Vipps MobilePay

Is Vipps safe?

Yes, for most people it is one of the safer ways to pay. Vipps in Norway and MobilePay in Denmark and Finland, both run by Vipps MobilePay AS in Oslo, show no data used for tracking on their App Store labels, and we found no privacy or consumer-protection fine against either. Tap payments use a digital card number that works only on your phone, and Norway's financial regulator found no significant deficiencies in the company's IT controls in 2025.

The risk sits with the people you pay. Friend-to-friend transfers are instant, and scammers know it. We score Vipps MobilePay 75/100, level with Apple Wallet and ahead of Google Wallet at 70.

Tapping with Vipps or MobilePay on an iPhone

Until 2024, only Apple Pay could use the iPhone's NFC chip in shops. Under commitments the European Commission made binding in July 2024, Apple had to give rival wallets in the European Economic Area free access, and Vipps went first. From 9 December 2024, Vipps users in Norway could tap to pay with an iPhone, initially on BankAxept terminals. MobilePay followed in Denmark and Finland on 20 November 2025, starting with Danske Bank customers, and on 29 June 2026 another 21 banks from Denmark, Greenland and the Faroe Islands joined.

The security model is close to Apple's. Activating a card creates a digital card number tied to your phone, so the shop never sees the real one. You need a code, face or fingerprint to open Vipps and to tap. Vipps says Visa and Mastercard certify the solution and that the certifications must be renewed every year.

What we could not find is a paid bug bounty. The company publishes a responsible disclosure address in its security.txt file, but no reward scheme.

What Vipps and MobilePay collect

A payment app knows a lot by design. Apple's labels say Vipps links purchases, financial information, contact details, user content, search history, identifiers, usage data and diagnostics to you. MobilePay's label adds location and lists contacts as collected but not linked. Neither label lists any data used to track you across other companies' apps.

The privacy notices fill in the rest. Vipps uses age, gender, postcode and which features you use for "simple segmentation" of its marketing, which you can switch off in the app's data and privacy menu. Fuller personalisation, built on your purchases, friend payments and receipts, needs your consent, which lasts three years. Vipps has been here before. In March 2025, Norway's Consumer Council (Forbrukerrådet) told the data protection authority that Vipps's consent for marketing based on purchase history was unclear and pushed people towards yes. In April 2025 Vipps withdrew the consent it had collected from about 2 million users and said it would ask again only when saying no was as easy as saying yes. Vipps says it does not share personal data with its marketing partners and excludes users under 15 from all marketing.

Two details are worth knowing. The wishlist can show sponsored links, and clicking one can lead to tracking by the shop and the Adtraction affiliate network. Vipps also stores transcripts of calls with its AI customer assistant.

The scams that target Vipps and MobilePay users

Most money lost through these apps is sent by the victim. In Denmark, police received 3,869 reports of "Hej Mor" scams in 2024, up 637% on the year before. In these, a message from a "child" with a lost phone asks for help paying a bill. In Norway, fraudsters posing as police or bank staff persuaded Vipps users to move savings to a "safe" account, taking NOK 6.4 million in April 2024 alone.

Vipps answered with Olga, a model that scores every payment in real time and cancels risky ones. The company says this type of fraud fell 98% in Olga's first six months, and that it now protects friend payments in Denmark too. MobilePay has shown users' full legal names since 2024, so a payment to "your daughter" shows the stranger's real name. It also lets you block other users and stay logged in on only one phone at a time.

How to use Vipps or MobilePay safely

1. Check the name on screen before you confirm any payment to someone who says they are family.
2. Hang up on anyone who says your money is at risk and must be moved, then call your bank on its official number.
3. Never approve a payment request you did not expect, even if it looks like a refund.
4. Use face or fingerprint unlock, and a phone code nobody else knows.
5. Turn off simple segmentation in the data and privacy menu if you do not want targeted offers.
6. Report fraud to the police and the company straight away, as Vipps asks on its security page.

How we scored it

The regulatory record (85) is the strongest factor. There is no fine or order, though no regulator has reviewed the apps themselves, and the 2025 consent complaint has no published outcome. Security (80) reflects tokenised tap payments, biometric checks and a clean IT inspection, held back by the lack of a bug bounty. Privacy (66) is the weakest: there is no ad tracking, but the apps hold a detailed record of your spending and use it for consent-based profiling. For tapping on Android, Samsung Wallet and Google Wallet are the main alternatives.