Expert: WeChat fingerprint payment risk

Following the use of fingerprint payment in Alipay Wallet and Jingdong Wallet, WeChat officially launched the "fingerprint payment" function on the evening of the 8th, which can achieve "secondary payment", but the cumulative amount of single account days does not exceed 5,000 yuan. At present, the cumulative maximum limit for single-account single payment that Alipay can use for fingerprint payment is 50,000 yuan.

WeChat fingerprint payment temporarily has device limitations. Apple products that can enable fingerprint payment include iPad mini3, iPadair2, iPhone5S, iPhone6, iPhone6 ​​Plus, and iOS8.0 or later systems can support the use; Android system is only supported by Huawei mate7. WeChat's fingerprint payment supports all consumption and transfer scenarios, such as transfer to friends or customers, but the cumulative limit for a single account is 5,000 yuan. If the limit is exceeded, the password can only be used for payment.

The user only needs to find "payment management" in the "wallet" option in the WeChat "I" item, and can open fingerprint payment according to the steps. The user activates the fingerprint payment function, enters the payment process after placing an order, places the finger in the fingerprint identification area of ​​the mobile phone according to the interface prompts, and does not need to enter a password to pay for the payment.

Regarding the reason for pushing fingerprint payment, WeChat stated that the original WeChat payment deduction process was to verify 6-digit payment password payment, which was simple and concise, but there were still cases where the user had forgotten the password. In addition, the 6-digit password was also peeped by people around him. possibility. When the iPhone first supported the fingerprint recognition function, many users used it to unlock the screen instead of the original 4-digit unlock password, which was more secure and convenient. The fingerprint function will become the standard for more and more manufacturers' mainstream models in the future, and WeChat will also have the right time to introduce the fingerprint payment function.

In addition, WeChat payment security is underwritten by China People's Property and Casualty Insurance Co., Ltd. If the user loses money due to the issue of WeChat payment, the claim can be settled in 24 hours.

Expert Says Fingerprint Information Has Risk of Exposure

Li Tiejun, a cheetah mobile security expert, told reporters that Apple had indeed been attacked by hackers when it started to do fingerprint payment. However, it is very difficult to fake other people's fingerprints to pay in different places, because fingerprint verification is only one of the verification methods, and the payment system also verifies other information at the same time. “However, one of the issues that people in the industry are generally worried about is: If the system is eventually conquered, resulting in the leakage of fingerprint information in a large area, the password can be stolen, but it can be changed, but the fingerprint cannot be changed. The risks are also of great concern to the industry, and new types of payments require a balance between safety and convenience."

WeChat emphasizes that the WeChat payment server does not store user's real fingerprint information, so there is no possibility that a large number of users' fingerprints may be leaked due to server attacks. Apple also previously stated that TouchID technology will not leak user fingerprint information, nor will it be uploaded to the iCloud cloud service. The user's fingerprint information is stored in a specific location of the A7 processor and needs to be confirmed. When information is called, even if thieves can get iPhone5S A7 processor, copying or reading the user's fingerprint information is also a difficult task.

For the security issue of fingerprint payment itself, the WeChat team stated that WeChat has a real-time risk control model and judgment mechanism for all transactions. For some suspicious situations, fingerprint payment or password input and SMS verification code may be disabled to circumvent Trading risk.

As far as possible finger injuries, peeling, air humidity and other physical conditions cause fingerprints to be unidentifiable, WeChat users can choose to quickly switch to password payment.