Security News > 2021 > November > Security researcher: Flaw in Apple Pay, Samsung Pay and Google Pay makes fraud easy for thieves
The balance between hands-free payments and the security standards required to protect those transactions has tipped too far in the wrong direction, according to a security expert.
At a session at Black Hat Europe 2021 this week, Timur Yunusov, a senior security expert at Positive Technologies, explained flaws in contactless payment apps that could lead to fraud using lost or stolen mobile phones.
"To perform the attack, smartphones with Samsung Pay and Apple Pay must be registered in these countries, but the cards can be issued in any other region," Yunusov said.
Apple Pay, Google Pay and Samsung Pay apps are all vulnerable to this threat.
In reality, Apple and Samsung have shifted the liability to Visa and MasterCard, he said, even though the problem is not with products from the payment companies.
"If the payment is for $0.00, the phone is locked, and the MCC code is transport, this is a legitimate transaction when someone pays in the subway. But if the payment is $100, the phone was unlocked, and the MCC is 'supermarkets,' which is suspicious, because it should not be possible for customers to pay in supermarkets without unlocking the phone."
News URL
Related news
- Researchers Highlight Google's Gemini AI Susceptibility to LLM Threats (source)
- U.S. Justice Department Sues Apple Over Monopoly and Messaging Security (source)
- GoFetch security exploit can't be disabled on M1 and M2 Apple chips (source)
- Apple's GoFetch silicon security fail was down to an obsession with speed (source)
- Google Cloud/Cloud Security Alliance Report: IT and Security Pros Are ‘Cautiously Optimistic’ About AI (source)
- Researchers Identify Multiple China Hacker Groups Exploiting Ivanti Security Flaws (source)
- New Google Workspace feature prevents sensitive security changes if two admins don’t approve them (source)
- Google Chrome: Security and UI Tips You Need to Know (source)
- Chinese government website security is often worryingly bad, say Chinese researchers (source)
- Top 5 Global Cyber Security Trends of 2023, According to Google Report (source)