Digital Wallet Security

For those of us who have used Google Pay or Apple Pay, have you ever wondered how your Credit/Debit cards are actually "stored" in a digital wallet? Digital wallets allow cardholders to securely store their payment information to make payments. If you take a Credit Card from Bank A, then Bank A is the Issuer. You add the Credit card to a digital wallet, and now you can perform payment transactions from your digital wallet. Your Card number, aka. Primary Account Number (PAN) is something you should protect at all costs. In many scenarios, your PAN (Card Number) and Card Expiry Date are all that’s needed to initiate a payment request. Storing your card’s PAN in the digital wallet application is risky. If your PAN is exposed to an adversary, deactivating the card and destroying the PAN at the Issuer Bank’s Side is a costly process. So, how is a card saved in the digital wallet? Instead of the actual PAN, your digital wallet gets a TOKEN to store. The TOKEN is made in such a way that it appears as an actual PAN to any Acquiring Bank/Gateway/Switch/Payment Network, and they can treat it like an actual Card Number (PAN). As a digital wallet provider, - You can deactivate the card in the wallet easily by deactivating the TOKEN. - You can limit how many transactions a TOKEN can do. Even if the token is compromised, the damage is short-lived. - You can bind a TOKEN to a single device, so stealing and using it from another device is not possible. - You can provide a token to a trusted merchant and limit the payment amount. So, only a specific merchant can make a payment request on the user's behalf. Henceforth, a digital wallet provider has better control over the digitally created short-lived instance of PAN, which is the TOKEN.

🏦85% of South Africans now have virtual cards. 73% use them regularly, up from 45% just a year ago. Banks have been promoting them heavily as a fraud prevention tool. The rotating CVV in particular has been positioned as a significant security advancement. Here is what the fine print does not say loudly enough. The rotating CVV protects you on new platforms that require you to re-enter your card details every time. It does not protect you on recurring subscriptions, where only the CVV at sign-up is ever stored. A criminal who obtains your full virtual card details can load them onto platforms with recurring payment structures and transact repeatedly until the card is blocked or reaches its limit. The rotation means nothing once the card is registered. Digital wallets compound the picture further. Apple Wallet, Google Wallet, Samsung Wallet. All of them require your CVV only once at setup. Every subsequent in-person tap-to-pay transaction bypasses that verification entirely. The security feature the bank marketed to you stops working the moment you use the product the way it was designed to be used.💡 There is also a Visa-specific vulnerability demonstrated recently by security researchers. A device can trick a digital wallet into treating a transaction as a transit payment, which bypasses biometric authentication entirely. Visa considers the risk low because execution requires local device access, specialised hardware, and a complex sequence of steps. Low risk is not the same as no risk. And in an environment where South Africa recorded nearly 98,000 digital banking fraud incidents in 2024, the definition of low risk deserves scrutiny. None of this means virtual cards are a bad idea. They are structurally superior to physical cards. Physical card details can be skimmed, photographed by a waiter, or stolen alongside the card itself. Virtual cards eliminate most of that surface area. The ability to generate multiple virtual cards for different platforms and cancel only the compromised one when fraud occurs is genuinely useful. The problem is not the technology. The problem is the marketing. Virtual cards have been presented to South African consumers as a fraud solution when they are more accurately described as a fraud reduction tool with specific and significant limitations. A consumer who believes their rotating CVV makes them substantially safer than before may take risks they would not otherwise have taken. That false confidence is itself a vulnerability. This week South Africa is managing active fraud losses approaching R60 million at one institution alone. The Standard Bank system error handed account access to the wrong clients. The OTP defence is being challenged in court. And now the security feature that was supposed to replace the compromised card is itself compromised under specific but not unusual conditions. The tools are improving. The threats are improving faster. #CyberSecurity #ConsumerProtection #FinancialServices

