Quantum-Safe Payments: Hype, Hope Or Just Headline Insurance?
Quantum investment is growing - when will it impact payments? (Photo by Thomas Niedermueller/Getty ... More Images)
When a Europol-backed working group warned in February that banks should 'start their post-quantum migrations now,' it triggered a familiar ripple through boardrooms: Is Q-Day finally close enough to budget for? The Quantum Safe Financial Forum, whose members include the Fed, the ECB, and half a dozen global systemically important banks, framed the threat in stark terms: criminals are already stockpiling today's encrypted payment traffic, betting they can decrypt it tomorrow.
Card networks, instant-payment switches, and mobile wallets rely on public-key cryptography: the RSA and elliptic-curve algorithms that every ISO 8583 or ISO 20022 message depends on. A fault-tolerant quantum computer could, in theory, break those keys in hours. Visa's global head of fraud services told PYMNTS that threat actors are 'steal-now-decrypt-later' harvesting card data already, waiting for quantum horsepower to catch up.
Central bankers are equally blunt. In a speech titled Technology as a New Frontier for Macro-Prudential Policy, ECB board member Piero Cipollone called quantum risk 'a serious threat to our encryption-based financial system' and urged an early transition.
For a decade, the answer to the quantum threat was to wait for NIST. That wait ended on 13 August 2024, when the U.S. standards body finalised its first three post-quantum encryption algorithms: CRYSTALS-Kyber for key exchange and CRYSTALS-Dilithium and SPHINCS+ for digital signatures. NIST urged system administrators to 'begin transitioning as soon as possible.'
Those standards are now the reference set for every card scheme, processor, and bank writing 'quantum-safe' into a roadmap. Mastercard, for example, launched a Quantum Security & Communications project in 2021 and says the NIST selections will 'directly inform future network designs.'
Card giants are still piloting. Visa has job listings for researchers 'who will directly influence how Visa and the broader payments industry evolve in the age of quantum computing,' hinting at an internal prototype network that swaps RSA for lattice-based keys. Mastercard runs quantum-threat drills inside its Cybersecurity Fusion Centers and has already swapped post-quantum algorithms into some internal message pipes.
While U.S. firms talk pilots, China is stringing satellites. In March, the Chinese Academy of Sciences announced the first 12,800-kilometre quantum key-distribution (QKD) link between Beijing and South Africa—an experiment that leapfrogs fibre-based QKD and shows how a global, satellite-borne network might one day shield cross-border payment traffic from interception. The geopolitical implication is clear: if Beijing controls an orbital quantum backbone, it could offer 'unhackable' payment messaging to Belt-and-Road partner banks long before Visa or SWIFT finish their ground-based migrations.
The payments stack is layered. Updating SSL/TLS in an API gateway is trivial compared with swapping out hardware security modules (HSMs) that live in PCI-DSS cages. Most production HSMs cannot run Kyber or Dilithium; vendors are still shipping beta firmware. Network-level revamps run into liability rules: if a post-quantum algorithm fails in the wild, who reimburses the retailer?
That's why many CISOs treat quantum-safe upgrades as headline insurance—announce a pilot, reassure the board, but keep the RSA fallback until regulators force a cut-over. The Europol forum tried to puncture that complacency: it wants banks to map every cryptographic dependency by end-2025 and publish transition timetables.
Sceptics argue fault-tolerant quantum machines are at least a decade away. Yet the harvest now strategy is real. Payments data—PANs, CVVs, CVCs—retain value for at least seven years, the typical validity window of a card. If quantum decryption arrives sooner than expected, terabytes of archived traffic could be replayed against tokenisation systems, revealing plaintext PANs that feed synthetic-identity fraud.
Visa's fraud researchers estimate cyber-crime will cost the global economy $10.5 trillion by 2025; post-quantum vulnerabilities could add a multiplier. Small wonder regulators view proactive migration as cheaper than retrospective cleanup.
QKD satellites grab headlines because they sound like Star Wars for banking. Yet QKD only solves key exchange, not bulk message encryption, and current satellites handle kilobit-per-second links—fine for diplomatic traffic, useless for VisaNet's 65,000 TPS. Most experts see satellite QKD as a niche overlay that protects the 'seed keys' used to bootstrap terrestrial networks.
