Practical receipt authentication for branchless banking

Abstract

Although branchless banking systems have spread to different parts of the developing world, methods to ensure transactional security in these systems have seen slower adoption because of a variety of operational constraints. A basic requirement from such systems is the provision of secure and reliable receipts to users during transactions, and recent attacks have demonstrated that existing systems fall short of fulfilling this requirement in practice. In this paper, we propose a simple and practical protocol to enable users to authenticate transaction receipts in branchless banking systems. Our protocol makes novel use of missed calls (sent from users to the bank) to help distinguish real receipts from spoofed ones and can be implemented on any mobile phone, without software installation. Besides preventing spoofing attacks, the protocol enjoys significant advantages of usability, efficiency and cost, which make it a more practical choice than other schemes. We also discuss ways to use missed calls to mitigate man-in-the-middle attacks on branchless banking systems.

The paper slip should be there!

“…From the user's perspective, sending a pull message or two to the bank is likely to be less of a burden than engaging in a conversation with a busy customer-care call center. Furthermore, appropriate use of pull messages can also enhance security of the transaction receipts (thwarting trivial receipt spoofing attacks) as described in [5]. We do not know of any branchless banking system which uses this technique to improve receipt reliability.…”

“…While this study brings out the potential value that digital receipts can bring to transactions in developing countries, it does not address the issue of user perceptions of different receipt forms. Panjwani [5] studies the problem of SMS spoofing in branchless banking and proposes a simple protocol to prevent spoofing of SMS receipts. Our work complements [5] by building a deeper understanding of receipt usability in branchless banking and our design recommendations address the security issues studied in that work.…”

Examining Security and Privacy Research in Developing Regions

“…Although the security and privacy risks due to lack of user awareness are not unique to users in developing regions, they are compounded by low literacy skills, socioeconomic barriers, and infrastructural constraints prevalent in resource-constrained settings. For example, several low-income users of a mobile money service found comfort in receiving SMS-based receipts without realizing that SMS could be spoofed [111]. The rapid adoption of mobile phones in developing regions could be deceptively seen as an indicator that marginalized people are becoming technologically literate.…”

A Mobile Banking Model in the Cloud for Financial Inclusion in India

“…In many cases where SMS receipts are sent to customers to confirm a transaction, customers have to accept paper receipts that are not authorized by the bank but distributed by agents to either make-up for delay in receiving SMS receipts or performing a transaction on behalf of the customer at a later point of time because of the agent's convenience or service unavailability etc. [27]. Agent trustworthiness is an important aspect of the system of branchless banking as it exists today because security measures are still lacking [28].…”