Card Account Updaters and Digital Wallets: The Hidden Cyber Advantage for Crime

Increasing use of digital wallets has major implications for cyber risk and fraud, as reissued cards automatically update in digital wallets, circumventing antiquated fraud controls. Infostealers are eroding the effectiveness of password-based authentication, conventional multifactor authentication, persistent browser sessions, and software-accessible wallet environments. Session cookie theft can bypass the need to repeat authentication, and card replacement alone may be insufficient when the victim’s device, wallet account, or merchant session remains compromised. Infostealers undermine the identity, device, and session controls surrounding tokenized payments, while quantum computing, accelerated using AI, could threaten the public-key cryptography supporting authentication, digital signatures, key exchanges, and token infrastructures. 

This report examines how cyber-risk mitigation with foresight can thwart existing and emerging risk without compromising the consumer convenience provided by digital wallets. The immediate priority is endpoint and session security; the strategic priority is crypto-agility and migration toward standardized post-quantum cryptography.

Key questions discussed in this Cybersecurity report: 

• Why does replacing a compromised card often fail to eliminate perpetual cyber risk?
• How can digital wallet vulnerabilities preserve cyber-attacker access even after a card is reissued?
• What cybersecurity and digital-compromise remediation measures should financial institutions adopt to detect and prevent ongoing card compromise? 

Companies Mentioned: 

Apple Pay, FIDO Alliance, Google Pay, Google Threat Intelligence, Hudson Rock, Microsoft, MITRE, National Cybersecurity Center of Excellence, NIST, Visa