A financial services technology group is developing standards for making secure mobile payment transactions.  The project is an effort of the Financial Services Technology Consortium (FSTC), an industry group comprising banks, technology vendors, researchers and government organizations, which develops technology standards for the financial services sector.   The goal of the project is to develop standards and processes so that banking customers are able to securely pay a merchant or another bank customer using their phone, no matter what mobile device or carrier they use.   The FSTC recently announced the completion of phases one and two of the project, in which goals for improving mobile payment security were established and technologies were identified.  It will now move on to phase three and four, during which standards will be created and roll-out strategies established. 

Mobile payment methods have been widely adopted in Europe and Asia, and soon will become more widespread in North America, allowing consumers to pay businesses or other consumers from their mobile devices.  But mobile security technology is in its infancy, and lags behind the security solutions available for PC platforms.  Most financial services companies still rely on basic multi-factor authentication to validate mobile user access to cash and stock accounts, because it is it involves little in the way of innovation or investment on their part.  Remember…these are the same people who brought us the “great recession”, so their approach should not fill us with confidence. 

At a recent USENIX Security Symposium, the leader of (Google) Android security, Rich Cannings, said that “The smartphone OS will become a major security target.”   Rich is correct:  The number of smartphones is on the rise, and these devices are capable of holding lots of sensitive personal and business data.  It will take a third-party approach by consortiums like the FSTC and innovation from the technology industry to ensure that effective security solutions are available for mobile devices.