Digital Wallet Security: Why Card Reissues Can't Stop Infostealers

Jessica Albright · 2026-11-06

Digital wallets have changed the game. With a single tap, you can pay at thousands of online stores without re-entering your card details. It's fast, it's convenient, and it's become second nature for millions of shoppers. But that same convenience is opening doors for cybercriminals in ways you might not expect. ### The Hidden Threat: Infostealers One of the biggest challenges in digital wallet security comes from a sneaky type of malware called infostealers. Once installed on your device—often through a phishing email or a malicious download—it quietly scoops up sensitive information. We're talking passwords, browser cookies, payment details, and even wallet data. Then it sends everything back to the bad guys. According to Tracy Goldberg, Director of Cybersecurity at Javelin Strategy & Research, the combination of infostealers and emerging encryption-cracking technologies has created a formidable threat. Her report, *Card Account Updaters and Digital Wallets: The Hidden Cyber Advantage for Crime*, highlights how these tools are making digital wallets more vulnerable than ever. ### The Problem with Card Reissues When your card is lost or stolen, your bank typically reissues it. And thanks to account updaters, the new card details automatically sync across your digital wallets—sometimes before you even have the physical card in hand. That's convenient, right? But here's the catch: if your wallet is already compromised by an infostealer, the malware gets the new card info too. "Even if you have a secure login to a digital wallet, if the wallet itself is compromised by an infostealer, when it automatically updates in the digital wallet cybercriminals have access to the digital wallet, and they have access to the new card," Goldberg explained. In other words, reissuing the card doesn't solve the problem. The infection is still there, and the bad actors still have access. ### Why Login Credentials Are a Weak Link Beyond digital wallets, our reliance on usernames and passwords is another weak spot. Password managers help, but they're not foolproof. Infostealers can capture autofill data, take screenshots of your browsing activity, and grab personally identifiable information (PII). All of this makes it easier for criminals to impersonate you or access your accounts. And with the average person juggling multiple digital wallets and payment cards, the attack surface is bigger than ever. Each wallet and each card is another potential entry point. ### A New Approach to Security So what's the solution? Goldberg suggests treating card replacement as just one part of the remediation. "Just reissuing the card isn't going to remove the infostealer, the infection on the device, or repair a wallet that's been compromised," she said. "There has to be a unique way of verifying the authenticity of that transaction every time it's conducted." That means moving away from relying solely on autofill and passwords. Some financial institutions are experimenting with hardware authentication keys, which require a physical device to verify your identity. Others are pushing for multi-factor authentication that's more resistant to phishing. But perhaps the biggest shift is in mindset. Security can't be static. As threats evolve, so must our defenses. It's a continual reassessment—one that puts user education and proactive measures at the forefront. > "We have to treat the card replacement as just one part of the remediation. Just reissuing the card isn't going to remove the infostealer, the infection on the device, or repair a wallet that's been compromised." — Tracy Goldberg, Director of Cybersecurity at Javelin Strategy & Research ### What This Means for You If you use digital wallets, here are a few practical steps to protect yourself: - **Keep your devices updated** with the latest security patches. - **Avoid autofill** for sensitive information; type credentials manually when possible. - **Use multi-factor authentication** wherever offered. - **Monitor your accounts** regularly for suspicious activity. - **Be cautious** of phishing emails and only download apps from official sources. The convenience of digital wallets isn't going away. But understanding the risks—and taking steps to mitigate them—can help you stay one step ahead of the criminals.