None of mobile payment apps in India fully secure: Qualcomm
None of the mobile payment apps or digital wallets in the country are fully secure, mobile technologies leader Qualcomm has claimed. These apps actually run completely in Android mode and do not have hardware level security, which in turn can be used to compromise users' password or fingerprint, said Qualcomm.
While government is pushing for digital payments through mobile phones, chipset maker Qualcomm said that wallets and mobile banking applications in India are not using hardware level security which can make online transactions more secure. "You will be surprised because most of the banking or wallet apps around the world don't use hardware security. They actually run completely in Android mode and users password can be stolen. Users use fingerprint which might be captured ... in India that is the case for most of all digital wallets and mobile banking apps," Qualcomm Senior Director Product Management Sy Choudhury told reporters here. He said that even most famous digital payment application in India is not using hardware level security. "Reason we are saying that none of them is using it because we work with OEMs (original equipment makers)," Choudhury said. As per market research firm Strategy Analytics, Qualcomm leads mobile chipset market globally with 37 per cent share. "Everyone is getting connected, everyone is getting authenticated by device. How do you know that your device is getting ready for demonetisation? When you download a mobile banking app you dont know if it is using hardware security or not," Choudhury said. He said that Qualcomm is now approaching digital payments companies for using secure environment for processing payments on mobile phone. "We are providing secure execution environment in the chipsets. This layer separates transactions on mobile phone from operating system. This checks any malware from effecting transactions," Choudhury said. He said that Qualcomm is also coming up with new feature in its mobile chipsets from 2017 that verify user with payment gateway using unique features like device id, phone manufacturer signature, Android version in the phone, root kit of operating system, location and time, which will be nearly impossible to duplicate. "Device attestation feature will start shipping in 2017. For end users it should be available by end of 2017," Choudhury said. 