Let’s talk about security and fraud in mobile payments

by Cherian Abraham 5 min read October 21, 2012

Cherian Abraham - Experian Global Consulting PracticeI'm here in Vegas at the Mobile2020 conference and I am fascinated by my room key. This is not the usual “insert in to the slot, wait for it turn green or hear it chime” key cards, these are “tap and hold to a door scanner till the door opens” RFID key card. It is befitting the event I am about to attend – Money2020 – the largest of its kind bringing together over 2000 mobile money aficionados, strategists and technologists from world over for a couple of days to talk about how payment modalities are shifting and the impact of these shifts to existing and emerging players. Away from all the excitement of product launches, I hope some will be talking about one of the major barriers for consumer adoption towards alternate payment modalities such as mobile – security and fraud.

I was in Costa Mesa last week and in the process of buying something for my wife with my credit card, triggered the card fraud alert. My card was declined and I had to use a different card to complete my transaction. As I was walking out, my smartphone registers a text alert from the card issuer – asking me to confirm that it was actually I who attempted the transaction. And If so, Respond by texting 1 – if Yes Or 2 – if No. All good and proper up till this point. If someone had stolen my card or my identity, this would have been enough to stop fraud from re-occurring. In this scenario the payment instrument and the communication device were separate – my plastic credit card and my Verizon smartphone. In the next couple of years, these two will converge, as my payment instrument and my smartphone will become one. At that point, will the card issuer continue to send me text alerts asking for confirmation? If instead of my wallet, my phone was stolen – what good will a text alert to that phone be of any use to prevent the re-occurrence of fraud? Further if one card was shut down, the thief could move to other cards with in the wallet – if, just as today, there are no frameworks for fraud warnings to permeate across other cards with in the wallet. Further, fraud liability is about to shift to the merchant with the 2013 EMV Mandate.

In the recent years, there has been significant innovation in payments – to the extent that we have a number of OTT (Over the Top) players, unencumbered by regulation, who has been able to sidestep existing players – issuers and card networks, in positioning mobile as the next stage in the evolution of payments. Google, PayPal, Square, Isis (a Carrier consortium formed by Verizon, T-Mobile and AT&T), and a number of others have competing solutions vying for customer mind share in this emerging space. But when it comes to security, they all revert to a 4 digit PIN – what I call as the proverbial fig leaf in security. Here we have a device that offers a real-time context – whether it be temporal, social or geo-spatial – all inherently valuable in determining customer intent and fraud, and yet we feel its adequate to stay with the PIN, a relic as old as the payment rails these newer solutions are attempting to displace.

Imagine what could have been – in the previous scenario where instead of reaching for my card, I reach for my mobile wallet. Upon launching it, the wallet, leveraging the device context, determines that it is thousands of miles away from the customer’s home and should score the fraud risk and appropriately ask the customer to answer one or more “out-of-wallet” questions that must be correctly answered. If the customer fails, or prefers not to, the wallet can suggest alternate ways to authenticate – including IVR. Based on the likelihood of fraud, the challenge/response scenario could include questions about open trade lines or simply the color of her car. Will the customer appreciate this level of pro-activeness on the issuer’s part to verify the legality of the transaction? Absolutely. Merchants, who so far has been on the sidelines of the mobile payment euphoria, but for whom fraud is a real issue affecting their bottom-line, will also see the value.

The race to mobile payments has been all about quickly shifting spend from plastic to mobile, and incenting that by enabling smartphones to store and deliver loyalty cards and coupons. The focus need to shift, or to include, how smartphones can be leveraged to address and reduce fraud at the point-of-sale – by bringing together context of the device and a real-time channel for multi-factor authentication.

It’s relevant to talk about Google Wallet (in its revised form) and Fraud in this context. Issuers have been up in arms privately and publicly, in how Google displaces the issuer from the transaction by inserting itself in the middle and settles with the merchant prior to firing off an authorization request to the issuer on the merchant’s behalf. Issuers are worried that this could wreak havoc with their inbuilt fraud measures as the authorization request will be masked by Google and could potentially result in issuer failing to catch fraudulent transactions. Google has been assuaging issuer’s fears on this front, but has yet to offer something substantial – as it clearly does not intent to revert to where it was prior – having no visibility in to the payment transaction (read my posthere). This is clearly shaping up to be an interesting showdown – would issuers start declining transactions where Google is the merchant of record? And how much more risk is Google willing to take, to become the entity in the middle?

