While convenient for consumers, automakers and service providers need to take stock of the cybersecurity vulnerabilities as vehicle-based wallets are given greater latitude to make payments, said Mitra Mirhassani, co-director of the Shield Automotive Cybersecurity Centre of Excellence at the University of Windsor in Ontario.
"I would prefer not to have a car that is connected to anything," she said, "but it's a trend in the market. You sometimes don't have any way around it."
Vehicle-based payments are an emerging area, and many in the auto sector are still working through the basics, said AJ Khan, CEO of automotive cybersecurity company Vehiqilla Inc.
Early steps include establishing how sensitive payment information is stored, whether payments will be made through the vehicle itself or smartphone apps, and how potential breaches will be handled, Khan said.
Real-time monitoring is needed, he said, because unlike with a lost credit card, mobile wallet users may not know they have been compromised.
"If your vehicle and your third-party apps are being monitored for any such thing, then you'll be notified," he said. "Attention is the first part toward prevention."Ford Motor Co. launched an app-based mobile wallet known as FordPay in 2016. But the company now says it was a proof of concept and it never followed up. It can't be used for third-party purchases now.
Some EV makers have adopted the Plug & Charge system. The system has software operating in the background that authorizes an EV at a charging station to identify itself to the network and provide a payment mechanism.
BlackBerry, meantime, is ramping up work on Ivy. The Waterloo, Ontario, tech company is collaborating with several unidentified automakers and Tier 1 parts suppliers to integrate Ivy into next-generation vehicles.
Vehicle-based payments are just one part of the cloud-based Ivy platform, undergoing co-development by BlackBerry and Amazon Web Services. The platform processes data transmitted by vehicle sensors and connects it with independent product or service providers running on the Ivy "ecosystem."
Financial technology company CarIQ Inc. is working with BlackBerry to enable vehicles to autonomously pay for fuel, tolls and parking, among other expenses. When run through Ivy, the solution creates a "digital fingerprint" allowing vehicles to connect to banking networks, validate spending and make payments.
Topping off the fuel tank is one example. Instead of a driver manually punching in a credit card PIN at the pump, authentication on Ivy is carried out by vehicle sensors, Virk said.