Survey of Strong Authentication Approaches for Mobile Proximity and Remote Wallet Applications - Challenges and Evolution

Wallet may be described as container application used for configuring, accessing and analysing data from underlying payment application(s). There are two dominant types of digital wallet applications, proximity wallet and remote wallet. In the payment industry, one often hears about authentication approach for proximity or remote wallets or the underlying payment applications separately, but there is no such approach, as per our knowledge, for combined wallet, the holder application. While Secure Element (SE) controlled by the mobile network operator (i.e., SIM card) may ensure strong authentication, it introduces strong dependencies among business partners in payments and hence is not getting fraction. Embedded SE in the form of trusted execution environment [3, 4, 5] or trusted computing [24] may address this issue in future. But such devices tend to be a bit expensive and are not abundant in the market. Meanwhile, for many years, context based authentication involving device fingerprinting and other contextual information for conditional multi-factor authentication, would prevail and would remain as the most dominant and strong authentication mechanism for mobile devices from various vendors in different capability and price ranges. EMVCo payment token standard published in 2014 tries to address security of wallet based payment in a general way. The authors believe that it is quite likely that EMVCo payment token implementations would evolve in course of time in such a way that token service providers would start insisting on device fingerprinting as strong means of authentication before issuing one-time-use payment token. This paper talks about challenges of existing authentication mechanisms used in payment and wallet applications, and their evolution.

💡 Research Summary

The paper provides a comprehensive survey of authentication mechanisms applicable to mobile digital wallets, focusing on the convergence of proximity (NFC‑based) and remote (online) wallet functionalities into a single holder application. It begins by categorising wallets into two dominant types—proximity wallets that interact with contactless terminals and remote wallets that operate over the internet. While the payment industry traditionally treats authentication for each type separately, the authors argue that a unified wallet requires a consistent, strong authentication framework that can address both use‑cases simultaneously.

Secure Element (SE) Approaches
The authors first examine hardware‑based solutions. SIM‑controlled Secure Elements, managed by mobile network operators, offer the highest level of cryptographic isolation and key protection. However, reliance on the operator creates strong inter‑partner dependencies, complicates onboarding of new payment service providers, and raises costs, making this approach unsuitable for open, multi‑party ecosystems. Embedded SEs realized through Trusted Execution Environments (TEE) or other trusted‑computing technologies provide comparable security without operator control, but their adoption is limited by higher device cost, heterogeneous implementations across OEMs, and relatively low market penetration.

Context‑Based Authentication
Given the limitations of pure hardware solutions, the paper highlights context‑driven methods as the most practical strong‑authentication option across a wide range of devices. Device fingerprinting—collecting immutable or semi‑immutable attributes such as CPU identifiers, OS version, sensor signatures, network characteristics, and installed app hashes—creates a unique digital profile that can be used for pre‑authentication. Because it does not require dedicated secure hardware, fingerprinting can be deployed on low‑cost devices, but it must handle legitimate changes (e.g., OS updates) through adaptive scoring and periodic re‑enrollment. Conditional multi‑factor authentication (MFA) builds on fingerprinting by adding risk‑based factors such as geolocation, behavioural patterns, and biometric checks (fingerprint, facial recognition). The system dynamically escalates the authentication level when anomalies are detected, thereby balancing user experience with security.

EMVCo Token Standard Integration
The 2014 EMVCo payment‑token specification introduced tokenisation as a means to protect PAN data during wallet transactions. The authors note that token service providers (TSPs) are increasingly demanding proof of device authenticity before issuing single‑use or limited‑lifetime tokens. They predict that future TSP policies will embed device‑fingerprint verification as a prerequisite, effectively making context‑based authentication a de‑facto gatekeeper for token issuance. This creates a natural synergy: the token itself secures transaction data, while the device fingerprint secures the token‑request path.

Challenges Identified

1. Lack of Global Standards – No universally accepted protocol exists for device fingerprinting or risk‑based MFA, leading to interoperability gaps among wallet providers, issuers, and token services.
2. Privacy and Regulatory Constraints – Collecting device‑level data raises concerns under GDPR, CCPA, and Korean privacy law. The paper stresses the need for privacy‑preserving designs (e.g., on‑device processing, zero‑knowledge proofs).
3. Performance vs. Security Trade‑offs – Complex fingerprinting algorithms can drain battery and CPU resources on budget devices; lightweight cryptographic primitives and hardware acceleration are required.
4. Supply‑Chain Complexity – SE‑based solutions involve multiple stakeholders (mobile operators, card networks, OEMs), making rapid security patches and firmware updates difficult.

Future Evolution Pathways
The authors propose a hybrid authentication framework that layers hardware‑based SE/TEE security for high‑risk transactions (large‑value payments, merchant‑initiated requests) with lightweight context‑based MFA for routine, low‑value operations. They advocate the use of AI‑driven risk scoring models that ingest real‑time contextual signals, continuously retrain on fraud patterns, and automatically adjust authentication thresholds. Finally, they call for coordinated standardisation efforts involving W3C, FIDO Alliance, and EMVCo to codify device‑fingerprint exchange formats, privacy‑preserving verification protocols, and compliance testing suites.

Conclusion
In the current mobile wallet landscape, context‑based authentication—particularly device fingerprinting combined with conditional MFA—offers the most feasible strong‑authentication method across diverse device classes and price points. Its integration with the EMVCo token ecosystem is likely to become a cornerstone of future wallet security architectures. As TEE and embedded SE technologies mature and become more widely available, a hybrid model that leverages both hardware isolation and adaptive context signals will emerge, delivering robust security without sacrificing user convenience. The paper thus provides both a diagnostic of existing shortcomings and a roadmap for stakeholders to evolve toward a more resilient, interoperable, and privacy‑respectful mobile wallet authentication paradigm.