Securing a mobile phone such that it can be used to make credit or debit transactions at a physical point-of-sale (POS) terminal is a challenge. Payment systems based on magnetic stripe cards have evolved to use EMV chip cards and the natural next stage was to utilize dedicated security hardware inside most phones called a Secure Element to host the payment application, user payment credentials and the associated cryptographic keys.

However, this approach has proven difficult to take from pilot to mass deployment for a variety of reasons – lack of standardization for mobile phones, complex certification requirements and, most importantly, the reluctance of many banks to cede control to a third party, the Trusted Service Manager (TSM). In the TSM model the bank pays to ‘rent space’ on the Secure Element, which is typically controlled by a mobile network operator (MNO) or handset manufacturer. To overcome these challenges an alternative approach is rapidly gaining support - host card emulation (HCE). With HCE, critical payment credentials are stored in a secure shared repository (the issuer data center or private cloud) rather than on the phone. Using host card emulation, limited use credentials are delivered to the phone in advance to enable contactless transactions to take place. Although host card emulation eliminates the need for TSMs and shifts control back to the banks, it brings with it a different set of security and risk challenges.


More than: https://www.entrust.com/digital-security/hsm/solutions/use-case/payments/host-card-emulation