Mobile payment applications contain sensitive user data and easily abused functionality, and all the while execute within environments which cannot be trusted. This talk will explain the implications of running financial applications within such hostile environments, and demonstrate how an application can be reverse engineered and modified. We will also discuss the implications of such an attack, including - targeted malware, the loss of confidence in the security of financial institutions, and the loss of intellectual property.