Mo(bile) Money, Mo(bile) Problems: Analysis of Branchless Banking Applications in the Developing World

Bradley Reaves, Nolen Scaife, Adam Bates, Patrick Traynor, and Kevin R.B. Butler

Proceedings of the USENIX Security Symposium, 2015

The first generation of mobile money applications had pervasive vulnerabilities that allow transaction modification and account impersonation.

Abstract

great distances, in order to fuel the engines of industry. These rapid, regular, and massive exchanges have created significant opportunities for employment and progress, propelling forward growth and prosperity in participating countries. Unfortunately, not all economies have access to the benefits of such systems and throughout much of the developing world, physical currency remains the de facto means of exchange. Mobile money, also known as branchless banking, applications attempt to fill this void. Generally deployed by companies outside of the traditional financial services sector (e.g., telecommunications providers), branchless banking systems rely on the near ubiquitous deployment of cellular networks and mobile devices around the world. Customers can not only deposit their physical currency through a range of independent vendors, but can also perform direct peer-to-peer payments and convert credits from such transactions back into cash. Over the past decade, these systems have helped to raise the standard of living and have revolutionized the way in which money is used in developing economies. Over 30% of the GDP in many such nations can now be attributed to branchless banking applications [39], many of which now perform more transactions per month than traditional payment processors, including PayPal [36]. One of the biggest perceived advantages of these applications is security. Whereas carrying large amounts of currency long distances can be dangerous to physical security, branchless banking applications can allow for commercial transactions to occur without the risk of theft. Accordingly, these systems are marketed as a secure new means of enabling commerce. Unfortunately, the strength of such claims from a technical perspective has not been publicly investigated or verified. Such an analysis is therefore critical to the continued growth of branchless banking systems. In this paper, we perform the first comprehensive analysis of branchless banking applications. Through these efforts, we make the following contributions:

Citation (IEEE)

B. Reaves, N. Scaife, A. Bates, P. Traynor, and K. R.B. Butler, “Mo(bile) Money, Mo(bile) Problems: Analysis of Branchless Banking Applications in the Developing World,” in Proceedings of the USENIX Security Symposium, 2015.

BibTeX

@inproceedings{mm15,
  author = {{Bradley Reaves} and Scaife, Nolen and Bates, Adam and Traynor, Patrick and Butler, Kevin R.B.},
  booktitle = {Proceedings of the {USENIX} Security Symposium},
  date = {2015-08},
  title = {Mo(bile) Money, Mo(bile) