Both organizations and consumers are evolving, becoming more digital, and requiring features that align with the current environment. As businesses are transforming digitally, consumers are surrounded by a plethora of applications and are using apps more than ever in daily life. Unfortunately, companies and individuals are at greater risk than ever because applications are among the top targets for threat actors. 

According to a new report from App Annie, “mobile shopping apps are poised to see their biggest shopping season to data.” Many expect the holiday season will see a massive increase in purchasing online. The mix of progressing digitalization and the ongoing COVID-19 pandemic has dramatically impacted consumers' shopping behavior globally.

Consumers from virtually every country now depend upon digital payments. A May 2020 survey reports that U.S. consumers found that "compared to last year, 49 percent of respondents were more interested in shopping online for the holidays. A third of respondents were also more interested in buying online and picking their order up in-store, and just less than a third were more interested in buying in-app."

As the demand for online and in-app purchasing grows, cybercriminals lay in wait to take advantage of the situation. Payment APIs are APIs (Application Programming Interfaces) designed for managing payments that enable ecommerce sites to process credit cards, track orders, maintain customer lists and more. "By 2021, 90% of web-enabled applications will have more surface area for an attack in the form of exposed APIs, and by 2022, API abuses will be the vector most responsible for data breaches within enterprise web applications," according to Gartner's API Strategy Maturity Model, 2019.

Some of these breaches are due to flaws in API implementation. Still, others are due to a lack of integration between security components, inadequate data validation, configuration issues, or insufficiently hardened infrastructure. APIs are also subject to virtually all of the same risks as classic web applications. Mainly, API attacks use bot networks to execute account takeover and carding attacks, scrape content, and disrupt ecommerce security. API attacks are increasing in volume and intensity across a wide range of applications in different sectors of ecommerce.

Additionally, attacking mobile APIs is fairly easy and can also use the same infrastructure and attack modes as directly attacking APIs and web APIs. Moreover, traffic is growing the fastest for mobile apps. So mobile APIs become a better environment to conceal corrupt behavior than far more lightly used website versions of food delivery applications like DoorDash and Uber Eats, elearning apps like Quizlet, or mobility apps like Uber and Lyft.

The payment as a service market is set to grow exponentially, as large enterprises are widely adopting digital payment solutions to reduce the time required for payment execution, improve administration visibility, and increase customer experience. In fact, the PaaS market globally is set to grow at a compound annual growth rate of 16.9% from 2020 to 2027.

As part of the Open Banking Initiative, the Payment Services Directive 2 (PSD2) seeks to make payments more secure in Europe, increase innovation, and allow for banking services to adopt new technologies for their customers. The Open Banking Initiative is evidence of the increasing importance of Application Program Interfaces. Without secure APIs, rapid innovation would be impossible. A foundational element of invention in today's app-driven world is the API.

As payment services continue to grow, APIs have become more critical to software development and deployment lifecycles. Securing APIs is difficult – manually testing is very tedious and time-consuming, and less than 25% of organizations are testing their APIs today. Application leaders responsible for digital ecommerce must anticipate changing landscapes by adapting their strategies, practices, and roadmaps.