Trust in the cloud or trust in the phone: What next for mobile payments?

Thales looks at the approaches for the successful mass adoption of mobile payments among issuers, card schemes, acquirers, merchants and consumers and asks whether the arrival of emerging mobile payment technologies and increasingly secure cloud services will act as a revolutionary or evolutionary force?

The payments industry was defined in an era before the internet, smartphones, the app store and the cloud. As a result any new payments ecosystem built around mobile and cloud connectivity could look very different to the world of payments we are currently familiar with – to both the industry and consumer alike.

To date the most widely discussed and broadly standardized approach to mobile payments has been evolutionary and has focused on effectively turning the phone into a credit card or a wallet full of credit cards. In this model, card issuers, card schemes and acquirers, play a familiar role despite ceding some control and power to new entrants such as Trusted Service Managers (TSMs), Mobile Network Operators (MNOs) and even handset manufacturers.

They collectively depend on the presence of a specialist security chip within the phone – known as the Secure Element – to protect the critical payment keys that enable the consumer to initiate a contactless mobile transaction at a point of sale terminal, just like the embedded chip in an EMV enabled plastic payment card world.

However, players such as PayPal, Google, Apple and a host of innovative start-ups like Square, take a different approach. Their trust lies in the cloud and the phone is simply a means of connecting to that cloud. The argument being that it is much easier to secure a common cloud service than millions of individual phones and much more in intuitive for users to simply log-on to a service – something they do every day.

Ian Hermon, mobile payment security specialist at Thales e-Security says: “As an industry we have been talking about the arrival of mobile payments for almost a decade now. Whilst we have seen big players in the retail market, such as Starbucks, invest in mobile payment platforms we are still a long way off from having one universally accepted model. Whether the industry moves to place its trust in the handset or in the cloud, one thing is for certain, the system as a whole will need to be protected from compromise or misuse.”