Anticipating Mobile Phone 'Smart Wallet' Crime: Policing and Corporate Social Responsibility

210

Article

Anticipating Mobile Phone ‘Smart Wallet’Crime: Policing and CorporateSocial Responsibility1

Shaun Whitehead∗ and Graham Farrell∗∗

Abstract Policing continues to struggle with the wave of mobile phone theft that emerged from the mid-1990sonwards. In this decade, the rate of increase may be waning, but the next wave may be approaching. Mobile phone smartwallets combine smart card technology with mobile phones, and the potential for identity theft and financial crime---andhence the attractiveness of theft---is likely to increase with smart wallets. This could spur new forms of theft, violence andother crimes. However, the market testing of technologies in Japan may be inappropriate for crime-proofing purposes,because of Japan’s low crime rate. The criminogenic potential of smart card and mobile smart wallet technologieswarrants further examination. If policing is to avoid a potential crime problem, discussions with manufacturers shouldbegin before the problem takes hold.

CharacterizationThe Gary Larson cartoon mocking scientific ap-proaches to crime and policing would show twoscenes. In the first, a gaggle of white-coated engi-neers celebrate the invention of the knife, one ex-claiming: ‘Cutting edge technology with no risk ofmisuse!’ In the second, a herd of social scientists andpolice cluster around a knife, murmuring: ‘It cor-relates with serious assault, but how does this thingwork?’.

∗Shaun Whitehead, Design Engineer, Midlands Centre for Criminology and Criminal Justice, Loughborough University, UK∗∗Graham Farrell, Director, Midlands Centre for Criminology and Criminal Justice, Loughborough University, UK. E-mail:[email protected]

1 This work was funded by the European Community AGIS Programme under Project JLS/2006/AGIS/094 on ‘E-Crimes: Theftand Misuse of Electronic Services’.

IntroductionTechnology is a key cause of crime, yet its intrica-cies are often not wholly understood by police andgovernment managers or the social scientists whostudy crime. Likewise, crime is rarely considered bydesign engineers or physical scientists who developtechnology. The partitioning of academic disciplinesmay be to blame. As long as the study of crime is un-dertaken largely by social scientists, a blinkered viewof crime, its causes and prevention is to be expected.

Policing, Volume 2, Number 2, pp. 210–217doi: 10.1093/police/pan024C© The Authors 2008. Published by Oxford University Press on behalf of CSF Associates: Publius, Inc. All rights reserved. Forpermissions please e-mail: [email protected]

at University of N

ewcastle on D

ecember 19, 2014

http://policing.oxfordjournals.org/D

ownloaded from

http://policing.oxfordjournals.org/

Anticipating Mobile Phone ‘Smart Wallet’ Crime Article Policing 211

Since technology is universally recognized to playa critical role in generating crime, there is a clearcase for engineers’ and designers’ work to designout crime risks and for policing to promote suchactivity.

Policing the future is a tricky business, and pre-diction is fraught with danger and error. However,encouraging safety and security as default options issurely justified in areas where significant new crim-inal opportunities are likely to occur. The presentstudy is ambitious insofar as it seeks to inform polic-ing about a potential future crime wave. Emergingsmart card and smart phone technology is likely toproduce significant changes in crime relating to mo-bile phones. The potential for the theft of personaland financial information and handsets of highervalue may spur a new wave of mobile phone theft andderivative crimes. Consequently, police and govern-ment should speak to manufacturers during productdevelopment and testing, to anticipate and designout crime: the cost of encouraging routine antici-patory planning against crime as a form of corpo-rate social responsibility is likely to be insignificantwhen compared to the cost of crime that otherwiseresults.

The article gives a brief overview of mobile phonetheft followed by a summary of the technology re-lating to the integration of smart cards and mobilephones. This is followed by an analysis of the po-tentially varied impact upon crime since the newtechnology could not only promote further handsettheft but also promote identity theft and financialfraud. The conclusions suggest next steps in an-ticipatory planning to pre-empt a potential crimewave.

Mobile phone theftTheft and robbery of mobile cell phones generateda mini ‘crime wave’ from the mid-1990s onwards.Once cellular phone technology had evolved to be-come small and practical enough for widespreaduse, the perfect target existed. Phone handsets areused in a way that makes them often publicly vis-

ible and available. They are also small, easily con-cealed, usually valuable and anonymous and eas-ily resold in a burgeoning market. They are theembodiment of Clarke’s hypothesis that some tar-gets are CRAVED, having the characteristics of be-ing Concealable, Removeable, Available, Valuable,Enjoyable and Disposable (where disposable meanseasily resold after theft). Mobiles could present thepossibility for empirical testing and the identifica-tion of the relative importance of these, or other,characteristics.

Mayhew and Harrington (2001) charted the rapidrise of mobile cell phone theft in the UK in the late1990s and estimated there were over 700,000 theftsin the year 2000. By 2007, the Home Office estimatedthat there were over 800,000 victims of mobile phonetheft per year in 2005/2006 in the UK (Hoare, 2007).The rate of increase of theft may have declined by themid-2000s, but all indicators suggest that the theftmarket is likely to remain fairly robust. There aretwo key reasons for this. The first is that many cus-tomers frequently replace their handsets when newand better ones become available with new bells andwhistles—better cameras, MP3-player capabilities,3G-video, TV and better PDA capabilities. The sec-ond is that the hybridization and miniaturization ofthe technological advances help sustain prices andmarkets for new handset models. Anti-theft mea-sures relating to mobile phones have been reviewedelsewhere (Whitehead et al., 2008). In the UK, anindustry-wide agreement to promote the blacklist-ing of stolen mobiles has probably been the most sig-nificant progress that police and government havebeen able to introduce in recent years. However,some stolen mobiles are not blacklisted by networkoperators for various reasons. Many phones are notreported as stolen, and it is cheaper for operators torecord mobiles as lost rather than stolen. Offendersalso sidestep blacklisting by reprogramming phonesto give them new identities (see Kaplankiran et al.,forthcoming) and by shipping them overseas be-cause blacklisting is only country-wide (see Mailleyet al., 2006 for further discussion on prevention andoffender adaptations).

at University of N

ewcastle on D

ecember 19, 2014


ownloaded from


212 Policing Article S. Whitehead and G. Farrell

Mobile phone wallet technologyAfter years of false starts and confusion, in April2007, 14 global network operators announced whatcould be the first practical foundations of the mobilewallet (Roy, 2007). The ‘Pay-Buy Mobile’ paymentstandard, initiated by the GSM Association (GSMA),relates to how mobile phone wallets will communi-cate, and ‘should lead to interoperability betweensuppliers’ equipment and financial companies’.

Mobile phones have significant potential as elec-tronic wallets. They already contain a high securitysmart card, the Universal Integrated Circuit Card(UICC). These smart cards have a far greater poten-tial than has already been realized. This fact, alongwith others things pointed out as below by Vedder(2007), means that the combination of the UICCand handset offer significant potential as a mobilephone wallet application, particularly when coupledwith some form of contactless communication:

� mobile phones are used more often than creditcards

� people are more likely to leave behind theirdoor key than their mobile phone

� the mobile phone is a way of life� today’s phones offer quite a number of services

---both secure and unsecured� by 2006 there will be more than 1.5 billion

active UICCs.

If mobile phone wallet use is about to take off,such handsets will potentially become more valuableand desirable to a thief than the combined value ofa mobile phone and conventional wallet. The aim ofthe project proposed here is to carry out researchto identify potential mobile phone wallet crimesand recommend solutions to them before theydevelop.

A mobile phone wallet is a mobile phone hand-set that incorporates some means of making elec-tronic payment for goods and services. Often thehandsets communicate via a form of contactless or‘proximity’ smart card. These smart cards, as theirname implies, do not need to be in contact with a

reader. They usually only need to be placed withina few centimetres of the reader for communicationto occur. The smart card and reader have internalantennae and wireless circuitry for communication.In the case of the mobile phone, the smart card caneither be a separate add-on to the handset, or be in-tegrated into the handset’s existing ‘smart card’, theUICC card.

UICC CardsThe UICC is the smart card used in mobile phonehandsets in GSM and Universal Mobile Telecommu-nications System (UMTS) networks. Depending onwhether it is deployed in a GSM or UMTS network,the UICC contains a SIM or USIM application re-spectively, but the card is generally referred to as a‘SIM’ card in all applications.

