Here’s the uncomfortable part about quantum computing: an attacker doesn’t need a quantum computer today to put some of your data at risk.
Think about it. They can collect encrypted information now, hold onto it, and wait. It’s an uncomfortable fact and reality that someone could be stealing your customers' encrypted login data right now, today, and not touching a single account for years.
That’s the idea behind “Harvest Now, Decrypt Later.” The data may be unreadable today. But if a sufficiently powerful quantum computer can eventually break the cryptography protecting it, information captured today could become tomorrow’s exposed data.
That changes the conversation.
We don’t know when a cryptographically relevant quantum computer will arrive. Estimates vary widely. What we do know is that replacing cryptography across a complex organization takes time.
NIST notes that historically, moving from a newly standardized cryptographic algorithm to full integration into products and information systems can take 10 to 20 years. NIST finalized its first three post-quantum cryptography standards in 2024 and is already encouraging organizations to begin the transition.
Put those timelines next to each other and the math gets uncomfortable.
The encryption protecting your customers' logins today relies on math that's hard for regular computers to break. A powerful enough quantum computer could eventually break it. That computer doesn't exist yet, but attackers don't need it to exist yet. Tick, tick, tick...they just need to steal the encrypted data now and sit on it, betting they'll be able to crack it later.
The National Institute of Standards and Technology, the G7 (Group of Seven major economies), and the Bank for International Settlements all treat this as a real, current risk, not science fiction. The G7 Cyber Expert Group adopted a formal roadmap for this exact transition back in January.
I think there’s an important distinction here. The financial industry isn't sitting around waiting for a quantum computer to appear before doing anything about it.
In December 2025, the Bank for International Settlement (BIS) continued its technical trial with Project Leap Phase 2, testing post-quantum cryptography in an operational payment-system environment. The project involved financial institutions and SWIFT and replaced traditional digital signatures with post-quantum cryptography while processing liquidity transfers.
And the results are absolutely revealing.
The challenge isn't simply swapping one encryption algorithm for another. The testing identified performance, interoperability and integration issues that have to be addressed before migration can happen at scale.
That is why I keep coming back to infrastructure!
I would start somewhere much more basic.
If asked, can you show me where your cryptography lives? Not just inside your core systems. Across authentication. APIs. Certificates. Applications. Cloud environments. Payment infrastructure. Third-party platforms. Vendor connections.
Followed by:
Who owns it? What data does it protect? How long does that data need to remain confidential? And what happens when the underlying cryptography has to change?
NIST's current migration work specifically emphasizes building cryptographic visibility and maintaining an inventory because organizations cannot effectively prioritize or migrate cryptography they haven't identified.
That may be the most important part of this entire conversation. You can't migrate what you can't see.
This isn't a call to panic about quantum computers. Not at all. It's a call to stop treating quantum readiness as a future technology project.
The financial industry is already being asked to think about cryptographic agility, inventory, vendor dependencies and migration planning. BIS describes the transition as requiring coordinated, proactive action across interconnected financial institutions and payment systems.
For me, the starting point is visibility. Before an institution starts running ahead of itself, and asking “Are we quantum-ready?”, it needs to be able to answer a much simpler question:
“What are we running today?”
If that answer isn't clear, that's not a quantum problem. That's an infrastructure problem. And it's one worth finding before someone else discovers it first.
Where does your organization stand? Is post-quantum migration already on the roadmap, or is the conversation still being treated as a future problem?
#payments #retail #quantum #fintech
More insights on payments, fintech, and strategic consulting
Fraudsters don’t necessarily need to guess a password. They can use credentials that already work. A system built primarily to flag the wrong password has very little to flag when the password is correct.
Read more
On August 5, MoneyPass stopped being part of Fiserv and became an independent company. That is a pretty significant change for a network with more than 37,000 surcharge-free ATMs and 160 million cardholders.
Read more
The conversation around retail-acquired card fraud often focuses on the consumer who loses money or the retailer dealing with a frustrated customer. But the financial impact reaches much farther across the ecosystem.
Read more
I’ve spent the last three posts digging into the retail physical gift card issue: physical packaging cannot win an arms race against organized crime syndicates, and any security fix we attempt has to clear the register in the exact same heartbeat as a standard credit card tap. That leaves us with one question: What does a fast, secure, and compliant gift card actually look like in the real world? The answer really seems quite simple: remove sensitive payment credentials from the physical card.
Read more
E&S Consulting delivers data-driven strategies to enhance your decision-making, minimize operational risk, and cultivate the partnerships necessary for long-term success.