insights.

Survey respondents ranked major vulnerabilities associated with mobile payments:

1. Use of public WiFi (26 per cent)

2. Lost or stolen devices (21 per cent)

3. Phishing/shmishing (phishing attacks via text messages) (18 per cent)

4. Weak passwords (13 per cent)

Consumer Awareness

The most effective way to make mobile payments more secure is using two ways to authenticate their identity (66 per cent), and requiring short-term authentication codes (18 per cent). Less popular was installing phone-based security apps (9 per cent).

“People using mobile payments need to educate themselves so they are making informed choices. You need to know your options, choose an acceptable level of risk, and put a value on your personal information,” said Christos Dimitriadis, Ph.D., international president of ISACA and group director of information security for INTRALOT. “Embrace and educate about new services and technologies.”

Security Governance

In the emerging mobile payment landscape, there is no accepted understanding of who is responsible for keeping mobile payments secure - consumers, payment providers or retailers.

One approach is to use the COBIT governance framework to involve key stakeholders in deciding on an acceptable balance of fraud rate vs. revenue.

ISACA established Cybersecurity Nexus (CSX) to help address the global cyber security skills gap. For information on the CSX 2015 cybersecurity conference and the new CSX Practitioner certification, visit cybersecurity.isaca.org.

CLICK FOR MORE NEWS HEADLINES