The UICC SIM card is arguably the world’s mostsuccessful smart card application, with over one bil-lion subscribers and more than two billion SIMsdeployed globally (see Vedder, 2007). The UICC hasalso proven to be very secure. Despite some deter-mined attacks, the UICC has essentially remainedsecure over its lifetime. The tough security measuresare no doubt a result of the vested commercial in-terests of the network operators who clearly do notwant UICCs hacked and services stolen. The UICCgenerally contains other applications as well as au-thentication, for example containing a phone bookand other personal information. Current UICCs cantypically hold a few hundred kilobytes of data. Theuse and content of the card can be protected by useof PIN codes, i.e. the card can be locked and un-locked by pressing the correct sequence of keys onthe handset’s keypad.

UICCs and their slots in mobile phone handsetsare standardized, in principle allowing subscribersto switch their network account, text messages andphone book from handset to handset, though of-ten handsets are locked to particular operators andmust be unlocked in order to fit a UICC from analternative operator.

at University of N

ewcastle on D

ecember 19, 2014


ownloaded from



RFID and NFCAs well as the smart card ‘brain’, a mobile wallethandset needs to be able to communicate with otherdevices. This can be achieved through SMS, 3G ‘in-ternet’ or short-range communication. The latter ismost practical for mobile phone wallet applications.Two terms are often used when describing the short-range communication of contactless smart cards; ra-dio frequency identification (RFID) and near fieldcommunication (NFC).

RFID devices communicate with readers overseveral different frequency ranges including13.56 MHz. In RFID, the flow of information is gen-erally one way, with the reader ‘asking’ the RFIDdevice for its information.

NFC is a development of RFID. Communicationis at 13.56 MHz, and is a two-way process, with bothdevices able to read, write and carry out significantprocessing of the data.

The short-range communication in mobile phonewallets is usually via NFC. If mobile phone walletsare to be secure, the method of communication mustoffer protection at a similar level to that provided bythe UICC.

Imminent mobile phone wallet schemes(UK)There are at least two major mobile phone walletschemes that are in the process of being introducedin the UK, Pay-Buy Mobile and PayForIT. Of thetwo, Pay-Buy Mobile is perhaps the closest to anideal mobile phone wallet.

Pay-Buy Mobile (GSMA, 2007)The GSMA’s ‘Pay-Buy Mobile’ initiative seeks to de-fine a common global approach to using NFC tech-nology to link mobile devices with payment andcontactless systems. Together with a UICC card in amobile handset, NFC is used to enable a wide range

2 Manufacturers include KPN, Maxis Communications, mobilikin austria, O2, Orange, AT&T China Mobile, KALL, KTF, MCI,MTN, NTI CoCoMo, Rogers Wireless, Smart Communications, Telenor, TeliaSonera, Telecom Italia, Turkcell, Vimpelcom,Samsung electronics and LG Electronics.

of secure, interoperable and transparent services,such as credit and debit payments.

This is the first concerted effort by the mobilephone industry to adopt a single approach to en-abling the mobile phone to be used, instead of acash or plastic credit card, at points of sale. A largenumber of the world’s leading network operatorsand handset manufacturers are committed to thePay-Buy Mobile initiative.2

First trials of the system will take place in SouthKorea and other countries in Asia and Europe inlate 2007. The Korean trial will be led by KTF andwill include participants from banks and credit cardproviders to retail organizations, handset vendorsand UICC card manufacturers. Should these trialsprove successful, the service will be rapidly deployedglobally.

The Pay-Buy Mobile initiative will build on thework of the major credit card companies, whichhave developed specifications to ensure global in-teroperability between chip cards and point of saleterminals, regardless of the manufacturer, the finan-cial institution and location of the transaction.

PayForITThe PayForIT scheme has been introduced by theUK’s five largest network operators (BBC, 2007). Itis aimed at the low-value, high-volume transactionmarket. Payments for goods and services with a valueof up to £10 can be made via the handset’s internetconnection.

It is anticipated that the facility will be used to payfor ringtones, train tickets, parking fees and even-tually as a payment system on web shops and sites.Any cash spent via the scheme will automatically beadded to a customer’s phone bill.

