Preparing for Quantum Day and the Risks to Modern Cryptography

Quantum computing may still be years away from breaking cryptography, but powerful quantum computers are rapidly advancing, and their impact on cybersecurity is already unfolding. Unlike previous technological shifts, it has the potential to render some of today’s most trusted cryptographic protections obsolete—forcing organizations to rethink how they secure data long before the threat materializes.

This moment, commonly referred to as Quantum Day, represents the point at which a quantum computer can effectively compromise today’s unbreakable algorithms. In a PaymentsJournal Podcast, Antoine Kelman, NORAM Payment Services Chief Technology Officer at IDEMIA Secure Transactions, and Tracy Goldberg, Director of Cybersecurity at Javelin Strategy & Research, discussed how organizations should prepare for this eventuality.

Getting an Early Start

A few years ago, Quantum Day was estimated to occur sometime between 2030 and 2040. However, rapid progress—particularly in countries like Korea—suggests that this timeline may be compressing. Many regulators are now urging organizations to be fully prepared by 2030, which is only a few years away.

Preparations are already underway. Regulators across multiple jurisdictions are requiring critical industries to assess their exposure and begin updating cryptographic protocols. National cybersecurity agencies are actively defining policies and advancing new standards.

A key concern is the emergence of “harvest now, decrypt later” attacks. In this model, attackers collect encrypted data today—even if they cannot yet decrypt it—with the intention of unlocking it in the future once quantum capabilities become available.

Online vs. Offline

The payments ecosystem includes cards and terminals with long operational lifetimes. Without sufficient preparation, these devices could become vulnerable. To address this, it’s important to understand how current transactions and cryptographic methods function.

There are two primary transaction types: online and offline. Offline transactions occur when the payment terminal can’t communicate with the issuing bank—whether due to connectivity issues, system outages, or practical constraints. Certain use cases, like mass transit, rely on offline processing because speed is critical.

Both transaction types must be addressed in the context of Quantum Day. On the online side, quantum computers are not expected to significantly weaken symmetric cryptography. As a result, maintaining strong, up-to-date algorithms is generally sufficient for quantum resilience.

Some networks mandate offline functionality for resilience purposes—for example, during large-scale cyber incidents that disrupt communications.

“We know that we'll have to rely on offline transactions and therefore we have to address the Quantum Day risk,” Goldberg said. “We constantly have these types of conversations every time there's a pretty significant change or shift that is needed, but eventually everyone will get on board.”

Identifying Additional Vulnerabilities

Another challenge is the long lifecycle of payment cards. Due to extended deployment and replacement cycles, it can take more than a decade to fully refresh cards in the field. As a result, some devices in circulation may still be active when Quantum Day arrives.

“With chip cards, we knew the risks for decades, and look how long it took us to make that migration,” Goldberg said. “If financial institutions, card issuers, acquirers, and merchants think that we’re going to be able to address Quantum Day concerns and we don’t get started now, they’re fooling themselves.”

The broader challenges lies in the complexity of the payments ecosystem. Cryptographic keys are stored, distributed, and managed across multiple layers and components, creating a wide attack surface.

“The first, most critical area to address in the payment business was the card itself,” said Kelman. “It continues to be our priority, because it embeds those secure elem