But what does it say about the payment app if it doesn't bother to secure the low hanging fruit?