Researcher: Samsung Pay flaw could let hackers skim payment tokens, make fraudulent payments; Samsung says attack is extremely difficult, deems risk acceptable
Contactless mobile payments come as standard in Samsung's latest Galaxy smartphones, but a hacker has found a way to intercept their signals.
Context & Ripple Effects
Samsung's response fits a decade-long pattern in its mobile-security record: researchers previously claimed a Galaxy S5 fingerprint-cloning flaw and later found design weaknesses in roughly 100 million shipped phones, including the Galaxy S21, that could expose cryptographic keys (since patched). Now the target is the payment layer itself — the token stream behind Samsung Pay's contactless transactions on current Galaxies.
The dispute also previews a script the industry would repeat: when researchers later showed an Apple Pay flaw letting a locked iPhone make a Visa payment in Express Transit mode, Apple deflected to Visa rather than own the fix. Samsung's 'extremely difficult, risk acceptable' framing is the same vendor posture, five years early.
First-order effects
- Samsung Pay users on current Galaxy phones carry a documented path — however impractical to execute — by which skimmed payment tokens could be turned into fraudulent payments, with no announced remediation since Samsung judges the risk acceptable.
Second-order effects
- Card networks and issuing banks absorb the residual fraud exposure whenever a vendor declares a flaw tolerable, shifting loss-liability questions toward the tokenization stack rather than the handset maker.
- Rival wallet operators get pulled into the same research spotlight: the later Apple Pay/Visa Express Transit finding shows that once one contactless wallet is shown skimmable, researchers probe the others' relay and transit-mode paths.
Third-order effects
- If 'acceptable risk' becomes the standard vendor answer to wallet research, mobile wallets harden into a permission layer whose security guarantees are set unilaterally by platform makers, with researchers and card networks as the only external checks — a structural tension that recurs across every subsequent wallet finding.
The trend: Contactless wallets are becoming the default payment rail faster than vendors will treat researcher-found flaws as mandatory fixes, leaving token-skimming risk priced by banks and networks instead.