Still, China's leapfrogging matters. A bank that can route high-value settlement messages via an entanglement-based channel gets an edge in geopolitical trust—especially in regions where 'quantum-proof' becomes a marketing label as powerful as PCI Level 1 was in 2005.
Quantum-safe payments sit at the awkward intersection of science and risk. Hype sells satellite demos and billion-dollar quantum-computer SPACs. Hope anchors R&D agendas for Google, IBM and Alibaba. But audit proof, evidence that a network will still work when Shor's algorithm becomes practical, is what regulators, auditors and cyber-insurers increasingly demand.
Visa, Mastercard, and China's quantum satellite engineers are converging on the same conclusion: the time for headline insurance pilots is closing. The following compliance cycle will ask not if you have a quantum-safe plan but how far along you are on the three-phase roadmap. For payments executives, the cheapest answer is to start migrating before Q-Day headlines hit the front page—and before stolen 2024 card data meets a 2030-grade quantum decryptor.
In other words, the smartest move might be to treat quantum-safe payments less like distant science fiction and more like EMV circa 2000: a heavy lift today, but table stakes tomorrow — because nobody wants their brand on the first un-quantum-proof breach.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Forbes
21 minutes ago
- Forbes
Microsoft Confirms Security Pause For Outlook Email Encryption
Two-click encrypted email adds security pause for Outlook users. There are lots of ways that email platforms can come under attack. Your passwords can be compromised, whether you are using Outlook or Gmail. Two-factor authentication code session cookies can be stolen by hackers enable easy account access. And you can, in effect, compromise your own email by not taking privacy considerations seriously enough. This can even be, maybe even especially be, the case when encrypted email is concerned. Which is why Microsoft is introducing a security pause for users of New Outlook for Windows. Here's what you need to know about the new 2-click encryption view. As regular readers of the cybersecurity section here at Forbes will know, I'm a great advocate for security being simple if it is to be effective. Anything that gets in the way of a smooth user experience will likely be ignored or disabled, and thus quickly becomes counterproductive from the perspective of attack mitigation. You might be surprised to learn, therefore, that I'm all in when it comes to the latest Microsoft announcement that Outlook is introducing a security pause to the encrypted email viewing process. 'New Outlook for Windows will now support a two-click view for encrypted emails,' Microsoft said. 'This feature enables admins to require user confirmation before allowing access to encrypted emails.' Sounds like an extra security hurdle to me, for sure, but in this case, it is a desired one. Why so? Because we are talking about preventing users from opening an encrypted email without giving any thought at all. What if the user is in an inappropriate environment? What if there are people around who should not be able to view the contents? Poor privacy controls are the doorway to compromise, especially when sensitive data is concerned, and let's face it, why would you encrypt email if it were not meant to kept private? Admins with control over New Outlook for Windows, as well as Outlook for the web, iOS and Android, will be able to implant the security pause from the TwoClickMailPreviewEnabled setting in the Microsoft Azure directory, and Microsoft said they can also set this up using a Microsoft PowerShell command in Microsoft Exchange Online PowerShell. The feature will start rolling out in early April and be complete by the end of that month, although Android and iOS implementations will come a little later, with the end of June being the target completion date, according to Microsoft.
