Majority of cybersecurity experts say mobile payments data breaches will grow

Yet, nearly half report using this payment method, reports ISACA. So how can users balance balance security, privacy risk and convenience?

Comments

A survey by ISACA of more than 900 cybersecurity experts shows that an overwhelming majority (87 per cent) expect to see an increase in mobile payment data breaches over the next 12 months.

Yet 42 per cent of respondents have used this payment method in 2015.

The 2015 Mobile Payment Security Study from the global cybersecurity association suggests that people who use mobile payments are unlikely to be deterred by security concerns.

The survey results show cybersecurity professionals are willing to balance benefits with perceived security risks of mobile payments:

Only 23 per cent believe that mobile payments are secure in keeping personal information safe.
Nearly half (47 per cent) say mobile payments are not secure and 30 per cent are unsure.
At 89 per cent, cash was deemed the most secure payment method, but only 9 per cent prefer to use it.

“Mobile payments represent the latest frontier for the ongoing choice we all make to balance security and privacy risk and convenience,” says John Pironti, risk advisor with ISACA and president of IP Architects.

“ISACA members, who are some of the most cyber-aware professionals in the world, are using mobile payments while simultaneously identifying and contemplating their potential security risks. This shows that fear of identity theft or a data breach is not slowing down adoption—and it shouldn’t—as long as risk is properly managed and effective and appropriate security features are in place.”

ISACA says reports show contactless in-store payment will continue to grow, with one report, Future Market Insights, estimating the global mobile payment transaction market, including systems offered by Apple Pay, Google Wallet, PayPal and Venmo, will be worth around US$2.8 trillion by 2020.

The best tactic is awareness. Embrace and educate about new services and technologies.

Christos Dimitriadis, ISACA

The ISACA survey respondents, meanwhile, ranked the major vulnerabilities associated with mobile payments:

1. Use of public wifi (26 per cent)

2. Lost or stolen devices (21 per cent)

3. Phishing/shmishing (phishing attacks via text messages) (18 per cent)

4. Weak passwords (13 per cent)

5. User error (7 per cent)

6. There are no security vulnerabilities (0.3 per cent)

The respondents state the most effective way to make mobile payments more secure is using two ways to authenticate their identity (66 per cent), followed by requiring a short-term authentication code (18 per cent). The least popular option was putting the onus on the consumer— installing phone-based security apps (9 per cent).

“People using mobile payments need to educate themselves so they are making informed choices. You need to know your options, choose an acceptable level of risk, and put a value on your personal information,” says Christos Dimitriadis, international president of ISACA and group director of information security for INTRALOT. “The best tactic is awareness. Embrace and educate about new services and technologies.”

Fear of identity theft or a data breach is not slowing down adoption—and it shouldn’t—as long as risk is properly managed and effective and appropriate security features are in place.

John Pironti, ISACA

Security governance for retailers and payment providers

In the emerging mobile payment landscape, ISACA notes that there is no generally accepted understanding of which entity is responsible for keeping mobile payments secure—the consumer, the payment provider or the retailer.

One approach, it says, is for businesses to use the COBIT governance framework to involve all key stakeholders in deciding on an acceptable balance of fraud rate vs. revenue. Based on that outcome, organisations should set policies and make sure that mobile payment systems adhere to them.

Members of the IT or information security group taking part in the discussion should also ensure they are keeping up to date with the latest cybersecurity developments and credentials.

A joint 2015 ISACA/RSA study shows that nearly 70 per cent of information security/information technology professionals require certification when looking for candidates to fill open security positions.

ISACA, meanwhile, lists more pointers for consumers:

Understand your level of risk: Ask yourself what level of personal information and financial loss is acceptable to balance the convenience of mobile payments.

Know your options: Understand the security options available to manage your risk to an acceptable level. Using a unique passcode should be mandatory, but also look into encryption, temporary codes that expire and using multiple ways to authenticate your identity.

Value your personal information: Be aware of what information you are sharing—like your name, birthday, national identification number, pet name, email, phone number. These pieces of information can be used by hackers to gain access to accounts. Only provide the least amount of information necessary for each transaction.