Digital Wallets Bring New Rules for Consumer Protection

Watch more: Digital Shift With Spreedly’s Jennifer Rosario

Digital assets can reach millions of consumers faster than the security practices surrounding them can mature.

Digital wallets and cryptocurrency products have moved beyond the embrace of technically sophisticated early users. A larger market gives criminals more potential targets, while generative artificial intelligence makes some attacks cheaper and easier to execute without the expertise once required.

“With scale comes more malicious actors,” Spreedly Chief Information Security Officer Jennifer Rosario told PYMNTS in an interview. “And that’s even heightened with AI because at this point, anyone who wants to become a malicious actor has access to it with AI.”

AI can remove clues consumers once relied upon to identify phishing messages and other fraud attempts. Rosario pointed to synthetic identification and deepfake video as additional problems for companies trying to determine whether someone opening an account or establishing a commercial relationship is who they claim to be.

Consumers, meanwhile, bring expectations formed by decades of card use into markets where protections aren’t identical. Credit cards developed their fraud controls through years of attacks, regulation and operating experience. New digital asset products don’t necessarily carry the same requirements or safeguards, Rosario said.

Security architecture is now a product question as well as a technical one. Providers need to decide what they’re protecting, which risks they’ll accept, and which controls deserve priority before an incident makes those decisions for them.

“There is no silver bullet,” Rosario said.

Security priorities should be driven by the company’s environment, industry, geography, data and risk tolerance, with technology considered alongside people and processes, she said.

Onboarding Moves to the Front Line

Synthetic IDs and convincing deepfakes can complicate know your customer (KYC) and merchant verification processes at the point where a provider is deciding whom to admit into its ecosystem.

“Onboarding, in my opinion, is one of the biggest areas of concern just because of the nature that AI is driving a shift in risk there,” Rosario said.

For payments, the security obligation continues after onboarding. Rosario pointed to PCI DSS 4.0 requirements that place attention on how merchants secure payment page integrations and manage threats such as card testing and skimming. That includes knowing which third parties operate on a payment page, evaluating their security programs and maintaining vulnerability management. The complication is that payment companies and merchants can depend on outside providers whose security practices they can’t directly control beyond contractual requirements.

More controls, however, can give rise to more friction. Wallets and other digital financial products compete partly on convenience, leaving providers to decide when an additional authentication or verification step prevents enough risk to justify interrupting checkout. That calculation also makes experimentation necessary. Rosario said Spreedly’s security organization works with product and engineering teams to give them room to test new technology while applying the company’s risk appetite and tolerance to determine where controls belong. The purpose is practical. Engineering teams need firsthand knowledge of AI tools if they’re going to understand how those tools can also be used to automate attacks.

Spreedly is also working toward ISO 42001 certification for AI management systems, Rosario said, using that framework to structure AI-related risk controls. Regulatory and standards work in Europe is useful in establishing requirements before companies are forced to respond to an incident.

“You don’t want to be reactive when building that structure,” Rosario said. “You want have some time to be able to plan and make sure you’re building a sound program.”

Watch the full interview with Spreedly’s Jennifer Rosario to learn more about:

• How companies can determine their risk appetite before choosing security controls.
• Why third-party dependencies complicate responsibility for protecting payment environments.
• How global standards can shape the way security teams govern and test emerging technology.