News

The iPhone security scare: Is LoopWallet a solution?

February 26, 2014

For some time, it's been a matter of debate throughout the financial services world whether information stored on a mobile device is truly secure — or can be. A pair of recent developments in the mobile world could add more heat to the discussion.

On Friday, Apple announced a serious security flaw in its iPhone operating system that could potentially allow a hacker to log sensitive financial information — such as bank card numbers, passwords and personal details — as the user enters it into a mobile or tablet device. As described by a New York Times blog:

... Apple has a security hole in both its mobile and desktop operating systems that could let a malicious hacker jump in on what you think is a secure Web transaction if you're on a public Wi-Fi network like those at a coffee shop, airport or some other location. ...

The problem lies in validating the security certificates that are sent back and forth when you’re establishing a secure connection. Thanks to this flaw, your browser can't verify the authenticity of an encryption certificate, meaning someone could easily be pretending to be your bank’s website, your doctor’s office site or a credit card application form.

Apple has since issued updates to fix the problem — not only on mobile devices, but also on the OSX Mavericks desktop operating system, which apparently had the same flaw.

This Apple security scare is extremely worrisome because the company has for years managed to maintain a squeaky clean reputation for OS security. If the iPhone is vulnerable, what isn't?

Loop thinks it has the answer. Last week the Boston-based company announced its LoopWallet app for storing magnetic-stripe cards in encrypted form on a smart phone and then transmitting this information to a standard POS device in a contactless transaction.

The LoopWallet user feeds cards into the device using the Loop Fob, a magnetic reader that plugs into the audio jack. Card data is encrypted and stored on the smartphone. 

At the POS, the user selects the desired payment card and holds the phone (with fob plugged in) next to the card reader. The device sends a signal via magnetic secure transmission technology, which emulates the signal generated when a mag-stripe card is swiped across the read head of a POS terminal.

Loop says its technology is Level One PCI-certified and can generate dynamic card data when a payment is made, preventing the creation of cloned cards.

The Loop Fob contains a microprocessor and magnetic induction loop and can be used without a phone, in which case payment would be made from a pre-designated preferred card. A rubber "bumper" protects the audio jack when the fob is used independently.

Alternatively, IPhone 5 users can choose the Loop phone case with integrated MST technology and phone charging capability. 

The LoopWallet app is free (the fob and case must be purchased) and is currently available for iOS 7. The company plans to release an Android version in April 2014. The app is only available to U.S.-based users.

To see how Loop works, watch the video: