Mobile payment in Fintech environment: trends, security challenges, and services

Apple pay

Apple pay is a mobile Fintech payment service that is dependent on both HW maker and OS maker [27]. It only works on Apple devices and iOS manufactured by Apple and like Samsung pay, payment service can be used without unlocking the lock screen and biometric authentication is executed through print recognition. Also by making payments through encrypted one-time token information, information is not exposed externally and by supporting a separate Secure Element (SE) that can independently and securely store sensitive information, security was improved. Also it was made so that Apple pay app does not need to be executed to make payments and by making it accessible on Apple watches as well as iPhones, it has greater convenience. However, unlike Samsung pay, it only supports Near Field Communication (NFC) which means there are few stores that can be used and it lacks compatibility for using in existing payment infrastructure.

Samsung pay

Samsung pay is a HW maker based payment service which can be used in the latest Samsung phones running android OS after S6 series [28]. Samsung pay enable payment through Samsung pay by linking with numerous financial institutions globally and once a payment method is registered, payment can be made without inputting payment information again. Also, unlike other mobile Fintech payment services, without the need for unlocking the lock screen, pay service can be used by executing the Samsung pay app. Through biometric authentication through fingerprint recognition, security was improved and recently they are preparing services through iris recognition. Also, In addition to SE for sensitive payment information, Host Card Emulation (HCE) is utilized which enables accessing payment information with only the software by storing in the cloud, and by using tokenized credit card information tokens, exposure of the payment information to the outside was prevented. Like Apple pay, Samsung pay can conduct off-line payment through NFC and considering most stores currently are Magnetic Secure Transmission (MST) affiliates rather than NFC, it supports payment method through MST to improve convenience and compatibility.

LG pay

LG pay is a HW maker based payment service which can be used in the LG G6 phones running android. LG Pay is able to make payment by connecting to various financial institutions like Samsung pay. Although only available in Korea, few financial institutions are available, they operate in a magnetic way and are available in most stores. Another advantage of LG pay is that it can be used without releasing the lock screen like Apple Pay and Samsung Pay because it is made by the hardware manufacturer. If you swipe your finger up from bottom, you can get a list of available cards right away. Samsung pay has to close all existing browsers and apps to make a payment, but LG pay can use it without having to. Payment authentication can be selected from simple passwords and fingerprints. Whenever a payment was made for secure payment, LG pay generated a new virtual card number to prevent the card number from being leaked. Therefore, we have applied double security system with password and virtual card number for the payment. Since LG pay supports only the payment of magnetic type, the payment range is smaller than that of Samsung Pay, which also supports NFC.

Android pay

Android pay is an OS maker based Fintech payment service [29]. Although a service called Google wallet was first introduced before Android pay, by omitting prepaid rechargeable card function from Google wallet and enabling registering and using cards in the Android pay app, it was newly introduced. Like Apple pay, payments can be made only through NFC and user authentication is done through fingerprint recognition or passwords during payment. Also, like Samsung pay and Apple pay, security was improved through token technology using virtual card numbers through HCC. Also, unlike Samsung pay and Apple pay which works only on Galaxy series, iPhone, and Apple watch, Android pay has high versatility, supporting Android phones that have Android 4.4 KitKat or above. However, the app must be executed when using Android pay which lacks convenience compared to Apple pay.

Alipay

Alipay is a payment platform provider based mobile Fintech payment service that can be used regardless of HW maker or OS maker [30]. It is a payment service introduced by China’s largest E-commerce company Alibaba which can be used regardless of mobile device or OS. Alipay uses a method where a unique barcode or Quick Response (QR) code is created on the smart phone screen when user authenticates, so that when the cashier scans the code, the payment information delivered to the smart phone is approved, and it does not require high-priced smart phones that have fingerprint recognition function for user authentication or NFC for near field communication. Also it has the advantage that the service provider making the payment does not have to install separate hardware other than barcode scanners, such as POS devices. However, because it has the disadvantage that dedicated Alipay app must be installed for the service provider, apart from areas where Alipay is widespread, it has limited use. Alipay uses a method where the user separately opens an Alipay account linked to a bank to recharge cash.

Wechatpay

Wechatpay is the payment function of Wechat messenger which is widely used in China. Because users can transfer or pay currency with Wechat pay QR code, Wechatpay is mainly used as payment method in many offline stores in China as well as online. Wechatpay also has secured service customers through a large number of social media clients called Wechat Messenger, which prevents customers from leaking to the other messengers and attracts new customers. If you register your financial payment card in Wechat, you can easily make payment and remittance without a card.

Starbucks siren order

Starbucks app, like Alipay, is a payment platform provider based mobile Fintech payment service. Starbucks which has branches all over the world enabled payment through points on gift cards rather than actual cash before Fintech started being introduced and currently through siren order in the Starbucks app, provides mobile Fintech payment service to order and pay for Starbucks products. Without the need to order and pay at a Starbucks branch, advance order can be made through the app and online payment is done through Starbucks gift cards or affiliate cards. Although it has limited versatility due to it being limited to payment of Starbucks products, but providing customized ordering service such as personalized menus and history, it can provide Starbucks specialized service.

PayPal here

PayPal here is a mobile POS for merchants making payments rather than users purchasing services [31]. While traditional payment services required payment software and hardware such as POS or barcode readers making a burden for small-scale stores to install and maintain, PayPal here enables users to pay with credit cards or PayPal accounts through linking with financial institutions by attaching a PayPal here reader on normal smart phones. By providing an easy payment service for small stores and areas where traditional payment services such as POS or barcode readers have not been activated, it increased the versatility of payment service.

Stripe

Stripe is a service providing mobile payment module. Rather than using their own financial infrastructure, they provide a platform for pay-as-you-go payments. In addition to its own platform, it is also compatible with third-party platforms such as Facebook, Twitter, and Applepay. Especially, on Facebook and Twitter, you can pay by button only. In addition, it provides a simple interface to developers as well as users, and it is dedicated to security essential to payment.

Mobile payment with VISA

Visa is a credit card that accounts for 60% of international credit accounts worldwide. Although it does not have its own mobile payment platform, it provides payment services in connection with various mobile payment platforms such as Apple Pay, Samsung Pay, and Google Pay. Visa is a financial institution that works with the user’s financial account to process the actual payment process. The mobile payment services mentioned above are used in conjunction with financial systems such as Visa MasterCard, Amex, and others.

CitiPay

Citi bank is a financial institution that can open an account and can manage the customer’s account, and also provides a credit card by itself. Already CitiBank offers a Citi Pay mobile payment service, attracting a large number of customers using mobile apps and credit cards. When you choose the card you want from the Citi Pay app, you will receive a barcode that you can pay and is available at the merchant that Citi Pay is affiliated with. It combines the functions of financial institutions with the mobile IT technology, but it has the disadvantage that only the Citi credit card can be used and payment can be made only at the franchisee.

HW makers

HW makers based payment services are dependent on HW makers and only operate on mobile devices developed by the corresponding HW makers. Generally, it implements a method of securely storing sensitive user financial information within mobile devices in HW module form, and it enables payment by linking traditional financial institution systems with SW such as OS or Apps. Because it is dependent on HW, independently it can improve security through adding biometric authentication technology such as fingerprint recognition or iris recognition that require HW modules and it can also select physical payment methods such as NFC and magnetic secure transmission. Also, unlike other SW based payment services, it enables payment without the need for executing mobile apps or unlocking lock screens.

OS makers

OS makers based payment services are dependent on OS makers and operate only on mobile devices installed with the OS of the corresponding OS makers. Generally, OS based payment services are linked to traditional financial institution systems like HW based payment services and makes payments through mobile Apps independently or dependent on HW. Sensitive user financial information is stored on security HW module of the mobile or is managed through implementing SW based trust zones. Also by linking with biometric authentication modules installed on the mobile device, it can provide additional authentication service. Payment can be made through the Internet or according to mobile device, can be made through NFC, and if it is not linked to HW, the corresponding payment service can be used only if lock screen is unlocked and the dedicated payment App is executed.

Payment platform providers

Payment platform providers based payment services are developed and provided based on their products or services. Unlike HW makers and OS makers based payment services, payment platform providers based payment services cannot directly compose payment service environment on mobile because the mobile devices and OS were not developed by them, but based on established mobile devices and OS environment, under the pretense of satisfying the requirements of each mobile device and OS maker, it can provide payment service. Because it is a payment service independent from OS and mobile devices can provide customized payment services for corresponding payment platform providers and it can provide payment services regardless of mobile device or OS. Also because service payments can be made through cards and points without linking with financial institutions, it independently gives benefit to the users which can make them dependent on the corresponding payment platform provider. However, when providing services linking to financial institutions, it has the limitation that it needs to satisfy security requirements that the financial institution indicates.

