How Secure are our NFC-based Mobile Payment Transactions in Retail Stores?
Modern technology makes shopping in retail stores really fast and easy for us. Scanners on Point of Sales (POS) terminals scan the product barcode. The POS software captures and records the items we bought, process our payments, and print out a receipt. With credit cards and smart cards, it only takes a few seconds to validate our payments.
Then here’s the Internet of Things (IoT). According to the technology research firm Gartner, “Internet of Things is the network of physical objects that contain embedded technology to communicate and sense or interact with their internal states or the external environment.”
Our credit card with magnetic stripe or chip, the products with barcode or QR code, and the scanner, software and computer hardware that makes up the POS system, these are all components of the Internet of Things in the retail store that enhance our shopping experience.
Modern POS systems use NFC technology to accept our mobile payments in retail stores. Google Wallet and Apple Pay, for example, use the NFC technology embedded on our smartphones. What validates our payment transaction on POS terminals is the Secure Element (SE) in the NFC chip. When you tap your phone or scan your finger to confirm the payment, the SE in your smartphone communicates with the NFC reader in the POS system to process the transaction.
One of the biggest concerns today in NFC-based payments is security. We’ve seen a lot of credit card data breaches in 2014 and mostly involve big retail stores. But according to NFC chip manufacturers, the structure of the SE is designed to provide strong security functionality.
So, does that mean our mobile payment transactions are safe?
To have a good grasp on the level of security NFC technology delivers in the IoT in the retail sector, let’s figure out the embedded technologies on the devices involve in NFC-based mobile payment transactions. Let’s also find out the security features offered by these devices.
Credit Card
The chip or magnetic stripe in our credit cards is the technology used in authenticating credit card transactions. Behind this technology is the EMV (stands for Europay, MasterCard and Visa) global standard for interoperability of credit cards and POS terminals. According to EMVCo, EMV cards are equipped with an integrated circuit chip and use strong cryptography to create a unique code for each transaction making them more difficult to hack or counterfeit.
Mobile Payment App
There are many mobile payment processors today and each of them almost offers a unique app for paying via smartphone.
Flint Mobile app let merchants scan the credit card number on your card to process the payment transaction.
Go Payment let you connect a credit card reader into your smartphone and then an app to process the transaction.
Apple Pay app uses NFC antenna (embedded on the smartphone) to let you pay on NFC-capable POS terminals. The app that makes this work is the Passbook which stores your credit card information and assigns it to become your default payment card.
Google Wallet works with the so-called Tap and Pay method. With NFC readers in POS terminals and your NFC-enabled Android phone, you can safely pay to hundreds of merchants across the US.
Mobile apps are developed with encryption protocols and data security features.
NFC-enabled devices (Smartphone, NFC reader)
Near-field Communication or NFC is an open-platform technology that supports communications or data exchange between devices, like our smartphones and the NFC readers in POS terminals. We often hear the term contactless NFC or contactless payment. That’s actually what NFC does. Modern smartphones are equipped with NFC chips that transmit radio frequency signal of up to 10 centimeters to communicate with other NFC-enabled devices.
Android and iOS developers apply NFC security protocols on mobile apps of which will run on NFC platforms. Smartphones have tons of built-in security features.
Cloud-computing/Internet Technology
To complete your mobile payment transaction, POS systems further perform series of data communication and exchange processes. With cloud-computing technology, customer’s data (credit card info and payment transaction data) is securely transmitted over the internet and private networks starting from the retail store’s POS terminal to the financial systems of other companies.
Cloud-based POS ensures that your payment to the merchant will be properly settled to all the parties involve. What makes these transactions highly private and secured are the IT infrastructures and server network management systems running behind the POS system, the mobile payment app, and the credit card company.
