At the computer security conference “Black Hat,” held in the Las Vegas, U.S., security researcher Salvador Mendoza demonstrated stealing the credit card information from a purchase made by Samsung Pay with a simple device. The demonstration used the principle of Samsung Pay’s payment system. Samsung Pay stores the credit card information in the smartphones, and payments can made by touching the smartphones on the card-reader instead of the real credit card. The "one-time payment information token" similar to that created when using a real credit is made by the financial companies and sent in an electromagnetic form to the device.

In the demonstration, Mendoza activated Samsung Pay in a smartphone and stole the token, the electromagnetic payment information, with a special device he carried. He took the advantage of the fact that the one-time payment information, token, provided by a financial company usually, is extinguished right after processing a payment, but when Samsung Pay is aborted without a payment being processed, the token provided by some financial company remains available for maximum 24 hours.

In the upcoming security conference being held in Texas, U.S. on August 10, a Korean research team is to announce the hacking vulnerability of Samsung Pay. According to Choi Dae-seon, a professor at Kongju National University, a hacker successively stole a credit card information within a 2m diameter way from a Samsung Pay user making a purchase, and made a fraudulent payment, Professor Choi said it was done in a way that the payment information was tapped using a special device, and the hacker makes a fraudulent payment before the credit card holder’s original payment is processed.

"The research team is arguing they succeeded in hacking (the credit card information) in an unrealistic experiment environment," Samsugn said, adding that "it is almost impossible to hack (the credit card information) in real life."

Samsung Pay service is available in total eight countries, including South Korea, the US, and China.