This content is a re-post from Cherian's personal blog:http://www.droplabs.co/?p=625

Related Posts

Rewriting the Road Ahead with Longer Loan Terms and Increased Refinancing Options

The automotive market is entering a new phase defined not just by what consumers are buying, but by how they’re choosing to finance it. According to Experian Automotive’s State of the Automotive Finance Market Report: Q1 2026, nearly one-third (35.55%) of all new vehicle loans now stretch more than six years, up from 30.83% in Q1 2025. Similarly on the used side, 31.54% of loans extended more than six years, an increase from 28.60% last year. The shift highlights why affordability is reshaping how consumers are financing their vehicles, particularly in larger and higher-priced vehicles. Refinancing gains traction as interest rates stabilize In addition to longer-term loans, consumers are becoming increasingly deliberate with their financing decisions and managing monthly payments as refinancing activity has gained momentum. For instance, consumers who refinanced this quarter lowered their interest rate by 2.2% and saved an average of $81 on their monthly payment. Credit unions, in particular, continued to play a major role in helping consumers secure more affordable payment options. In Q1 2025, credit unions accounted for the lion’s share of automotive refinancing at 63.43%, from 62.31% a year ago. By comparison, banks went from 23.51% to 22.59% year-over-year. Furthermore, those who refinanced with a credit union saved an average of $101 this quarter, whereas those who refinanced with banks saved $60. Expanding credit access through flexible financing Another notable trend this quarter was the incessant growth in subprime financing as credit accessibility across the market continues to increase. In the first quarter of this year, subprime borrowers made up 15.75% of total vehicle financing, from 14.40% last year. For new vehicles in particular, the subprime market went from 5.61% to 6.88% year-over-year, while subprime in used vehicle financing grew to 20.60% this quarter, from 19.36% a year ago. Increased activity in the subprime segment highlights continued confidence in the automotive market and underscores the importance of expanded financing options. As consumers seek greater flexibility with financing decisions that fit their lifestyle, lenders and dealers have the opportunity to approach them with more personalized solutions. These trends are helping keep both new and used vehicle markets moving forward, while creating new opportunities for consumers to manage payments and purchase confidently. To learn more about automotive finance trends, view the full State of the Automotive Finance Market Report: Q1 2026 presentation on demand.

Published: June 2, 2026 by Melinda Zabritski
Staying Competitive After Trigger Leads Evolve: A Roadmap For Lenders

