Could a card payment be made through a mobile wallet?¶

Yes. A card can be added to a mobile wallet and used through a phone, watch or other compatible device.

Avoid this assumption: The card number shown on the statement identifies the physical card used at the terminal.

Mobile wallets often use a device-specific payment token instead of the actual card number.

The transaction may therefore appear as a card payment while the physical card was never presented.

Relevant records may include the tokenised card number, device identifier, wallet provider, provisioning date, authentication method, merchant, terminal and transaction reference.

Provisioning records can be important. They may show when the card was added, which device was used, what contact details were involved and what verification occurred.

A wallet payment may be approved using a device PIN, biometric or other device authentication.

Successful device authentication does not automatically identify the person holding the device.

A phone or watch may be shared, stolen, unlocked or remotely compromised.

Ask the issuer or wallet provider to link the token to the underlying card account and provide provisioning and transaction records.

Compare those records with device ownership, account access, location evidence, CCTV and communications.

Do not assume that the cardholder personally added the card to the wallet. An offender may provision the card onto another device if security checks are defeated.

When reporting, distinguish the physical card, underlying card account, wallet token and device used.

Operational takeaway¶

Identify whether the payment used a mobile-wallet token and obtain provisioning and device records before attributing the transaction to the cardholder.