The scheme standardizes the way phones can beused to make payments, independent of the handsetor network operator. PayForIt has been developed

at University of N

ewcastle on D

ecember 19, 2014


ownloaded from



as an alternative to other systems such as premiumrate SMS. The aim with this standardized facility is tomake customers feel more comfortable with mobiletransactions and payments, so that they can be con-fident about who they are buying from, what they arepaying for and who they should turn to if things gowrong. A number of companies have already signedup to offer payment via the PayForIt system.

Mobile phone wallets (worldwide)In order to assess and pre-empt potential crimeproblems, it is informative to look at how mo-bile phone wallets are currently being used aroundthe world. Japan generally leads the way in mo-bile phone development, application and use and somakes a good case study. In Japan, mobile phonewallets are often referred to by the trade name‘Osaifu-Keitai’ (‘portable wallet’). Mobile-phone-based transactions have also become commonplacein South Korea, where there are more than 12 mil-lion mobile-payment-enabled handsets in circula-tion, with 80,000 terminal payment machines inshops, restaurants and cafes. However, only Japanwill be considered here, as the market leader.

SystemsThe partnership of NTT DoCoMo and Sony hasled the development and introduction of mo-bile phone wallet technology, based around the‘FeliCa’ smart card chip. DoCoMo introduced thefirst phones with built-in mobile payment chipsin 2004, and currently there are around 20 mil-lion DoCoMo handsets with Felica chips---a 38%share of the company’s 52 million wireless sub-scribers. FeliCa-based handsets are now sold by allthe Japanese networks.

Osaifu-Keitai and other phone-based paymentscan be made in

� Convenience stores� Vending machines

3 According to Weber and Wingert (2006), “another important factor underlying Japan’s leadership [in take-up of mobile-basedservices] is a very strong customer service orientation, evidenced by the quality of handsets and services. An objective of thisattitude is to achieve anshinkan, a sense of a state of security or peace of mind in the customer”.

� Train tickets using Mobile Suica� e-money payment system QUICPay� e-money payment system Edy� Mobile credit card iD� Coupon service Toruca.

By 2007 there were 200,000 point-of-sale loca-tions where Osaifu-Keitai payments were accepted.Users must generally ‘charge up’ their accounts withcredit before they can pay using their phones. InJapan, it appears that the handsets have separatecards rather than being fully integrated; the RFIDchip just happens to be ‘stuck’ to the mobile phone;this needs to be formally verified.3

HardwareAn example of the type of handset that could beused as a mobile phone wallet is the Nokia 6131NFC. As the name implies, it is a standard Nokia6131 handset with NFC functionality built in. The6131 NFC has been available since early 2007.

The next crime wave?Potential crimes issues associated with mobile phonewallets include

1. Mobile phones continuing and increasing as adesirable target of theft

If NFC-capable phones are more expensive perunit, then the average unit value of a stolenmobile will increase, stimulating theft.As NFC-capable phones begin to be purchasedin the market, demand for them will increasesignificantly, thus providing a new major de-mand and market for the resale of stolenphones with this capability.

2. Loss of mobile phone=potential loss of ‘identity’and financial information

If stolen phones can be resold not only for thevalue of the phone, but can be exploited for

at University of N

ewcastle on D

ecember 19, 2014


ownloaded from



the financial information they contain, thenthe average value of a stolen phone couldincrease significantly. The precise nature of thisrisk remains to be determined. However, thereis the possibility that a phone could be ‘plun-dered’ for personal and financial informationas well as immediate financial gain, prior to re-sale, if appropriate safeguards are not in place.

3. Other potential fraudulent uses of pay-and-touchtechnologies

The possibilities for the development of fraud-ulent NFCs have not yet, to our knowledge,been fully explored. The manner in which thiscould take place, which could include non-technology-based efforts to dupe mobile own-ers into making payments, remains to be ex-plored. As is well known in relation to breachesof computer security, it is often human errorthat facilitates crime, and social-engineering-based attacks are a significant threat.

The particular manifestations of mobile phonetheft that will occur are not yet clear. It is possiblethat the average net value of a mobile phone theft issignificantly greater due to the potential for theft ofidentity and financial information. If so, then therecould be an increase in severity as well as volumeof phone theft. While robbery currently only consti-tutes a small proportion of mobile phone thefts, thepotential for an increase in robbery is probably thebiggest threat if the potential rewards to the offenceand losses to the victim are significantly increased.