Trigger leads have long been the preferred solution for identifying high-intent mortgage borrowers. But with the implementation of the Homebuyers Privacy Protection Act (HPPA), which introduces new limitations and consumer protections around trigger leads, that playbook will need to shift. Now, lenders are quickly facing a pivotal shift in how they discover, engage, and convert prospective borrowers into customers. The industry now stands at a crossroads. Lenders who adapt early—leaning into predictive tools, consent-based engagement, and smarter prescreening—will redefine borrower acquisition in a more privacy-centric era.  HPPA: A structural change to mortgage marketing  The HPPA amends the Fair Credit Reporting Act by significantly restricting the use of mortgage inquiries for prescreen purposes. As of March 5, 2026, credit bureaus may only provide or utilize mortgage inquiries to:  End users with explicit borrower consent  The originator of the consumer’s current mortgage  The servicer of the consumer’s current mortgage  An insured depository institution or credit union where the consumer has an existing account  While these exemptions may provide continuity for banks and credit unions, many mortgage brokers and nonbank lenders will need to overhaul their prescreen practices—or risk being cut off entirely from a previously high-performing acquisition channel.  Why this isn’t just a compliance shift—It’s a strategic recalibration  Mortgage triggers in prescreen allow lenders to react instantly to consumer intent. Lenders rely on a prompt and convincing narrative to entice applicants to switch lenders. Mortgage inquiry triggers are effective and were, therefore, a prospecting strategy for many lenders. Recent legislative changes significantly restrict the availability of these inquiry triggers, and impacted lenders are focusing on a more intentional prospecting strategy to compete.   Without these mortgage triggers in prescreen, lenders need to ask:  Who are we trying to reach?  What early signals can we act on?  How do we earn permission and attention before a mortgage inquiry ever happens?  Transforming the funnel: From reaction to anticipation  The shift in mortgage inquiry-based prescreen isn’t the end of high-intent lead targeting. It’s the beginning of a more strategic and intentional approach—one that leverages earlier indicators of mortgage readiness and focuses on building relationships, not just closing transactions.  Here’s where the momentum is evolving, creating a new and smarter funnel:  Prescreen marketing: Using credit and behavioral attributes to help identify consumers who meet specific lending criteria before they signal active intent.  Predictive modeling: Leveraging propensity scores or custom models to prioritize outreach based on conversion likelihood.  Consent-based engagement: Implementing compliant mechanisms to capture and manage borrower opt-ins at scale.  The power of predictive modeling  According to recent industry interviews, propensity modeling is emerging as one of the most effective replacements for trigger-based prescreen. These models analyze hundreds of credit attributes—such as utilization, account mix, account age, and depth—to help identify consumers statistically more likely to seek a mortgage.  For lenders just beginning to use predictive modeling, off-the-shelf models can be a quick way to identify potential borrowers. For example, when layering propensity scores on top of credit eligibility, which can improve borrower targeting, many lenders see an increase in open mortgage loan rates.  Meanwhile, custom-built models, which analyze a lender’s own campaign performance over time, offer the highest level of precise targeting. These models isolate the attributes most predictive of conversions within a specific product mix—optimizing not just volume, but fit.  Speed without traditional triggers? It’s possible  One of the biggest concerns among lenders is maintaining the speed historically enabled by trigger leads. But that concern may be overblown.  Self-service prescreen platforms now allow marketers to generate qualified lead lists in as little as 24 hours, enabling rapid response during rate drops, competitive shifts, or seasonal demand spikes.   For those new to prescreening, batch campaigns still offer value, especially with analyst support.   Don’t overlook retention  In an era of intense acquisition competition, retention becomes a key differentiator.  Lenders who monitor property status, cash flow, and consumer credit behavior can proactively identify when an existing borrower is likely to list, refinance, or exit. Armed with that intelligence, lenders can re-engage with the borrower at the right moment—sometimes before a competitor is considered or contacted.  This level of behavioral intelligence may soon separate proactive lenders from reactive ones.  Actions instead of reactions  The evolution of trigger-based prescreen doesn’t just require new tools; it demands new thinking. Lenders should begin by auditing their current pipelines and determining:  What percentage of our acquisition is dependent on triggers?  What share of our book falls under the HPPA exemptions?  How will we scale compliant opt-in collection?  Are our current prescreen or modeling capabilities future-ready?  Those who answer these questions today—and act on them—won’t just be in compliance with the new laws, they’ll lead in a transformed market. Lenders should also be asking:   Do we have the infrastructure to collect and act on borrower consent?  Are our acquisition teams equipped to run prescreen campaigns — both batch and self-service?  What predictive models are we using (or could we use) to prioritize leads?  Are we proactively monitoring our portfolio to catch retention risks early?  How are we preparing our sales teams for longer, more consultative buying journeys?  Conclusion  The HPPA signals a shift away from relying on passive, inquiry-based prescreen acquisition and the beginning of smarter, more strategic engagement with potential borrowers. Lenders who embrace this transition early will find themselves not just compliant, but competitive—with deeper borrower insights, better conversion rates, and stronger long-term customer relationships.  The market is moving. The only question is: will you lead the change or chase it?  Citation  Experian. (2025, November). Interview: How the Homebuyers Privacy Protection Act is reshaping mortgage marketing—and what lenders should do now [transcript]. Experian Mortgage Insights. Insights based on lender feedback, campaign performance data, and analysis of prescreen marketing strategies and predictive modeling outcomes were gathered from Experian client engagements and internal mortgage analytics between May and October 2025. Homebuyers Privacy Protection Act timeline and legal context referenced from legislation signed September 5, 2025, with implementation beginning March 5, 2026.   

Published: April 22, 2026 by Ivan Ahmed