Mobile Wallets: Security, Tokens and Liability
A mobile wallet replaces the number with a token and requires authentication: check who is liable in case of fraud.
In this article
Paying with a phone worries mostly those who have never done it, but the mechanics deserve to be known before being judged. The mobile wallet never transmits the card number. It transmits a token tied to the device, unusable anywhere else, which the merchant can neither see nor store. Mobile payment is therefore more discreet than the plastic card itself. Every transaction also requires authentication on the device, by fingerprint or code, whereas a contactless card asks for nothing below a certain amount. Two steps are enough to prepare well. Enable location and remote lock, which let you wipe the wallet from a lost phone through any browser. Also note the issuer's number so you can report quickly. Liability follows the card agreement's rules, with prompt reporting in support. This article explains how tokens work, the complete security setup and the procedure for the day the phone disappears.
Understand the token replacing the number
A mobile wallet does not store your card number and does not transmit it to the merchant. It uses a token, a distinct identifier generated for your device and unusable anywhere else. The merchant receives that token, the payment network translates it, and your real number never circulates. This architecture makes mobile payment more discreet than the physical card, whose number is printed on the plastic and handed to every merchant. A data breach at a merchant that received tokens does not compromise your card: stolen tokens are useless outside the device that generated them.
Require authentication at every payment
Security's second pillar is local authentication: fingerprint, facial recognition or code, required by the device before each transaction. Nothing like it exists on the contactless card, which pays without asking anything below a set amount. A stolen, locked phone therefore pays for nothing, while a stolen card works until it is reported. Check your setup: the automatic screen lock should be quick, the passcode strong and biometric authentication enabled for payments. A device without a passcode cancels most of this protection and turns the mobile wallet into a permanent contactless card.
Prepare remote locking in advance
The function that matters on the day of a loss must be enabled before the loss. Location and remote lock, offered by the major mobile systems, let you lock the device from any browser, display a message on it and wipe the wallet. The setup takes five minutes. Test it once to confirm it works and that you know the credentials you need. Also note the issuer's number somewhere other than on the phone: prompt reporting is a contractual obligation, and looking for the number on the vanished device obviously leads nowhere. These two preparations turn a loss into a minor administrative inconvenience.
Know your recourse for unauthorized transactions
An unauthorized transaction made through a mobile wallet is disputed like any card transaction: the agreement's rules apply, with prompt reporting as the central condition. The token helps the investigation, since each device has its own identifier in the system. This makes it possible to tell a transaction made by your phone from one made with the card number. You can also ask the issuer to deactivate the token without cancelling the physical card, which is useful when only the device is compromised. The usual documentation applies: reporting date, file number, chronology of exchanges. Prompt reporting rarely makes this file necessary, but it protects you on the day it is.
Quebec scenario
His daughter set up mobile payments for him over the holidays. Since then, a retiree in Chambly pays for groceries with his phone, half amazed and half worried. His worry comes down to one question: what if the phone is stolen? The advisor at his caisse shows him what actually travels during a payment. It is never his card number, but a token, an identifier tied to the device and unusable anywhere else. The merchant neither sees nor stores the real number, which makes the mobile wallet more discreet than the plastic card itself. Also, every transaction requires authentication on the device, by fingerprint or code, whereas a contactless card asks for nothing below a certain amount. Two preparation steps remain, done together in ten minutes. The first is to enable location and remote lock, which let him wipe the wallet from a lost phone through any browser. The second is to note the issuer's number so he can report quickly. Liability follows the rules of his card agreement: an unauthorized transaction is disputed the same way, and prompt reporting remains the condition to meet. The following month, his phone, forgotten in a grocery cart, comes back to him at the counter within twenty minutes, locked, with the wallet intact. That demonstration convinced him better than any explanation.
Checklist
- Understand the token replacing the number
- Enable the device's required authentication
- Enable location and remote lock
- Test the remote wipe once
- Note the issuer's number for reporting
- Lock the phone the moment it disappears
- Report any doubtful transaction quickly
- Dispute under the card agreement
- Keep the device's system updated
The questions we get
A question about your situation?
A Quebec broker answers, with no commitment.
Read next
// Credit cards
Recurring Payments After Replacing a Card
List the merchants that charge automatically and confirm each transfer after the card is replaced.
// Credit cards
Points Devaluation: Limit the Risk of Accumulating Rewards
Record the current conversion rule and the notice allowed before changes: long accumulation raises devaluation risk.
// Credit cards
Compare a Credit Card Beyond the Reward Rate
Weigh the reward rate against your spending that actually qualifies, then subtract annual fees, interest and foreign-exchange costs.