Financial institutions

Financial institution payments are payment services provided through actual financial institutions using IT technology or by converging with other payment services. Like payment platform provider based payment services, because it does not develop mobile devices or OSs, it cannot directly configure payment service environment and payment services can be provided only if it satisfies the requirements of mobile device and OS maker. Also because it is dependent on financial institutions, unlike other payment services, payments can be made only through accounts and cards of the corresponding financial institution. However, because it can control its own financial system, it can additionally provide financial services from the traditional financial system as well as payment.

Convenience

Mobile Fintech payment services must be more convenient than traditional payment services [32–34]. For example, an existing payment service tries to provide the convenience to the user, but since the payment platform, User Interface (UI), or additional benefit is dependent on the financial institution, there is a limitation in meeting needs of the users. If the user must go through various procedures through the payment service, it is not appropriate for Fintech mobile payment service. Fintech mobile payment services, unlike traditional payment services, must provide customized payment services based on user’s needs and convenience minimizing conscious billing procedures through convenient payment procedures such as simple password or biometric authentication.

Mobile payment infrastructure

Mobile Fintech payment services must have mobile Fintech payment infrastructure where desired services can be paid through mobile anywhere and anytime [35, 36]. Even if a Fintech mobile payment service has superior convenience or function compared to traditional payment service, if it does not have the infrastructure to use the payment service, the service cannot be used. For example, if certain communication protocols such as NFC must be used or if it can only be used on certain services, the versatility of mobile Fintech payment service becomes very limited. Especially, current mobile Fintech payment services have incomplete infrastructure compared to traditional payment infrastructure and sometimes it lacks availability compared to traditional human systems.

Compatibility

Mobile Fintech payment services must be compatible with traditional payment services and financial environment such as banks and card companies [37–39]. Introduction of mobile Fintech payment service is not a simple replacement but convergence with existing payment service and it must have compatibility to utilize existing payment services and infrastructure. Through this compatibility, without the need for changing existing payment service based systems and infrastructure, both can be used and it can be widely used without resistance from users. Also by minimizing changes in existing payment services, it must minimize the costs to implement the new environment.

Mobility

Mobile Fintech payment services must be supported by the mobility of mobile devices [3, 40, 41]. Due to the nature of mobile devices, they need to be continuously on the move with the user and communicate externally based on wireless networks. Existing payment service was made through a designated reader or external device at a designated place for payment. Mobile Fintech payment services should not require additional devices, apart from external devices that was already used for existing payment services, regardless of where the mobile device is and where the payment is made. Thus, by maximizing utilization of the infrastructure provided by the existing payment system to ensure the mobility of the payment service, the convenience of the user can be maximized.

Security

Because payment services are directly related to the assets of users, security is a requirement in mobile Fintech payment service [42–44]. So that sensitive security information of the user is not exposed to malicious attackers, mobile payment services must be constructed securely in terms of both HW and SW, and even if multiple payments have been made with the same payment service, information about the payment method must not be exposed to unauthorized third parties. Also from information used during the use of mobile Fintech payment service, the user or user information must not be exposed. If secure payment service is not provided, it cannot only cause monetary damages to users but also invade user privacy based on payment information the user used.

Simplicity

Mobile devices are becoming lighter and smaller with the development of IoT technology [45, 46]. This trend will lead to the development of various wearable devices, and many users will wear 3–4 wearable devices in the future. The current mobile payment service is optimized for smartphones, but it should also be able to make payments on wearable devices that do not have a small screen or screen. In addition, since wearable devices are small in size, most of them are poor in computing performance, so it is necessary to develop a light payment system to provide a simple payment service.

In order for mobile payment service to be successful, mobile payment infrastructure, compatibility, mobility, security, and simplicity should be ready as mentioned above. You can still launch mobile payment services, even if you do not meet all of these requirements. But they will not be available to users at the end of the day, because the other competitors will have. In particular, security factors are background areas that users can not see or experience directly, but once a security incident occurs, users will lose trust and will no longer be used even if they meet other conditions.

