Cashless Payment with Mobile Wallets: LINDDUN Privacy Threat Model

Cashless payment is becoming increasingly ubiquitous and with this overall trend, also the adoption of non-bank-led payment solutions keeps increasing. In this document, we provide the standalone application description of an abstracted mobile wallet based system, of which the most prevalent examples are Google Wallet or Apple Pay. These payment systems are integrated within the operating systems of mobile platforms, and tightly integrated in their overall ecosystems.
The technology itself relies on hardware capabilities such as Trusted Execution Environments. The abstracted payment system described in this document is based on technical document pertaining the Apple Pay system. We first present the overall case description, consisting of two distinct Data Flow Diagrams (DFDs) and a step-by-step explanation of the main functioning of this system. Then, we present the LINDDUN privacy threat model for this case, which lists and describes the most prevalent privacy threats.