Mobile Wallet

Overview

Mobile wallets can hold keys locally, connect to custodial accounts, use secure device hardware, interact with decentralized applications, scan payment codes, and authorize transactions through touch or biometric-assisted authentication. Their custody models vary widely.

Phones are frequently connected, carried, replaced, backed up, and exposed to malicious applications, phishing, notification leaks, screen capture, and account takeover. Biometrics usually unlock a device or application rather than replacing the underlying wallet key. Cloud backup can change the effective security model.

Users should install from verified sources, protect the device and account, review permissions, enable strong authentication, and keep recovery material separate. High-value holdings may require more isolated storage. Before approving, users should verify amount, destination, network, and contract intent. Device loss and migration should be tested while the original phone remains available.

Mobile Wallet should be distinguished from the asset balance and from the application that displays it. For example, a customer-facing success message does not prove that the intended transaction executed on the correct network; operations should verify execution and reconcile the result before irreversible fulfillment.

Material risks for Mobile Wallet include credential compromise, malicious destinations, unsupported assets, wrong-network transfers, stale balances, compromised software, provider outage, privacy leakage, and inaccessible recovery material. For Mobile Wallet, controls should reflect value, automation, reversibility, and whether the organization or a third party controls signing.

Production ownership for Mobile Wallet should identify the user or legal entity, supported assets and networks, address model, custody boundary, signing authority, recovery method, and systems permitted to request or observe transactions. For Mobile Wallet, these fields determine who can act and which evidence is authoritative.