Currently I'm designing a payment app. It has the standard security controls such as HTTPS communication, certificate pinning, no cache, login with 2FA (OTP), 2FA for payment operation.. but I'm not sure how to protect the user against a mobile theft. A thief can reset the password due to the fact that the user usually signed in to the email app, biometric authentication can be easily bypassed due to compatibility and UX requirements, secret questions are usually easy to guess.

Are there any other measures that can be done in order to eliminate damage from mobile theft?

2 Answers 2


Let us review the basic access control corning stones with their pros and cons relating to your case of device theft:

Something you know

Referring to passwords, passphrases, PIN codes, secret questions.


It can be a hard time for the thief to "crack" this factor as is, especially if you enforce a strong policy. You can mitigate the concern of resetting the password through an email using a challenge (e.g strong secret question, perhaps recent activity based) as a must step for the password reset.


Where did you make your recent payment? to whom?


This is considered to be the weakest factor among the others I will mention, and indeed in case of theft, it will be easily changed without the abovementioned mechanism.

Something you have

A physical token that your application can scan using RFID, NFC, etc.


Provides a higher level of security as long as the token is not near the device itself


Pricey, perhaps overkill. User experience might be bad as well.

Something you are

Biometrics; fingerprint, iris scan, voice analysis, behavioral analysis (continuous authentication)


Considered to be the strongest factor, industry standard, most of today's devices have this hardware in place for you to utilize.


Biometric authentication has its errors; false rejection of the user and acceptance error of an unauthorized entity (e.g: printed picture, looked alike person, etc)


you can enforce a strong secret questionnaire upon sensitive operations (transactions, password reset requests, etc), you can add a physical token or verify the client upon sensitive operations based on biometrics


Only if you haven't read this already, I would recommend you take a look at the PCI DSS Mobile Payment Security Guideline standard:


Making your payment app PCI Compliant should be your number one goal in security terms. After that, if you think you can strengthen your app's security, go ahead!

  • Thank you for this comment, but I've already implemented the app in a way it would be compliant with the PCI DDS. Do you have any thoughts on how to strengthen my app's security?
    – user161736
    Aug 3, 2018 at 12:49
  • Actually, what @harelm said sounds very good to me. That's the answer you need :)
    – franpen
    Aug 3, 2018 at 13:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .