The developed world takes universal cashless payment systems for granted. From credit cards and online banking to massive scale business-to-business transactions, our modern economy is reliant on regular and instantaneous movement of funds. And for the most part, transactions are secure and customers are safe from electronic fraud. But can the same be said of the systems in developing countries?
Mobile money offers tremendous promise to enable financial inclusion in the global south, where in many countries more people have a mobile phone than a bank account. These systems have been viewed as an improvement to physical security because customers no longer need to carry large amounts of currency or travel long distances to make payments. However, little attention has been paid to whether these accounts are actually secure and customers’ money is safe, until now.
We recently published a security analysis of mobile money apps in developing countries, focusing on a new wave of branchless banking applications designed for smartphones. First generation SMS-based mobile money apps are already known to be vulnerable to attack inside telecommunication provider networks.
We looked at 46 Android apps from countries including Brazil, India, Nigeria and Thailand focusing on the three most important banking functions: account registration, account login and transaction procedures. Half were found to improperly encrypt their communications, potentially allowing an attacker to steal money.
Our analysis exposed many vulnerabilities. We observed that many applications created their own communications protocols that could allow an attacker to capture account information, impersonate users and steal money with ease. Some of the weaknesses would require an attacker to be physically near their target, whereas others could potentially enable large-scale theft from anywhere in the world.
However, one application (Zuum, from Brazil) did not appear to have these problems, demonstrating that it is possible to build a technically robust mobile money application. This application was built in partnership with Mastercard, which likely helped to provide security experience. Such expertise is unfortunately not available to all application developers.
In many developed nations the onus for preventing and detecting fraud is on financial companies. Unfortunately, all of the applications we looked at assign fraud detection entirely on the user. This is a problem because these users are the least able to absorb the total loss of their funds – the difference between losing the credit in your favourite coffee chain’s application versus the loss of one’s entire life savings. As vulnerabilities continue to evolve in future versions of these applications, users have no assurance that their money is safe, directly threatening the expansion of these transformative systems.
Lack of regulation may also damage trust in mobile money. During our investigation, we discovered only one regulatory document, by the Reserve Bank of India. However, this document offered little in terms of concrete actions in its 12 short pages.
There are numerous challenges and opportunities going forward. Crucial to the success of these systems is genuine cooperation between the technology, policy and NGO communities. Tools to help developers create secure code, a clearing house to certify that applications provide a baseline of protection and laws to better protect users against fraud are necessary, as is keeping the cost of operation low.
We would love to see the developers of these applications fix these problem. For the most serious cases, we reached out to developers and gave them detailed steps they could use. We will be checking the applications again in coming months to see if changes were made.
It is difficult for consumers to do much about this problem. A public education campaign about cybersecurity is needed, but many of the countries affected by this issue lack the infrastructure and literacy rates to facilitate such a campaign.
The mobile money apps we looked at do not provide any meaningful information about the technical details of their security, but the marketing campaigns associated with them claim that they are strong. Our work shows that this is simply not the case.