Mutual authentication

In mobile Fintech payment service, mutual authentication between mobile Fintech payment service providers and existing financial infrastructures must be conducted before conducting payment. The absence of mutual authentication can cause critical financial damage not only to the user and service subject but also the payment financial institution. If a malicious attacker assumes the identity of a mobile user, it can deliver false payment information to the service subject to avoid payment and if it assumes the identity of service subject, payment can be received from the user and not provide the service. Because in mobile Fintech payment service, not only face-to-face but also remote Internet payments can be made, mobile devices must be authenticated as well as the user during authentication. However, if the procedures of mutual authentication become complex due to security, it can rather make mobile Fintech payment services more complex compared to traditional payment services which can greatly reduce convenience. Due to recent developments in IT technology, biometric authentication such as fingerprint or iris recognition is being widely used to conveniently authenticate remote users.

Authorization

Mobile Fintech payment must be accessible only for authorized users and also the information exchanged for the payment must be accessible only to the authorized subjects. Also payment subjects must not be able to see information other than approved information even if it participates in the payment process. For example, users must provide passwords for payment method information to the service provider to proceed with mobile Fintech payment service but sensitive payment information should be accessed and seen only at the financial institution that actually deals with money. If authorization on information is not appropriately given to payment subjects, hackers can easily intercept the payment information of users without mutual authentication and furthermore, they can control the information. In addition, even service subjects can claim excessive fees without the knowledge of users and financial institutions can figure out conception patterns of users without the agreement of users.

Integrity

Mobile Fintech payment services must have integrity. If the payment information or information exchanged by mobile devices to make payments are modified by malicious attackers or external factors, it can have direct damage to financial assets of the users. Also, unlike actual cash or checks, mobile Fintech payment services exchange digital currency which means users cannot immediately be alerted of damages and if integrity is not kept, users can continuously be exposed to repeated damage. Also, to indicate to both the user and payment service that normal payment has been made, it needs to be able to prove the integrity of the payment.

Privacy

If malicious attackers can figure out payment information or patterns of users, on top of financial damage on users and payment subjects, it can greatly invade the privacy of users. Also because mobile Fintech payment goes through payment service of an IT company rather than directly through a financial institution, it has the problem that regardless of the will of the user, payment information can be delivered to all subjects participating in the payment which can harm the privacy of the users. Information used in payment must be delivered encrypted, divided into purpose and sensitivity, and payment subjects must not be able to figure out information excluding the minimum information necessary to proceed with the payment. For example, when a user pays for a service using card information through mobile Fintech payment service, the merchants must not know the card information and the card company must not know the user purchased service history. One-time card information or tokens are being widely used to protect user privacy.

Atomicity

Mobile Fintech payment service must completely conduct a payment or not at all. Due to the development of IT technology, payment methods have been simplified but due to the increase of subjects participating in the process of payment, it has become more complex. During the process of payment, if payment is halted during the process due to external factors or internal error, even if the user attempted payment, determination subject might not properly receive the payment request and the user might not be able to receive service even after processing payment or the service provider might not be able to receive payment even after providing service. Mobile Fintech payment service providers must make it so that payment is made only when the payment process is completely conducted from start to finish to prevent these types of damages and must indicate to the participating subjects that the payment has been successfully made.

Availability

While mobile Fintech payment service simplifies payment and expands the domain of availability compared to traditional payment services, it must not provide lower security compared to traditional payment services. Also, while maintaining the same level of security as traditional payment services, it must have the availability where payment can be made simply whenever and wherever the user wants. However, because it does not directly go through financial institutions to conduct payment, it is not easy to maintain the same level of security as traditional payment services. Also, if various security procedures are demanded on the user to have high security, it can rather have reduced convenience compared to traditional payment services. Mobile Fintech payment service must have the availability that satisfies both the security requirements of subjects participating in payment and user convenience.

In order for a mobile payment service to be securely provided, it must have mutual authentication, authorization, integrity, privacy, atomicity, and availability as mentioned above. Financial services should be more rigorous than other services because it directly affects property if one vulnerability is found in the service. If you do not meet those requirements, it will cause not only a simple service error but also a catastrophic property damage to the user. While the existing payment services and the mobile payment service security requirements are similar in many respects, mobile payment services run on a variety of devices and operating systems and lack the resources to run security programs. In addition, since it is mobile, it is not fixed in one location, so it is difficult to build a security system than existing payment system. Many companies are constantly releasing mobile payment services, so in order to survive the competition, it is necessary to develop services in consideration of all these aspects.