E-payment Digital PaymentsCybersecurity

Consumers in SEA want strong security for e-payments — Kaspersky

Research by cybersecurity solutions firm Kaspersky showed that e-payment adopters in Southeast Asia (SEA) are becoming increasingly aware of the importance of safeguarding their financial data.

Digital payments have seen a rise at the onset of the pandemic as governments imposed lockdowns that left consumers to do their transactions online.

The research titled “Mapping a secure path for the future of digital payments in APAC,” discovered that 67% of users of digital banking and e-wallet apps in SEA prefer the implementation of one-time-passwords (OTPs) through SMS for every transaction. The Majority of the respondents also want to see the implementation of two-factor authentication or 2FA (57%) as well as biometric security features like facial or fingerprint recognition (56%).

Social media users in SEA want to keep financial data offline — Kaspersky
Kaspersky sees more attacks on financial systems, cryptocurrency industry in 2022

The implementation of OTPs is the top priority for consumers in most SEA countries, including Indonesia (67%), Malaysia (66%), the Philippines (75%), Thailand (63%), and Vietnam (74%), except Singapore where two-factor authentication is the most urgent concern (65%).

The study was conducted by research agency YouGov in key territories in the Asia Pacific region, including Australia, China, India, Indonesia, Malaysia, the Philippines, Singapore, South Korea, Thailand, and Vietnam (10 countries). Survey responses were gathered in July 2021 with a total of 1,618 respondents surveyed across the stated countries. The respondents ranged from 18-65 years of age, all of which are working professionals who are digital payment users.

Machine learning

Digital payment customers also welcome the use of machine learning in combatting social engineering attacks. Almost half (40%) noted that companies should start preventing frauds and scams automatically based on spending behavior and/or transfer history.

Over a quarter (28%) also said tokenization, the process of protecting sensitive data by replacing it with an algorithmically generated number called a token, can also augment the security of mobile banking and e-payment applications in the region.

“In a competitive sector, payment companies should be assessed not just on their innovations, but also on their security posture,” said Yeo Siang Tiong, GM for Southeast Asia at Kaspersky. “We can draw from our findings that customers are increasingly becoming aware of the value of technology to protect their finances online. In general, these security features are useful preventive measures that can potentially enhance the cybersecurity standards in the digital payments space. However, these options should not be viewed in an isolated manner, but considered as part of a holistic cybersecurity framework.”

Kaspersky, however, noted that the usage of two-factor authentication, for example, has its limitations, particularly when it comes to SMS-based authentication.

Password-bearing SMS messages can be intercepted by a Trojan lying inside the smartphone, or by a defect in the SS7 protocol used to transmit the messages, making SMS-based 2FA unreliable at times. In such cases, it would be advisable to employ self-contained authenticator apps, with SMS being used only as a last resort to limit a company’s vulnerability to data breaches.

With the complicated nature of securing apps and finances online, it is not surprising that 65% of the respondents said that banks and mobile wallet companies should provide more incentives to maintain the security decorum — such as changing passwords regularly. Another 60% noted that providers should educate users more about the threats online.

E-wallets

When it comes to choosing a mobile e-wallet provider, security remains a priority for digital payment users in SEA.

More than half (58%) said they will use an e-wallet that includes extra security features like fingerprint and 2FA while more than a third (37%) said they will use banking apps or mobile wallets from providers that have not have been engaged in any previous data breach or cybersecurity attack.

A number of respondents also noted that mobile e-wallet has to be independent — can be used directly by a bank or through a third party (42%) or a closed one — linked to specific merchants, where users can only use the funds to make payments for transactions initiated with the specific merchant (35%).

Another set of considerations in choosing a digital wallet company includes apps that should offer promos, cashback, lower transfer fees (49%); provide anonymity — users don’t need to reveal credit card details to too many merchants (35%); be bankless — bank account details not needed (25%), and be locally made (16%).

“To develop a long-term and sustainable growth strategy, digital payment companies need to take into account some of the wants and needs of their users,” Yeo said. “While some of the preventive measures are not entirely new and have been around for some time, it is crucial to consider how security features can be integrated in a manner without compromising the user experience. Our study showed how customers are increasingly holding digital payment providers accountable for the security of their finances online so we suggest companies determine the cybersecurity gaps in each of the stages of their payment process and fit in the right IT measures in a calibrated manner.”

To stay protected from ever-changing fraud and cybercrime techniques, Kaspersky recommends digital payment providers adopt the following measures:

  • Ensuring prompt patching and updating of software to prevent adversaries from penetrating the system.
  • Implementing high-grade encryption for sensitive data and enforcing strong credentials and multi-factor authentication.
  • Using effective endpoint protection with threat detection and response capabilities to block access attempts, and managed protection services for efficient attack investigation and expert response.
  • Educate your customers and employees on possible tricks malefactors may use. To save time and receive quality service, companies should work with globally recognized providers that can ensure an efficient learning process.
  • Conduct annual security audits and penetration tests to find security issues in a company’s network.
  • Install a fraud prevention solution that can be quickly adapted for identifying new attack schemes and methods.
  • For enterprises with mature IT infrastructure, install anti-APT and EDR solutions, enabling capabilities for advanced threat discovery and detection, investigation, and timely remediation of incidents. Provide your SOC team with access to the latest threat intelligence and regularly up-skill them with professional training. All of the above is available within Kaspersky Expert Security framework.