The crime potential will not yet have been realizedbecause mobile payments are not yet widespread.Offenders are not yet, to our knowledge, aware of theoffending opportunities, and have therefore not in-vested in gaining the skills, knowledge and resourcesrequired to exploit these opportunities. However, allour experience in other areas of crime suggests thata small investment in anticipatorily designing outcrime planning at this stage would be a wise invest-ment of time and effort.

4 http://www.textually.org/textually/archives/2005/08/009372.htm.

Concerns about making wireless payments viaNFC and RFID are well documented. On the plusside however, NFC is more secure than RFID becauseit is a two-way system. This means that a handset isable to demand a password or PIN to complete atransaction.

The problem of market testing inJapanMobile technologies appear to be often piloted inJapan. However, it has long been known that whileJapan is one of the most advanced and techno-friendly industrialized countries, it has significantlylower crime rates than most other industrializedcountries. Consequently, mobile technologies are pi-loted under conditions that are, in effect, entirely in-appropriate for testing in relation to the crime riskselsewhere.

Even if the crime market is smaller in Japan, itis likely that there will be signs of the criminal ex-ploitation of the new opportunities. However, sincemanufacturers do not necessarily have a particularvested interest in highlighting crime risks, and couldeven prefer to play down these risks, it is likely thatfurther useful information remains to be gleanedfrom Japan regarding current and future crime risks.

There is some evidence that the Japanese pub-lic is concerned about crime, but not necessarilyhandset theft.4 In a 2005 survey, about two-thirdsof Japanese mobile phone users surveyed said theywere concerned that the number of crimes in whichcell phones are used is increasing. When askedwhat they think is the most troublesome amongproblems related to the use of cell phones, 65%said fraudulent demands for unnecessary fees, and56% said cases involving the abuse of dating ser-vice web sites. However, the increased use of mo-biles for financial transactions may also increasethe potential for fraudulent point-of-sale access,whether based on technology or social engineering

at University of N

ewcastle on D

ecember 19, 2014


ownloaded from



(where social engineering is essentially variousforms of scam and con–trick that induce the user toknowingly or unknowingly part with money or valu-able information).

Advanced handset security in JapanAccording to the producers of fingerprint sensorsat the company Authentec, a major growing mar-ket for their sensors is in wireless handsets. Theyclaim that the market is growing rapidly, with moresensors being shipped in 2006 (ten million) than inthe previous eight years. In the cell phone market,more than seven million cell phones now includeAuthentec sensors:

driven by the fact that in Japan thecell phone is used like a mobile wal-let. Our sensor is used to unlock themobile payment capability and authen-ticate the transaction by holding thephone near the payment (POS) termi-nal. There are hundreds of thousands ofretail locations, vending machines andrestaurants in Japan with these termi-nals, and we believe that m-commercewill be spreading to Europe, the U.S.and the rest of the world. In fact, every-thing we are seeing in the global buildout of the mobile commerce infrastruc-ture is exactly how the rollout occurredin Japan (Ken, 2007).

Rate of growth of Touch-and-Pay in Japan5

In January 2007, infoPLANT published the resultsof research conducted in late 2006 on the topic ofmobile phone electronic wallets. They interviewed1,500 mobile phone users, of which 28.5% hadphones with electronic cash features. Of those, 36%had made use of those features, meaning around10% of the interviewees had already used the elec-tronic wallet facility of a mobile phone. These figures

5 http://whatjapanthinks.com/2007/02/18/mobile-phone-electronic-wallet-hardware-penetration-high-user-penetration-low/#more-586. http://wirelesswatch.jp/2006/09/14/jr-boosts-m-commerce-and-survey-results/.

are likely to increase significantly in the near fu-ture as the technology becomes more widely avail-able and its use becomes increasingly widespreadand normalized. As the legitimate market size in-creases, the risks of offenders seeking to exploit themarket increases significantly. The aim of designingout crime efforts would be to ensure that the tip-ping point is not reached whereby phone theft andfinancial/identity theft bring a new crime wave.

In any case, there are lessons to be learned; if thereare indications of mobile phone wallet theft, thenthis gives a warning of what might happen in theUK and the rest of the world. If there is no problem,then it may be due to the mechanisms mentionedabove, in which case further study will identify whatcan be learned from Japan and other early adoptersof mobile phone wallet technology.

