Across the globe, digital wallets – software-based systems residing on smartphones, smart watches and other devices – are now commonly used to store payment information, such as debit and credit cards, event tickets, vouchers and even cryptocurrencies and IDs. They can also be used to hold passwords and biometric data. Applications such as Apple Pay, Google Pay and PayPal have grown in popularity in recent years as they enable fast, convenient and usually secure cashless transactions by transmitting encrypted financial data to payment terminals and online checkout services.

In 2024, there were over 4.3 billion digital wallet users, reflecting more than half of the entire global population. As society becomes increasingly digitalised, this number is set to grow to approximately 5.8 billion users – 68% of the global population – by 2029. In fact, a survey released in 2025 found that in the UK, only 48% of people now carry a physical wallet, and 11% of UK adults habitually leave home with only their digital wallet as a form of payment. As a result, users are experiencing unprecedented ease-of-access when it comes to their finances.

The security concerns
However, the threat landscape associated with digital wallets is growing. If hackers gain access to one, they will be able to steal personal information to make unauthorized transactions, or hold the owner to ransom. In Europe, over 3,000 banks and credit card issuers support Apple Pay alone, and these institutions can also be placed at risk if malicious actors access data linked to their services.

It’s not just digital threats either: a lost or stolen device which a wallet is linked to is also another avenue to unauthorized payments. Any of these incidents can result in significant financial detriment not only to the owner, but to the digital wallet provider also.

In 2024, unauthorized fraud cases across the UK rose 14% to 3.13 million, representing a total loss of £722 million. To mitigate these issues and better protect the end users, it’s essential that adequate security measures are in place – which is where TCG technologies can help.

Protecting digital wallets
Solutions such as the Trusted Platform Module (TPM) are being used to protect the passwords and PIN numbers hosted within the digital wallet. A secure cryptographic processor found in over a billion devices, it stores sensitive keys, PINs, passwords and biometric data to make these inaccessible to attackers, even if they gain access to the device’s storage. The wallet application can request the TPM to decrypt or sign data, but the actual key will never leave the TPM.

Additionally, should the device be passed over or stolen by a different user, the Root-of-Trust (RoT) measurement and Secure Boot process (leveraged by the TPM) ensures it cannot be tampered with. This mitigates the threat of malware, while delivering optimal password protection and data encryption.

An essential tool in fighting any kind of cyber threats, the TPM – as well as other technologies such as DICE – are establishing a strong foundation when it comes to protecting digital wallets, and the users they belong to. With users at risks, and providers and financial institutions limited in terms of the security measures they can offer, using the latest standards and specifications from the Trusted Computing Group (TCG) remains the best option for preventing payment fraud and other malicious activities.