Samsung Wallet and Samsung Pay

Is Samsung Pay safe?

For tapping your phone at a till, yes. Samsung Wallet, the app that took over Samsung Pay, replaces your card number with a token tied to the phone, keeps sensitive data in a protected part of the chip and asks for your fingerprint or Wallet PIN before each payment. We found no breach of Wallet payment data.

The weak side is privacy. Samsung's US privacy notice for Wallet allows advertising inside the app and sharing with marketing partners, while its Google Play data safety section says the app collects nothing at all. We score it 67/100, a little below Google Wallet at 70 and Apple Wallet at 75.

How Samsung Pay protects your card

When you add a card, Samsung encrypts the details and sends them through its servers to your card network, such as Visa or Mastercard. Your bank may ask for a one-time code to prove you are the cardholder, which stops someone with your lost card from adding it to their own phone. The network then issues a token for your device, and Samsung says it neither stores nor has access to the card details.

At the till, you confirm with a fingerprint or your Wallet PIN, and the terminal receives only the token. The network checks it against your real card in its own vault before approving the payment. On the phone, Samsung's Knox platform keeps fingerprint and payment data in a separate "secure environment" that ordinary apps cannot reach.

The app itself has had bugs. The National Vulnerability Database lists several fixed flaws in Samsung Pay since 2021, including one in the US version that allowed NFC use without the user noticing (CVE-2021-25525) and an information leak through an implicit intent fixed in 2024 (CVE-2024-20850). Samsung pays researchers between US$200 and US$1 million for qualifying reports.

What Samsung collects in Wallet

On Google Play, Samsung declares that Samsung Wallet collects no user data and shares none. Its own US privacy notice, updated on 20 October 2026, tells a different story. It covers:

• your Samsung account, name, date of birth, email and phone number
• driver's licence, passport, campus ID and work ID details, including photos
• card numbers with security codes, bank account and routing numbers, balances and bill payments
• device identifiers, including the IMEI, IP address and Wallet IDs
• location through Bluetooth and Wi-Fi signals, and precise location with separate consent
• the merchant, location and amount of transactions when you use Cash Back or certain branded cards

Samsung may use this to market its own products, show "sponsored content and promotional content from select partners" and provide advertising within the app. The list of companies it may share data with includes aggregators, card networks, app developers and marketing partners.

This differs from Samsung's support page, which says that only the payment network and your bank have information about a transaction. That holds for an ordinary tap, but not once you use Cash Back offers or a co-branded card. We score privacy on the notice, which is broader than the Play label.

Samsung's regulatory record

We found no privacy or consumer-protection fine or order that names Samsung Wallet or Samsung Pay. Unlike Apple Pay, which faced an EU antitrust case and a CFPB fine, no regulator has finished a review of Samsung's wallet, so the score stays in the 85 to 88 range we use for apps that regulators have not examined.

The one recent clash was about money, not privacy. In March 2026 the head of South Korea's Financial Supervisory Service said that charging card issuers for using Samsung Wallet, used by more than 18.6 million people in Korea, would likely be passed on to consumers. He also said the decision was Samsung's to make, so there is no order.

How to use Samsung Wallet safely

1. Use a Wallet PIN that is not your birthday or your phone's unlock code, and register a fingerprint.
2. Never share a one-time code your bank sends to add a card, whoever is asking. Fraudsters use these codes to load stolen cards into their own wallets.
3. Turn on SmartThings Find, so you can lock or erase Wallet if the phone goes missing.
4. Leave precise location off unless a feature you use needs it.
5. Skip Cash Back offers and co-branded cards if you do not want Samsung to see where you shop and how much you spend.
6. To see or delete what Samsung holds, use the Privacy Rights Portal at samsung.com/us/privacy/rights.

How we scored it

The regulatory record (86) is the strongest factor, with no fine or order against the app. Security (78) is solid, with tokens, Knox and a check for every payment, but sits below Google Wallet and Apple Pay because of a run of app-level flaws. Privacy (50) is the weakest, because the privacy notice allows ads and partner sharing and the Play label says nothing is collected. On a Galaxy phone you can also use Google Wallet, which pays the same way and is more open about its data.