From Adoption to Security Assurance: Mapping the Knowledge Structure and Evidence Gaps in Digital Wallet Security, Privacy, Governance, and Auditability (2015–2025)

Digital wallets have moved from peripheral payment applications to infrastructures that mediate retail payments, remittances, central-bank digital currency experiments, crypto-asset custody, and access to platform-based financial services. Their expansion has generated a mature stream of adoption research built around perceived usefulness, ease of use, trust, perceived risk, provider reputation, and behavioral intention [1-8]. Yet adoption is no longer the only relevant question. As wallets store credentials, payment tokens, private keys, transaction histories, and identity attributes, their reliability increasingly depends on security architecture, privacy safeguards, fraud controls, governance arrangements, and demonstrable accountability.

The literature has responded unevenly to this transition. Technical studies examine wallet vulnerability and exploit detection [9], cryptographic key management [10], authentication and proof-of-ownership mechanisms [11], offline payment protocols [12], forensic recovery [13], and additional cryptographic, vulnerability-analysis, and wallet-security mechanisms [14-21]. Behavioral studies continue to model trust, perceived security, privacy, and continuance intention [1-4]. A smaller governance-oriented stream addresses data-protection compliance, crypto custody, regulatory responsibility, and self-custody [22-26]. These streams are relevant to the same assurance problem but are often studied independently, which makes it difficult to determine whether the field has developed a coherent knowledge base or merely accumulated disconnected technical and behavioral solutions.

Existing bibliometric studies have generally mapped digital payments, mobile-wallet adoption, financial inclusion, or blockchain-enabled finance at a broad level. A recent study in this journal mapped personal-information security across electronic payments using Scopus, Web of Science, VOSviewer, and Bibliometrix [27]. That contribution established the importance of privacy, trust, and technology acceptance, but it did not isolate digital wallets as a distinct control environment or examine whether security claims are supported by governance, traceability, incident evidence, and independent verification. The present study therefore narrows the unit of analysis to payment, financial, and crypto-asset wallets and evaluates the field through a security-assurance lens. This high-precision framing makes it possible to distinguish perceived security from verifiable control effectiveness and to identify auditability as a structural evidence gap rather than an established research stream.

This study treats assurance as the capacity to generate justified confidence that a wallet operates in accordance with stated security, privacy, integrity, compliance, and accountability requirements. Assurance is broader than security: it includes the governance of controls, traceability of transactions and incidents, evidence preservation, responsibility allocation, and independent verification. The proposed adoption-to-assurance transition does not imply that adoption research disappears. Instead, assurance themes increasingly intersect with adoption constructs, while new technical and regulatory streams emerge. Scientometric mapping is therefore used to assess both the structure of this convergence and the gaps that remain.

The general objective is to map the intellectual and thematic structure of Scopus-indexed research on digital-wallet assurance from 2015 to 2025 and to identify evidence gaps across security, privacy, fraud control, governance, risk, and auditability. The specific objectives are to: (1) characterize the evolution, sources, authors, countries, citation impact, and collaboration patterns of the corpus; (2) map the conceptual structure linking adoption, trust, security, privacy, crypto-wallet infrastructure, and compliance; (3) examine the temporal transition from adoption-centered research toward assurance-centered themes; and (4) identify underdeveloped constructs and propose a research agenda for trustworthy and auditable wallet ecosystems. The study focuses on financial, payment, and crypto-asset wallets; records in which the wallet was incidental or only an identity container were excluded.

3.1 Research design and database

A retrospective bibliometric and thematic study was conducted using Scopus records. The design combined performance analysis with science mapping, following established guidance for transparent bibliometric research [40, 41]. Scopus was selected as the single source because it supplies standardized citation, affiliation, author-keyword, and reference metadata under persistent EIDs, which supports consistent deduplication and reproducible network construction across the interdisciplinary security, information systems, finance, and legal literature. A single normalized source also avoided cross-database differences in citation counts, source titles, and document identifiers. The resulting corpus is intentionally focused: the search required both a wallet descriptor and an assurance descriptor in prominent metadata fields. Its size therefore reflects a high-precision design rather than an attempt to represent all electronic-payment research.

3.2 Search strategy

The final search was executed on 24 July 2026. The strategy required a wallet descriptor and an assurance descriptor in the title or author keywords, as well as a financial, payment, or transaction context in the title, abstract, or keywords. The search was limited to English-language articles published from 2015 through 2025. The complete executable equation is reported in Appendix A. The query retrieved 80 records. This precision-oriented design may reduce recall compared with a broader TITLE-ABS-KEY strategy because both the wallet and assurance descriptors were restricted to the title or author keywords.

