Threats increase as digital wallets gain popularity
The pandemic, along with the personal preferences of users, has contributed to the rapid emergence of digital payment apps and digital wallets, which compete with credit cards and cash as preferred payment options.
The growing popularity of digital wallets like Google Pay, Samsung Pay and Apple Pay makes them a bigger target for malicious actors, according to a report from the specialist in security analysis software Cognyte.
The study, which collected and analyzed conversations of threat actors on digital wallets from 2016 to 2020, found that the number of interactions of threat actors around the topic had nearly doubled from 2017 to 2018.
In 2019, that number increased by 456%, reaching 31,878 interactions and in 2020, it increased another 292%, reaching 96,363 interactions.
Increased popularity and threats
“The popularity of digital wallets and the continued increase in their use make them a popular target for threat actors,” said Gilad Zahavi, senior director of cyber threat intelligence analysis at Cognyte. “As transactions move to the digital wallet, threat actors are also shifting their criminal activities to increase their chances of financial gain. “
Zahavi said that in the first months of 2021, the company observed more than 40,000 discussions of digital wallets on the dark web. Of these, 63% happened on Telegram, 22% on dark web forums, 6% on Reddit, 4% on Discord and the rest were discussed on Twitter, markets and pasta.
“This indicates that as the use of digital wallets continues to grow, the interest of threat actors globally is also increasing,” Zahavi said. “According to our analysis, the presence of methods and tutorials on dark web forums and the growing interest in these discussions represent an evolution of the threat.
For example, Cognyte identified an increase in the willingness of threat actors to break into digital portfolios, from 27 posts in 2018 to 111 in 2019 and 641 in 2020.
Another growing trend the report discovered was the sale of digital wallet vulnerabilities. For example, in a darknet marketplace, an exploit for Apple Pay, Samsung Pay, and Google Pay is offered for sale by a threat actor for $ 104.
Digital wallets are also vulnerable to phishing campaigns, although the study pointed out that there is still not much interaction about these types of dark web phishing campaigns.
“It appears that phishing on digital wallets is less common today than phishing attacks elsewhere,” the report notes. “This could be explained by the increased security on the various digital wallet applications.”
Additionally, the fact that Samsung Pay and Apple Pay are preinstalled on newer compatible devices, and because there is no web platform that can be manipulated, they are less susceptible to phishing attacks by default.
On the other hand, Google Pay, which is used through an app but is also available through a web interface, makes it more vulnerable to phishing and social engineering attempts, the report notes.
Zahavi, however, pointed out that cybercrime related to digital wallets is still in its infancy and expects market attention and technological vulnerabilities to continue to grow.
“Our databases contain 93,363 publications related to digital wallets as of 2020 and we expect this number to grow as the number of users around the world continues to grow,” he said. “Cybercrime related to digital wallets can be expected to become as popular as other financial cybercrimes, with digital wallets becoming a prime target of various threat actors.”
Despite growing awareness and adoption, nearly half of consumers have not heard of or are not interested in these types of contactless payments due to perceptions of value and security, according to a report. 2020 from McKinsey.
In fact, even as adoption increases, the survey found that more consumers are reporting a deterioration in the perception of the security of digital payments over the past year than an improvement.
Most digital payment applications use tokenization, which adds a layer of security; the original number is replaced by a temporary number which is sent to the merchant. Digital wallets also use security protocols such as two-factor authentication and one-time PIN codes.
Social media giant Facebook is also expected soon launch a digital wallet platform called Novi, David Marcus, head of Facebook’s crypto unit, said in an interview this week with The Information.