Digital Wallets Bring New Rules for Consumer Protection

As digital wallets and cryptocurrency products reach larger markets, security practices must evolve to keep pace. Jennifer Rosario, Chief Information Security Officer at Spreedly, highlights the growing threat from malicious actors enabled by artificial intelligence. AI makes attacks cheaper and easier to execute without the technical expertise required in the past, and advanced technologies like deepfakes and synthetic identification pose new challenges for consumer fraud detection.

Companies must now consider AI's role in their security architecture, deciding what risks to accept and which controls to prioritize. Security priorities should be driven by the company's environment, industry, geography, data, and risk tolerance, with technology considered alongside people and processes. Onboarding processes are particularly vulnerable, as synthetic IDs and convincing deepfakes complicate know your customer (KYC) and merchant verification.

Security obligations continue after onboarding, with PCI DSS 4.0 requirements focusing on securing payment page integrations and managing threats like card testing and skimming. Providers depend on outside vendors whose security practices may not be directly controllable, creating a delicate balance between added security measures and maintaining convenience.

Spreedly works with product and engineering teams to allow testing new technologies while adhering to risk appetite. The company is also pursuing ISO 42001 certification for AI management systems to structure AI-related risk controls. Regulatory frameworks in Europe provide useful guidance in establishing requirements before companies face an incident.