Skip to main content

Advertisement

Advertisement

Analysis: WhatsApp's new payment mode could pose higher scam risks than e-wallets

SINGAPORE — The new payment mode unveiled by messaging platform WhatsApp on Tuesday (May 9) could carry a slightly higher risk of exposing users to scams compared to conventional e-wallets, tech experts say. 

A new payment mode was unveiled by messaging platform WhatsApp on May 9, 2023.

A new payment mode was unveiled by messaging platform WhatsApp on May 9, 2023.

Follow TODAY on WhatsApp
  • WhatsApp has unveiled a new payment mode that is integrated into its messaging platform
  • Experts said that the payment mode likely has the same security features as any other electronic payment service
  • However, the integration of the chat and payment features could mean that scammers or impersonators have a more seamless means to trick victims into sending their money into the wrong hands, they said
  • While WhatsApp can take some precautions, it is ultimately up to the user to be more vigilant, the experts said
  • China's WeChat and Japan's Line platforms have integrated payment modes into their messaging platforms for about a decade, with some instances of scams reported

SINGAPORE — A new payment mode unveiled by messaging platform WhatsApp on Tuesday (May 9) could carry a slightly higher risk of exposing users to scams compared to conventional e-wallets, tech experts said. 

The experts said that the WhatsApp payment mode will likely have the same security features as any other electronic payment service.

However, the fact that the payments are being made in tandem with the chat function means that scammers or impersonators have a seamless means to trick victims into sending their money into the wrong hands, the experts added. 

Other messaging platforms such China-based WeChat and Japan's Line have integrated payment options into the platforms for about a decade and have reportedly been subject to various scams.

WhatsApp said on Tuesday that the new feature will be supported by WhatsApp's payments service provider partner, Stripe, and for a start will be for payments only between businesses and customers.

The service was rolled out to a "small number" of Singapore-based businesses on Tuesday and will be available to more in the coming months, the firm added.

This will enable residents here with a WhatsApp phone number registered here to pay these participating businesses using credit cards, debit cards or PayNow.

The experts said that while it is good that WhatsApp is "soft launching" the service by limiting its application to businesses for now, this could also lull users into a false sense of security, as scammers could impersonate businesses, not just individuals.

In response to TODAY's queries regarding these concerns, WhatsApp said on Thursday that there are several safeguards in place to protect users from scams. For one, the payment provider Stripe has the "most stringent level of certification available in the payments industry".

The experts agreed that ultimately, should the right safeguards be put in place, the service could prove to be a much more convenient way for users to transact their money.

Mr Ian Lim, field chief security officer of Japan and Asia-Pacific at cybersecurity firm Palo Alto Networks, said: "The key thing is convenience, in not having to download a whole other app, and being able to converse with people and being able to execute a payment on the back of that conversation." 

WHATSAPP PAYMENT MODE NOT A NEW CONCEPT

The full details of how the WhatsApp payment method works are not yet widely available as it has been rolled out only on a limited basis.

However, experts said that the new payment mode, being under Stripe, will likely operate in a similar manner to e-wallets that are already available.

With e-wallets, users enter their banking details into an e-wallet application or website, and then use their mobile phone to make payments.

The experts said that users of the WhatsApp payment method will likely have to sign up with Stripe first.

This would probably mean that users would have to provide bank account details and proof of identification to demonstrate that they are legitimate before being able to use the payment service.

A WhatsApp spokesperson said that when making a purchase, buyers are directed to a webpage to enter their payment card details.

"This webpage is hosted by a payment partner, who collects the necessary information to process the payment," the spokesperson said.

WhatsApp will also require the legal name and identity of the user to verify their eligibility to use payments on WhatsApp.

The key difference between regular e-wallets and the WhatsApp innovation, however, is that payments over the latter take place over a chat platform although this is not new.

China's WeChat has integrated a payment function into its app since 2013, while Japanese messaging application Line has done so since 2014.

Numerous instances have been reported of scammers attempting to use these systems to defraud consumers of their funds.

In 2019, the South China Morning Post reported that 680 Chinese nationals were arrested in Malaysia over a sophisticated online scam operation targeting WeChat Pay users.

Nikkei Asia also reported in 2019 on a sophisticated scam on WeChat Pay, where scammers collected “traffic fines” from unsuspecting motorists via WeChat Pay QR codes placed on their cars.

The scammer put a photo of a police officer in their WeChat profile, which lulled victims into believing the money was being sent to the authorities.

In May last year, Thailand's Nation newspaper reported that the operator of Line, which operates in the kingdom, had warned users about scammers attempted to obtain personal information from Line chat.

Neither of these payment options are available in Singapore.

POSSIBLE ADDED RISKS OF USING WHATSAPP AS A PAYMENT PLATFORM

Mr Shivaji Das, Asia-Pacific managing director of consultancy firm Frost and Sullivan, said that while WhatsApp's new payment option is no less secure than other e-wallets, the complication comes in integrating a chat application with a payment mode. 

