Samsung this week disputed a security researcher's claims that the Korean tech giant's mobile payments system was vulnerable to hacking.

For each transaction, the Samsung Pay app creates a unique digital token that represents the account holder's credit or debit card information. In a research paper prepared for the Def Con hacking conference, security expert Salvador Mendoza claimed that the tokenization process could leave a consumer's financial information vulnerable.

Hackers can exploit the vulnerability by tricking Samsung Pay into reusing a token for multiple transactions, Mendoza wrote. In addition to guessing a token using brute force methods, a hacker could jam the transaction and force Samsung Pay to generate a new token, which he or she could then steal.

The entire process could be completed with little more than a Raspberry Pi and a device called a MagSpoof, which acts as a jammer to confuse a nearby payment terminal, according to Mendoza. Unlike competing contactless payment apps from Apple and Android, Samsung Pay can use the same magnetic strips found in plastic credit cards to complete a transaction.

Samsung did not deny that a hacker could steal its digital tokens, but the company explained that stolen tokens alone are not sufficient to make an unauthorized charge. Samsung Pay checks each transaction against a counter, which tracks the sequence of transactions and determines whether an attempted purchase is older than the last one approved.

The app also requires a secret key, called a cryptogram, in addition to a valid counter check and digital token. These requirements make it unlikely that Mendoza's approach would work in practice. Even if it did, the Samsung Pay app alerts users after each transaction, Samsung explained, making it easy for them to spot and dispute fraudulent charges with their bank.