CNET
29 minutes ago
- CNET
Should You Buy or Rent Your Router? The Wrong Choice Set Me Back Nearly $1,000
I've been writing about the internet for six years, and for most of them, I carried around a shameful secret: I rented a Wi-Fi router from Xfinity. Even though I've always advised readers to buy their own equipment, my rented modem and router worked fine. But all that time, in the back of my mind, I knew it was a waste of money. A monthly charge of $15 for internet equipment doesn't seem too bad when you're first signing up for internet, but after a few years of paying that monthly fee, you'll quickly rack up hundreds of dollars for a cost you could have avoided. When I looked through my old bills and added up the cost of renting internet equipment, I found I spent $873 on Xfinity's equipment fees over those six years. Buying your router and modem may seem like a hefty upfront cost, but it will likely pay for itself in the first year. With the money I've spent renting Xfinity equipment, I could've bought the most advanced router CNET's ever tested and then bought another as a backup. I could've doubled the internet speed I was getting. I could've booked a flight to Oslo. I was finally ready to enter the world of modem and router ownership. Locating local internet providers As satisfied as I was with my Xfinity gear, owning your own equipment is almost always the better option. You'll often get better performance -- my upload speeds increased by more than 2,000%. As I said, it'll usually pay for itself within the first year or two. The average internet bill in the US comes in at $78 per month -- and that's before you add the extra taxes and fees, which you should be able to see on your ISP's broadband nutrition label. Some of these are unavoidable, but equipment rental fees don't fall into that category. You might be perfectly content to pay a bit extra for the convenience of not having to buy and set up your own equipment. But if you're looking to save money in the long run and are comfortable purchasing and managing your own gear, it's a far better deal to shell out for your own router and modem. You may also be able to take advantage of any low-income discounts available in your state if you qualify. Here's what I've learned about making the switch from rented equipment to my own, and here's how you can make a similar change as painless as possible. How to choose the right modem and router The best internet is the internet you never notice, and I can't remember the last time my connection went out or I saw a buffering wheel in my home. And this is all with a device from 2017 that Xfinity describes as an "old Wireless Gateway with limited speeds and functionality." This goes to show how much the type of internet user you are has to do with what kind of equipment you need. I live in a 750-square-foot apartment, and my internet needs are mostly limited to video calls and TV streaming. If you live in a larger home with multiple floors, the same router likely won't cut it. Similarly, activities like online gaming hinge on split-second reactions. If this instantaneous responsiveness is important to you, it's probably worth investing in a gaming router that minimizes lag. Wi-Fi routers run the gamut from entry-level models like the TP-Link AC1200 for $30 to ultra-advanced mesh systems like the Netgear Orbi 970 Series for $1,500. To test each Wi-Fi router, CNET runs three speed tests in five different rooms in our testing facility, logging results for download speed, upload speed and latency. That process is repeated six times, accounting for variations in network performance at different times of the day. Ry Crist/CNET After consulting our picks for the best Wi-Fi routers, I decided to go with a budget pick: the TP-Link Archer AX21, of which my former CNET colleague and router connoisseur Ry Crist wrote, "It's nothing fancy, but it offered near flawless performance for small- to medium-size homes in our tests, and it's a cinch to setup." I get only 200Mbps through my Xfinity plan, so the 700Mbps speed the TP-Link hits at close range is more than enough juice and only cost $85 when I bought it. (Several government agencies have since opened investigations into TP-Link for ties to Chinese cyberattacks. But I don't have any plans to replace my TP-Link router just yet.) A cable modem like the Hitron CODA connects your home to your internet provider through a coaxial cable. Hitron Do you need to buy a modem? Depending on your internet connection, you may need to purchase a cable modem in addition to your router. Some ISPs, like Spectrum, include the modem for free but charge extra for a router. The main thing to look for in a modem is compatibility. Your internet provider will have a page on their website that lists all the models that it works with, and you shouldn't stray from this. You may also have a choice between DOCSIS 3.0 and 3.1; the newer standard provides faster speeds, but DOCSIS 3.1 modems are typically more expensive. (Note: Although some ISPs have DOCSIS 4.0 modems available to rent, most are not yet widely available for purchase.) Other things to consider are the modem's speed limits -- make sure they're equal to or above your internet plan -- and the number of Ethernet ports. Xfinity doesn't provide a free modem, so I had to buy one in addition to a Wi-Fi router. I opted for the Hitron CODA Modem -- a DOCSIS 3.1 model that's one of the cheapest Xfinity-compatible models I could find for $100 at the time I purchased it. It supports download speeds up to only 867Mbps, but that's still far more than my Xfinity plan. How to set up your new modem and router Ordering the equipment is the easy part; the ordeal of setting up third-party equipment is what keeps many customers on the hook for years. The process is largely the same whether you're starting service fresh with a new provider or swapping out old equipment. Here's everything you'll need to do. 1. Activate your new modem with your ISP The modem is the piece of equipment that brings the internet to your home through a coaxial cable connected to your internet provider's network. Before it can work, ISPs need to tie your specific modem to your account. If you're replacing old equipment, they will also turn this off as they activate the new modem. ISPs do this by logging your MAC (media access control) number, which can be found on the bottom of the modem. You can typically do this through your internet provider's app, in a live chat or by calling a customer service number. 