Mo(bile) Money, Mo(bile) Problems

Abstract

Mobile money, also known as branchless banking, leverages ubiquitous cellular networks to bring much-needed financial services to the unbanked in the developing world. These services are often deployed as smartphone apps, and although marketed as secure, these applications are often not regulated as strictly as traditional banks, leaving doubt about the truth of such claims. In this article, we evaluate these claims and perform the first in-depth measurement analysis of branchless banking applications. We first perform an automated analysis of all 46 known Android mobile money apps across the 246 known mobile money providers from 2015. We then perform a comprehensive manual teardown of the registration, login, and transaction procedures of a diverse 15% of these apps. We uncover pervasive vulnerabilities spanning botched certification validation, do-it-yourself cryptography, and other forms of information leakage that allow an attacker to impersonate legitimate users, modify transactions, and steal financial records. These findings show that the majority of these apps fail to provide the protections needed by financial services. In an expanded re-evaluation one year later, we find that these systems have only marginally improved their security. Additionally, we document our experiences working in this sector for future researchers and provide recommendations to improve the security of this critical ecosystem. Finally, through inspection of providers’ terms of service, we also discover that liability for these problems unfairly rests on the shoulders of the customer, threatening to erode trust in branchless banking and hinder efforts for global financial inclusion.

Computer security for data collection technologies

“…They describe five factors which contribute to these differences, including the prevalence of text message banking and piracy in the developing world. More recently, security researchers have studied apps used for mobile banking in the developing world and found them rife with technical security vulnerabilities ( Reaves et al, 2015 ). While similar problems are present in apps created for and used by people in the developed world, this work echoes the findings of ( Ben-David et al, 2011 ) that the prevalence of these factors in the developing world increases the potential reach of their effects.…”

“…First, it surfaces key computer security threats and opportunities that we believe ODK deployment architects should consider. Second, it expands on other threat modeling work in ICTD (e.g., ( Ben-David et al., 2011 , Corrigan-Gibbs and Chen, 2014 , Reaves et al., 2015 )) and provides a data point for threats that might arise for ICTD applications.…”

“…Areas affected by poverty are frequently the focus of ICTD, but any setting where things like limited connectivity, unreliable power, or lightly skilled personnel conspire to create a unique technological landscape might be relevant to ICTD. Although there have been some efforts to study and address computer security and privacy risks with technologies in an ICTD environment, both on a case-by-case basis for specific technologies and from an academic perspective, e.g., ( Ben-David et al., 2011 , Corrigan-Gibbs and Chen, 2014 , Reaves et al., 2015 ), the space of “computer security meets ICTD” is still in its infancy. We contribute to this space through insights into how to evaluate and address computer security risks in ICTD environments.…”

Understanding Android Financial MalwareAttacks:Taxonomy, Characterization,and Challenges

“…They described in detail the techniques this malware family used and confronted them with current state-of-the-art static and dynamic code-analysis techniques forAndroid applications.Additionally, several authors investigated the holistic security of mobile money applications including mobile banking, mobile wallets, and mobile payment apps. Reaves et al [46] performed a comprehensive analysis of branchless banking applications. They discovered vulnerabilities using the Common Weakness Enumeration (CWE) classification system and showed that six of the seven applications fail to preserve the integrity of their transactions.…”

The Advantages and Analysis of the Location of Branchless Banking in Urban and Rural Areas in Yogyakarta Special Region, Indonesia

“…The development of branchless banking will result in potential benefits to stakeholders in many different forms, such as a program that is more effective for social benefits, an increasing number of payment for electricity and water bills, and a better return for bank loan (Ivatury 2006, Diniz et al 2009, Jayo et al 2012. Branchless banking brings much-needed financial services to the unbanked in the developing world (Reaves et al 2015). Ansong et al (2015), for instance, argue that the disproportionate growth of physical/traditional branch banking leads to disparities in the spatial distribution of bank branches.…”