tap-to-pay Archives

AppWizard

September 18, 2026

That security patch date on your Android phone is no longer the full story

Google has launched the AndroidX Security State and Security State Provider libraries, enhancing Android's security framework. These tools allow applications to assess the security status of individual components on a device, rather than relying solely on the overall security patch level. Applications can now verify specific security fixes, identify available updates, and check for pending installations. This is particularly useful for security-sensitive applications, such as banking software, which can confirm the presence of necessary security fixes before allowing transactions. The libraries also enable apps to check for the resolution of specific vulnerabilities (CVEs), ensuring critical fixes are in place before enabling features like tap-to-pay. Phone manufacturers can communicate specific security fixes without changing the overall security patch date, meaning a device may show an outdated patch date while still having resolved certain vulnerabilities.

AppWizard

September 18, 2026

Android apps can now check security patches down to individual device components

The new AndroidX Security State libraries, with stable releases of Security State v1.1.0 and Security State Provider v1.0.0, allow developers to evaluate the security status of individual device components. They provide three levels of security patch information: Device Security Patch Level (DSPL), Published Security Patch Level (PSPL), and Available Security Patch Level (ASPL). These libraries enable checks on critical components of the Android operating system, including system modules and the Linux kernel, which are represented by version numbers rather than monthly patch dates. Applications that prioritize security can utilize this detailed patch information to assess vulnerabilities, particularly those tracked as Common Vulnerabilities and Exposures (CVEs). The libraries also integrate with the Open Source Vulnerabilities (OSV) database for access to Android Security Bulletin data and device-specific vulnerability reports. Additionally, Android 17 allows manufacturers to declare individual security fixes beyond the stated security patch level, and Google is working with manufacturers to transition their OTA update clients to this new standardized system.

AppWizard

September 8, 2026

Ohio Mobile ID Arrives in Google Wallet, Opening the Program to Android

Ohio residents with Android devices can now integrate their driver's license or state ID into Google Wallet as part of the state's Mobile ID program. This digital credential is a companion to the physical card, and users are encouraged to carry their plastic IDs. To add the credential, users can navigate through the Google Wallet app. The digital ID is accepted for age and identity verification at various businesses, state buildings, TSA checkpoints, and casinos in Ohio. It utilizes specialized readers for presentation and allows users to review shared data. The credentials are encrypted and can be remotely erased if the phone is lost or stolen. Participation in the program is voluntary and free, adhering to privacy and security standards. Governor Mike DeWine highlighted the convenience of this innovation, and vendors are expanding support for mobile driver’s licenses in multiple states.

AppWizard

February 25, 2026

Numo Launches Bitcoin Tap-to-Pay App For Merchants

Numo has introduced a tap-to-pay point-of-sale app that allows merchants to accept Bitcoin payments without additional hardware, utilizing the Cashu open-source ecash protocol. The app is available for free as an open-source Android download, with plans for a Google Play Store release. It uses NFC technology for quick transactions, enabling customers to pay via a Cashu wallet interacting with an NFC tag on the merchant's device. Payments are settled in Cashu ecash, which can be automatically transferred to a merchant's Lightning address once a specified balance is reached. Numo also supports Lightning invoices and offers features like inventory management, payment history tracking, offline payment support, and tipping options. The app has no platform fees and is developed under the MIT license, aiming to simplify Bitcoin payments for merchants. Cashu employs blind signatures for privacy-preserving custodial payments and connects independent mints over the Lightning Network.

AppWizard

November 4, 2025

Hackers Hit Android Users, Drain Bank Accounts Remotely Through 760 Apps: Report

Cybersecurity experts have identified over 760 malicious applications that exploit Near Field Communication (NFC) technology to target Android devices, compromising sensitive user data and financial information. These apps often disguise themselves as legitimate banking and government services, convincing users to set them as default NFC payment methods. Once installed, they can intercept critical information such as login credentials and card details, which is then transmitted to hackers via Telegram channels. The campaign, which began in April 2024, affects users in countries including Russia, Poland, the Czech Republic, Slovakia, and Brazil, impersonating banks like Santander and VTB. Stolen data is sent to over 70 command-and-control servers managed by automated Telegram bots.

AppWizard

November 3, 2025

Android Apps misusing NFC and HCE to steal payment data on the rise

Researchers from Zimperium zLabs have identified over 760 Android applications exploiting Near-Field Communication (NFC) and Host Card Emulation (HCE) technologies to illegally acquire payment data. Since April 2024, there has been a significant increase in NFC relay fraud, affecting banks, payment services, and government portals globally, including Russian banks and various European financial institutions. The malware operates as paired “scanner/tapper” toolchains or standalone data collectors, exfiltrating sensitive EMV data and transmitting it to Telegram channels. Operators control these applications via command-and-control (C2) servers, allowing for fraudulent transactions with minimal user involvement. More than 70 C2 servers and numerous Telegram bots have targeted over 20 institutions worldwide, primarily focusing on Russian banks. The rise of “Tap-to-Pay” transactions has made NFC a target for cybercriminals, with harmful applications exploiting Android’s NFC permissions to steal payment data. Zimperium has provided Indicators of Compromise (IOCs) related to this campaign for safeguarding systems.