3.3 Eligibility and quality control

Eligibility screening was conducted at the title-and-abstract level. Records were included when a financial, payment, or crypto-asset wallet was a substantive object and at least one assurance dimension was central to the study: security, authentication, privacy, data protection, fraud, risk, trust, governance, regulation, compliance, custody, or auditability. Eight records were excluded because wallets were incidental to broader work on bank-FinTech cooperation, organizational blockchain transparency, digital authentication, cryptocurrency regulation, national payment systems, self-sovereign identity/KYC, digitally facilitated economic abuse, or blockchain criminal law. The final corpus contained 72 records. Ambiguous records were re-read against the wallet-centrality and assurance-centrality criteria. No missing DOI, keyword, or reference value was imputed. All seven authors participated in title-and-abstract screening. Ambiguous records, including the eight ultimately excluded, were re-read collectively, and inclusion decisions were reached by consensus. Because screening was collective rather than independently duplicated, no inter-rater agreement statistic was calculated. Figure 1 presents a PRISMA 2020-style flow diagram summarizing this selection process [42].

tu_pian_1.png

Figure 1. PRISMA 2020-style flow diagram of record identification, screening, and inclusion

3.4 Analytical procedures

The analysis was implemented in Python 3.12 using pandas, scikit-learn, and Matplotlib. Performance analysis covered annual output, source and author productivity, country participation, citation counts, and international co-authorship. Author keywords were lowercased and normalized for common singular/plural and orthographic variants. A weighted co-occurrence matrix was constructed for keywords appearing in at least two documents, and spectral clustering with a fixed random seed identified communities. Thematic evolution was compared between 2015–022 and 2023–2025. A transparent multi-label dictionary coded title and author-keyword evidence into security/authentication, privacy/data protection, trust/risk/user protection, governance/regulation/compliance, fraud/financial crime, adoption/continuance, and auditability/accountability. Documents could receive multiple labels. Country-level productivity was computed using full counting: each document was credited once to every country represented in the author affiliations, and a document with authors from k countries was counted once under each of the k countries. International collaboration (Multiple Country Publications, MCP) was defined as any document whose author affiliations spanned two or more distinct countries. The multi-label dictionary was applied only to titles and author keywords, representing a conservative, high-precision, lower-recall design consistent with the search strategy.

The results support an incomplete adoption-to-assurance transition: adoption remains dominant by citation leadership, yet two-thirds of the corpus was published after 2022 and increasingly addresses authentication, crypto-custody, vulnerability detection, fraud, offline payments, and regulatory responsibility [18-21, 36-39, 43-46]. The field is shifting from whether users will adopt a wallet to whether wallet ecosystems operate dependably under adversarial and regulatory conditions.

Security is quantitatively dominant but conceptually fragmented: protocol-oriented papers demonstrate mechanisms such as key protection, ownership proofs, and offline payments [10-21, 35-39], while behavioral papers treat security as a perception influencing use and loyalty [3, 4, 28, 29, 33, 34]. Integrating these evidence standards requires models linking control design and incidents to user confidence and recovery outcomes.

The declining relative share of privacy-focused work suggests specialization in a small group of policy-compliance studies, not reduced privacy risk, even as wallets combine more data types and introduce new linkability concerns. Privacy research should move beyond policy-text analysis toward data-flow mapping and comparative enforcement outcomes.

Most importantly, auditability is almost absent; this is the gap that distinguishes assurance from the broader security literature. A secure protocol cannot alone demonstrate that controls operated continuously or that retained evidence supports independent review. Even recent smart-contract security work treats auditability as an application property rather than a measurable construct [39]. Wallet research therefore needs explicit control objectives, event-log integrity, and assurance reporting across custodial, mobile-payment, CBDC, and smart-contract environments.

This study mapped 72 Scopus-indexed articles on digital-wallet security assurance published between 2015 and 2025. The evidence shows a recent, interdisciplinary field whose historical influence remains rooted in adoption and trust, while technical work increasingly addresses authentication, crypto-custody, vulnerability detection, fraud, offline payments, and regulatory responsibility. Security is prominent but fragmented across behavioral perceptions, protocol demonstrations, forensic investigations, and governance studies. Auditability is virtually absent as an explicit construct. The proposed control–evidence framework converts this absence into testable requirements for authentication, custody, transaction integrity, fraud monitoring, privacy, and incident governance. Digital-wallet research has therefore moved beyond adoption, but it has not yet established common evidence for demonstrating that controls operate effectively, accountably, and under independent review.

The study is limited to Scopus, English-language articles, and records published through 2025. The specialized query improves precision but may omit studies that use product names or assurance terminology not captured by the equation. Citation counts favor older publications; country extraction depends on affiliation metadata; and keyword clustering is sensitive to author terminology and the frequency threshold. Dictionary-based coding is transparent and reproducible but cannot replace independent content analysis. Future research should validate the categories through independent coders, semantic models, or embedding-based techniques and should test the proposed evidence categories against actual wallet architectures, incidents, and regulatory regimes. Title-and-abstract screening was conducted collectively by all seven authors rather than through independent duplicate screening; consequently, no inter-rater agreement statistic was calculated. Country-level findings use full rather than fractional counting, which may modestly overstate the productivity of countries whose publications disproportionately involve multinational teams. Because the recent sub-period (2023–2025) is markedly shorter than the early sub-period (2015–2022), the thematic comparison is exploratory. Within-period shares account for differences in corpus size but do not eliminate the imbalance in temporal coverage. Future studies with a longer post-2023 window should test these patterns using matched equal-length periods, rolling averages, alternative cut-off years, or trend regression of annual thematic shares. A systematic abstract-level search for auditability-related terms across all 72 abstracts, followed by manual verification, is also needed.