A stitch in time saves crime: nextstepsClearly, this is a preliminary foray into the sub-ject of crime relating to mobile phone wallets. Allavailable indicators suggest that markets for mo-bile phone smart wallets are likely to expand sig-nificantly in the next few years. All available indi-cators and experience from other areas would sug-gest that the expanded legitimate market is likely tobe followed by an increase in the illegitimate mar-ket. Further research is required on the followingareas:

� the specifics of the likely nature of mobilephone wallet schemes in the UK

� the nature of existing crime risks identified inJapan, South Korea and Finland

� the nature of additional potential crime risks(some of which were discussed in brief above)

� the measures that industry are currently takingto explore and anticipate those crime risks

at University of N

ewcastle on D

ecember 19, 2014


ownloaded from



� the potential for stimulating the market to en-courage the industry into designing out crime

� the need and potential for additional securityefforts to be developed.

At the same time, police and government needto approach manufacturers. This should open thedoors for further research, but should also be aimedat encouraging manufacturers to anticipate andavoid potential crimes. Manufacturers do not footthe bill for the emotional and physical injuries in-curred by victims, or the police and criminal justicecosts. Manufacturers can even benefit when theft ofproducts results in further sales for replacements.Policing needs to begin to more formally acknowl-edge that industry’s apathy to crime is often self-interested, and to encourage corporate social re-sponsibility that reduces crime and the drain uponpolicing.

ReferencesBBC. (2007). “Mobiles to become Digital Wallets.” BBC

News online, 3 September 2007, at http://news.bbc.co.uk/1/hi/technology/6764979.stm (accessed September 2007).

GSM Association. (2007). “Momentum builds aroundGSMA’s Pay-Buy Mobile Project.” GSM AssociationPress Releases 2007, at http://www.gsmworld.com/news/press 2007/press07 33.shtml (accessed September 2007).

Hoare, J. (2007). “Mobile Phones: Ownership and Theft.”In Flatley, J. (ed.), Mobile Phone Theft, Plastic Card and

Identity Fraud: Findings from the 2005/6 British CrimeSurvey. Home Office Statistical Bulletin 10/07. London:Home Office.

Kaplankiran, T., Mailley, J., Whitehead, S., and Farrell, G.“Mobile Phone Reprogramming.” Crime Prevention andCommunity Safety: An International Journal (forthcom-ing).

Ken, Y.-N. (2007). “Mobile Phone Electronic WalletHardware Penetration High, User Penetration Low.” WhatJapan Thinks website at: http://whatjapanthinks.com/2007/02/18/mobile-phone-electronic-wallet-hardware-penetration-high-user-penetration-low (accessed Septem-ber 2007).

Mailley, J., Whitehead, S., and Farrell, G. (2006). “Progressand Prospects in the Prevention of Mobile Phone Theft.”Justice of the Peace 170(22): 404–407.

Mayhew, P. and Harrington, V. (2001). Mobile Phone Theft.Home Office Research Study 235. London: Home Office.

Roy, B. (2007). “GSMA Endorses Wireless Mobile Payments.”The Register at http://www.theregister.co.uk/2007/02/15/nfc again/ (accessed September 2007).

Vedder, K. (2007). Intermodal Means of Paymentor The Contactless SIM. Presentation to EuropeanTelecommunications Standards Institute, France, athttp://www.cen.eu/cenorm/news/events/vedder.pdf (ac-cessed September 2007).

Weber, A., and Wingert, B. (2006). “i-mode” in Japan: Howto Explain its Development. In J. Muller and B. Preissl(eds.), Governance of Communication Networks. Connect-ing Societies and Markets with IT. Heidelberg: New York,pp. 309–332.

Whitehead, S., Mailley, J., Storer, I., McCardle, J., andFarrell, G. (2008). “Mobile Phone Anti-Theft Designs: AReview.” European Journal on Criminology and CriminalPolicy 14(3): 39–60.

at University of N

ewcastle on D

ecember 19, 2014


ownloaded from


Documents

Anticipating Mobile Phone 'Smart Wallet' Crime: Policing and Corporate Social Responsibility