Digital wallets are miles ahead of traditional card payments when it comes to security due to enhanced security features like tokenization, biometric authentication, and encryption - but the way they protect your data is slightly different. Here’s the breakdown: 🍎 Apple Pay:  ↳ Uses device-based tokenisation so your actual card number is never stored or shared ↳ All data is stored locally on the device in the Secure Enclave ↳ Doesn’t track your transactions or link them to your Apple ID ↳ Biometric authentication (Face ID / Touch ID) is required for each payment ✅ Merchants never see your real card details ✅ Apple never knows what you bought or where 🔐 Google Pay: ↳ Also uses tokenisation  ↳ Stores some data in the cloud, and Google may collect transaction info (which can be used to personalise services) ↳ Biometric authentication is still standard, but setup can vary by Android device ↳ Google has broader integrations which can be a convenience win but raises more questions around data use and privacy So which is more secure?  👉 Both are secure, but Apple Pay edges ahead in terms of privacy-first design and keeping your financial data out of the cloud.  👉 Google Pay is still a safe choice, especially if you're in the Android ecosystem, but just be mindful of the data-sharing trade-offs. Which one are you using and was security a consideration when you chose it?

🚨 Ouch. The Bybit security breach is turning out to had been a supply-chain attack, which is *way* worse than initially anticipated. You see, while most crypto hacks exploit phishing or hacked workstations, this attack was executed directly through a supply chain compromise of Safe {Wallet}’s UI infrastructure, enabling attackers to manipulate transactions at the source. ‼️ The attackers breached Safe{Wallet}’s AWS S3 storage and injected malicious JavaScript directly into its UI. This means _every_ Safe user could had been affected. How it happened? Well, the forensic investigations by Sygnia and Verichains show that the attack originated from a hacked developer workstation which then was able to manipulate Safe{Wallet}’s front-end infrastructure, effectively hijacking transaction approvals at the source. This raises a crazy amount of questions around unsupervised production access, change management controls and lack of multiple-eyes approvals. Now, the only reason why only ByBit was affected, is because the hijacked file exclusively targeted ByBit's multisig! In an attempt to be as discrete as possible, rather than phishing multiple contracts, they went for the biggest, likely most active one... There will be more to this, but the immediate recommendations given this information is: ✅ Whenever possible, rely on an on-premise infrastructure able to be both the maker and checker of transactions. Avoid relying in on third-party websites for wallet operations. If it's not in your domain, it's not in your control. ✅ Setup controls to ensure integrity of frontends or interacted interfaces. We have seen this in the past, which is why IPFS's based solutions were popular as unique hashes ensured used UI's could be verified and not updated. This one is a tough one. I'll do a separate post on further information and showcasing the mechanics of the issue. Reports are available to download here - https://lnkd.in/eZyVkpGU

Smart contract exploits are not the only threat. In 2025, people have become one of the weakest links. Why? In the first half of this year alone, phishing and social engineering drained ~$600M across web3. And it’s already more than all of 2024’s full-year totals. Here are more numbers: • $476M were lost in total in Q2 2025. It's up 4x from Q1 of the same year. • $330M Bitcoin were lost after sharing the wallet access. • $100M+ of high-net-worth Coinbase users were also lost after attackers posed as "Coinbase support", quoting real balances to build trust. And that’s just the tip of the iceberg: fake wallet-permission requests, malicious token approvals, and wallet-draining scripts in cloned dApps are everywhere. Why does it matter? Social engineering doesn’t attack code, 𝗶𝘁 𝗮𝘁𝘁𝗮𝗰𝗸𝘀 𝗵𝘂𝗺𝗮𝗻𝘀. And unlike exploits, no patch can fix it after the fact. What you can do to protect yourself: 1) Ignore "exchange support" calls. 2) Avoid links in branded SMS or Telegram messages. 3) Use authenticators/hardware keys instead of SMS 2FA. 4) Inspect email headers before trusting senders. 5) Store large balances in vaults or cold wallets, not in hot wallets. 6) Keep recovery phrases offline. The trend is clear. Smart contracts matter, but protecting people matters even more. At W3A, we see phishing and social engineering climbing toward 20% of all Web3 losses. Do you think human-targeted attacks will overtake technical exploits as the #1 web3 risk by 2026? -- 🌐 Protect your dapps, users & assets → https://Web3Antivirus.io/ Proactively defend every Web3 interaction, meet compliance standards with ease and protect digital assets across your entire stack in real time.