AppWizard

October 30, 2025

NFC Relay Attack: 700+ Android Apps Harvest Banking Login Details

Researchers at zLabs have identified over 760 malicious Android applications that exploit Near Field Communication (NFC) technology to steal banking credentials and facilitate fraudulent transactions. This cybercrime campaign has expanded from isolated incidents in April 2024 to a widespread operation targeting financial institutions in countries including Russia, Poland, the Czech Republic, Slovakia, and Brazil. The malware utilizes social engineering tactics by impersonating around 20 legitimate banking institutions and government services, such as VTB Bank, Tinkoff Bank, and the Central Bank of Russia. The malware ecosystem is supported by over 70 command-and-control servers and private Telegram channels for data exfiltration. Attackers deceive victims into granting dangerous NFC permissions, allowing the malware to intercept payment data during contactless transactions. Some campaigns use paired applications for data extraction and fraudulent purchases, while others focus solely on data exfiltration. The malware maintains communication with its command-and-control infrastructure, enabling real-time relay attacks to conduct transactions using victims' payment credentials. The rapid spread of this NFC-based payment malware highlights the adaptability of cybercriminals as contactless payment technologies become more common. Financial institutions are urged to enhance fraud detection systems, mobile device manufacturers should tighten NFC permission controls, and users are advised to be cautious when granting NFC access to applications.

AppWizard

September 29, 2025

What Google Material 3 Expressive redesigns are rolling out [Updated]

In May, Google introduced its new design language, Material 3 Expressive, which is being implemented across various applications following the launch of the Pixel 10 and Android 16 QPR1. Rolling out: - Gmail II: New layout with messages in containers and subtle borders. - Google Chrome: Segmented Material 3 progress indicator, circular containers for actions in the overflow menu, new tab button and switcher in Tab Grid, and thematically colored Tab Group cards. - Google Wallet: App logo change, thicker cards for passes, containers on various pages, enhanced NFC tap-to-pay animation, and new overlay for Pixel users activated by double-tap of the power button. Recent launches: - Google Drive II: Edge-to-edge aesthetic with no main list view container. - Quick Share: Fullscreen experience embracing Material 3 Expressive. - Google Maps: Listings use M3 Expressive containers and actions carousel at the bottom. Fully launched (in alphabetical order): - Digital Wellbeing: Main page refreshed with M3 Expressive elements and thicker donut graphs. - Files by Google: Animated Material 3 carousel on the homepage, pill-shaped toolbar for Quick Share and document scanning, revamped navigation rail, and dedicated toolbar for image editing. - Gmail: Structured layout for email list and messages, swipe gestures trigger pill-shaped animation, redesigned search app bar. - Google Calendar: Time slots in rounded containers, solid background layer for visibility, and FAB menu for creating various items. - Google Meet: Large cards for calls on the homepage, oversized buttons for voice and video calls, and user information in a pill shape. - Google Messages: Organized conversation list and message threads in containers, redesigned 'plus' menu with pill-shaped buttons. These updates aim to provide a more cohesive and visually appealing experience across Google's applications.

AppWizard

July 30, 2025

Crypto payments made easy with Samsung Pay in latest Coinbase app update

Coinbase has integrated with Samsung Pay, allowing select users in the U.S. and Canada to purchase cryptocurrency directly from their Galaxy devices starting in August. This integration includes a "Tap to Transfer" feature for easy fund transfers between devices and supports transactions without requiring a third-party digital wallet. Users can also send money using a debit card with tap-to-pay capabilities or by using the recipient's phone number. Additionally, Samsung is rolling out a feature in its Wallet app that enables users to pay for items in installments if they have an eligible Visa or Mastercard account.

AppWizard

July 30, 2025

Love T-Mobile Money? Too bad, you’ll soon need to use the T-Life app instead

T-Mobile is consolidating its digital services under the T-Life app, retiring the T-Mobile Money app, which will be integrated into T-Life. Key changes include: - Users will access their accounts through T-Life or t-mobilemoney.com. - Starting 12/1/25, users can earn a 4.00% APY on the first ,000 with no monthly direct deposit requirement. - Customers will receive a new debit card and account number, requiring updates to direct deposits and auto-payments. - The "Pay Friends" feature will be temporarily unavailable. - Direct Deposit setup will transition to direct setup through employers. - Users can no longer mail checks for deposit; checks can be deposited via photo in T-Life, and personal checks will be discontinued. - Starting 12/1/25, T-Mobile Money customers can qualify for overdraft protection with 0 or more in payroll-based direct deposits every 31 days. There is speculation about a potential change in T-Mobile's banking partner, currently credited as Coastal Community Bank. The launch date for T-Mobile Money features in T-Life is not yet clear.