Human-in-the-Loop for Secure Digital Wallets Transactions
summary
Study of tokenization shows wallets like Google Pay and Apple Pay control authentication and banks accept that delegation, enabling attackers to add stolen cards using weak KBA (billing address, DOB, last four SSN) and SMS OTP workarounds. Analysis across six banks finds locked physical cards still allow wallet purchases and recurring charges, and automatic card replacement pushes tokens into an attacker’s wallet giving indefinite access. Prototype attacks execute end-to-end; fix is to require explicit human verification on add and update.
AI-written summary · about
related talks
19mSamsung Pay: Tokenized Numbers Flaws and Issues
19mThe Mini Wallet as a Building Block of Interoperable Wallet-Based Age Verification
43mThe Backend of Wallets, from Tokenization to Checkout
23mAll Your Payment Tokens Are Mine: Vulnerabilities of Mobile Payment Systems
25mKeynote Reshaping Digital Payment Authentication
23mReduce fraud and improve engagement using Digital Wallets
42mChallenges in User Authentication: Balancing Security & User Experience
15mMy Online Bank Card and Mobile Phone Were Stolen...