2. Connect the coax cable to your modem After your new modem's MAC address is registered with your ISP, you'll be prompted to connect your modem to the cable outlet in your wall and plug it into a power outlet. You may have to wait up to 5 minutes, and your modem's lights will tell you when it's receiving the internet signal. Once the indicator lights are on, you're ready to set up your wireless router. This TP-Link router offers wireless access to your modem's connection with the web (hence the antennas). Ry Crist/CNET 3. Set up your Wi-Fi router Each Wi-Fi router has its own setup process, so you'll want to follow the instructions provided. In the case of the TP-Link Archer AX21, that meant unplugging the modem's power, connecting the modem to the router's WAN port via an Ethernet cable, powering on the modem and then plugging the router into a power outlet. From there, I set up my new network through the TP-Link app. That's the short version. There's a lot more to consider when setting up a wireless router, including choosing the optimal location, setting up parental controls and protecting your privacy. For my purposes, though, I was ready to start testing out my new internet connection. Speed comparison: Which setup is fastest? I wanted to see how my new modem and router would compare with my old equipment, so I ran speed tests before and after I was connected: one from my desk next to the router and one from the furthest corner of my apartment (regrettably, the bathroom). My old modem and router returned 164/5Mbps speeds from my desk and 143/5Mbps from the bathroom -- not bad for an internet plan that advertises 200/10Mbps speeds. But the speeds with my new equipment were eye-popping: 237/118Mbps at both my desk and my bathroom. I didn't just save money by purchasing my own equipment -- I'm actually getting a significant speed boost, too. Joe Supan / CNET I have no idea why my new equipment picked up 10 times the upload speeds of my old one. I subscribe to Xfinity's Connect More plan, which is supposed to get only 10Mbps upload speeds. In 2022, Xfinity announced that it was increasing upload speeds on my plan to 100Mbps -- but only for customers who pay for its $25-per-month xFi Complete equipment. Apparently, I'm reaping those same benefits with my new modem and router. My best guess is that the upgrade from a DOCSIS 3.0 to a 3.1 modem is the main reason for the jump in upload speeds. How to save yourself some headaches I eventually got my modem and router set up properly, but I made plenty of mistakes along the way. Here's what I would do differently: Buy your modem and router on day one. Moving is a pain, and no one wants to make their to-do list even longer, but this is one task where the extra effort pays off (nearly a thousand dollars in my case). A technician Use your ISP's list of compatible modems. Routers aren't tied to specific providers, but if you have to purchase your own modem, you'll need to make sure that it works with your ISP. Don't cut corners here. I searched Amazon for a modem that said it was compatible with Xfinity and ended up having to return it a week -- and several hours of phone calls -- later. Your provider should have a page where it lists all the modems that it works with -- don't stray from this. Pay for only the speed you need. Internet equipment is expensive, and there's no reason to pay for a modem certified for 2,000Mbps when you're getting only 200Mbps with your plan. The same goes for routers -- you don't need to pay top dollar for a gaming router with exceptional latency if you're just streaming TV and scrolling the internet. My final thoughts Setting up a new modem and router is not fun, but it's absolutely worth it. My internet speeds have dramatically improved, and I'm paying significantly less for them. I'm saving $15 per month on equipment, and somewhere along the line, an Xfinity agent bumped my plan price down for the following year. My monthly bill went from $78.54 to $50. That's far more than I expected to save, and my new equipment paid for itself within the first six months. My only regret is that I didn't make the leap sooner.
Washington Post
43 minutes ago
- Washington Post
$75 billion firm wins carve-out in tax bill after lobbying push
The tax bill before Congress would partially exempt the U.S. Virgin Islands from a law meant to crack down on tax havens, after a lobbying campaign by the territory's government and a large private credit firm that stands to benefit from the measure. Over the past three years, an affiliate of the credit giant Golub Capital paid a Washington firm more than $500,000 to urge Congress to relax a global minimum tax approved as part of the 2017 GOP tax law, lobbying disclosures show. The push was supported by the Virgin Islands' governor and Democratic member of Congress. House Republicans included a bipartisan provision partially exempting the Virgin Islands from that law in the tax legislation they approved last month — a decision that has puzzled experts on both the left and right, who say it has little clear policy justification.