"You are likely using WhatsApp for sharing jokes, pictures, while at the same time (potentially) receiving scam messages, and so the potential risk of individual mistakes increases," he said. 

You are likely using WhatsApp for sharing jokes, pictures, while at the same time (potentially) receiving scam messages, and so the potential risk of individual mistakes increases.
Mr Shivaji Das, Asia-Pacific managing director of consultancy firm Frost and Sullivan

Mr Lim from Palo Alto Networks said that if hackers are able to compromise a user's account, they could potentially "solicit payment" from the user's friends and contacts. 

And even though the WhatsApp payment mode is only between customers and businesses for now, there is the possibility that this might lull users into a false sense of security.

Mr Ali Fazeli, director of security consultancy and advisory at cybersecurity firm Infinity Forensics, said that scammers could possibly "create a fake business account using fake identification to set up the business". 

And even if WhatsApp has the resources to verify the legitimacy of the small number of businesses involved now, it may not be possible to do so when the service goes mainstream. 

"WhatsApp (will likely) not stop only on the business side, they will also want to expand the service to (operate) between consumers," said Mr Ali. "Between consumers there will be (opportunities for) even more scams." 

WhatsApp told TODAY said that the option to enable payments on WhatsApp in Singapore is only available to local businesses using its business platform. 

"There are no further plans on this," the spokesperson added. 

While the platform did not officially respond to a media query on how users will access Stripe through WhatsApp, TODAY understands that only businesses will have to resgister their account with Stripe and there is no need for customers to do so.

Apart from the risk of scams, Mr Lim added that data privacy issues are also a matter of concern, given that WhatsApp is owned by tech giant Meta.

For instance, it is not known if data of the payment transaction details of each user will be shared with Meta, which could then use it to push targeted advertisements based on what users had purchased. 

"Anyone who signs up to this (payment mode) also subjects themselves to the company knowing about their spending habits. With WhatsApp you have messages and spending habits, which could enable them to market to you much better," he said. 

Responding to this concern, WhatsApp said that as the payment is made on a separate webpage, that the information goes "goes directly to the payment partner and is not processed or seen by WhatsApp". 

WHAT CAN BE DONE TO MITIGATE THESE RISKS?

Experts said that there are some simple ways to make the payment mode safer, if indeed they have not already been adopted. However, it is ultimately up to the user to be discerning about where they send their money.

Mr Ali said that two-factor authentication could be used whenever a transaction is about to be made under the payment service.

This means that other than just sending the money with a press of a button, a verification process requiring additional information such as the user's fingerprint or a one-time password on a separate application will be required before the money is sent through. 

"If no one-time password is needed, and the payment can go through immediately, that is a concern," he said. 

In response to TODAY's queries, WhatsApp said that it works with trusted payment partners, such as Stripe, to protect its users.

"Our partners are required to comply with payment card industry data security standards, provide fraud detection, and support industry standard security practices such as encryption and tokenisation to protect card data," the spokesperson said. 

As for the prevention of bogus businesses signing up for the service, Mr Das said that there should be a stringent process of checks. 

"(WhatsApp) can do basic tests, such as check for Acra (Accounting and Corporate Regulatory Authority) registration... the level of investigation and due diligence they can do is straightforward and nothing different from (other e-wallet platforms)," he said. 

WhatsApp added that for businesses that want to sign up, they will need a WhatsApp Business Account, a Stripe account, and provide the business’ Goods and Services Tax (GST) number.

"Our payments partner, Stripe, will also have their own onboarding and regulatory requirements for businesses," the WhatsApp spokesperson said. 

To WhatsApp's credit, it is already limiting the exposure of consumers to scams by limiting the payment mode to businesses for now, said Mr Lim. 

"When the risk is manageable, it is very likely that an expansion (of the service) will happen (such that it is also) between consumers," he added. 

Still, he noted that WeChat and Line's integrated payment modes are still functioning despite the risks. 

"WeChat payments have been in existence for a fairly long time. If it's highly problematic for the company, that functionality would have been shut down early, so what I'm thinking is that the risk is at an acceptable level," he said. 

Ultimately, it is up to the user to be more vigilant in an age where payment and social media applications are becoming more integrated, while scammers are also becoming more sophisticated, the experts said. 

Mr Das said that in the end, should a user unwittingly send their money to the wrong account, the application platform will likely not be liable for any losses. 

"The responsibility on the user is now greater, to make sure that they do their own verification before making any payments," he said. 

Read more of the latest in

Advertisement

Advertisement

Stay in the know. Anytime. Anywhere.

Subscribe to get daily news updates, insights and must reads delivered straight to your inbox.

By clicking subscribe, I agree for my personal data to be used to send me TODAY newsletters, promotional offers and for research and analysis.