7 Security Snafus in Mobile Payments

Published January 17, 2014 3:40 PM

|

Updated October 20, 2016 10:12 AM

1 Min Read

As with any new technology, mobile wallets must earn the trust of the consumers and merchants who would use them. Many mobile payment apps may attempt to beef up security with password and PIN protection, but a few have had their security scrutinized very publicly. (Image: ShutterStock)

A Starbucks Corp. logo sits on a board outside a coffee shop in Berlin, Germany, on Tuesday, May 28, 2013. Starbucks, the world's biggest coffee-shop operator, reported fiscal second-quarter profit in April that met analysts' estimates as U.S. customer traffic improved while sales stagnated in Europe. Photographer: Krisztian Bocsi/Bloomberg

Krisztian Bocsi/Bloomberg

Starbucks (1 of 2)

The Starbucks app this month received a security update after a researcher disclosed that the app stored passwords in plain text instead of encrypting them. This might have made the passwords accessible to a hacker with physical access to the user's phone. (Image: Bloomberg News)

A pedestrian passes a Starbucks Corp., coffee shop in London, U.K., on Thursday, Dec, 1, 2011. Starbucks Corp., the world's largest coffee-shop operator, plans to add 200 more drive-through stores across the U.K. in an expansion that will create 5,000 jobs. Photographer: Chris Ratcliffe/Bloomberg

Chris Ratcliffe/Bloomberg

Starbucks (2 of 2)

The Starbucks app faced another security issue earlier in its life. A user decided to make his account information public so that anyone could load or spend funds, and even created a program to broadcast the account's balance over Twitter. Starbucks was originally supportive, but soon shut down the account out of security concerns. (Image: Bloomberg News)

The Google Inc. Mobile Wallet card for cardless payment sits on display at the Mobile World Congress in Barcelona, Spain, on Wednesday, Feb. 29, 2012. The Mobile World Congress, operated by the GSMA, expects 60,000 visitors and 1400 companies to attend the four-day technology industry event which runs Feb. 27 through March 1. Photographer: Chris Ratcliffe/Bloomberg

Chris Ratcliffe/Bloomberg

Google Wallet (1 of 2)

Shortly after Google introduced its mobile wallet, security researchers discovered that on a "rooted" phone (one that has been modified to run unauthorized software), a hacker could obtain the user's name, credit card balance, limits, expiration dates and transaction history. The full credit card number was still protected. (Image: Bloomberg News)

The Google Inc. Mobile Wallet application for cardless payment is displayed on a smartphone screen at the Mobile World Congress in Barcelona, Spain, on Wednesday, Feb. 29, 2012. The Mobile World Congress, operated by the GSMA, expects 60,000 visitors and 1400 companies to attend the four-day technology industry event which runs Feb. 27 through March 1. Photographer: Chris Ratcliffe/Bloomberg

Chris Ratcliffe/Bloomberg

Google Wallet (2 of 2)

A more straightforward bug in Google Wallet allowed users to bypass the PIN protection on the virtual Google prepaid card by simply resetting the account (deleting the PIN in the process). Google quickly fixed the issue, and it eventually discontinued its virtual prepaid account altogether. (Image: Bloomberg News)

A customer views an Apple Inc. iPhone 5c displayed during the devices launch at the company's store in New York, U.S., on Friday, Sept. 20, 2013. Apple Inc. attracted long lines of shoppers at its retail stores today for the global debut of its latest iPhones, in the company's biggest move this year to stoke new growth. Photographer: Craig Warga/Bloomberg

Craig Warga/Bloomberg

Apple's Password Policy

Apple recently entered a settlement with the Federal Trade Commission over how the iPhone maker handled payments for mobile apps. Apple's earlier policy allowed continued purchases for a period of time after the user typed a password. This led to multiple complaints from parents whose kids were able to spend huge sums of money inside mobile games. (Image: Bloomberg News)

Square as a Skimmer

As the audience grew for Square's mobile card reader, incumbent terminal maker VeriFone went on the attack. VeriFone posted a website claiming that Square's card reader could be repurposed as a card skimmer and used for fraud. Square called those concerns overblown, and it soon started talking openly about its plans to improve security through encryption. (Image: Square)

Bitcoin Wallets on Android

Several Bitcoin wallet apps had to issue updates in August 2013 after discovering an issue in the Android operating system's method for generating random numbers, which are used for cryptography. (Image: ShutterStock)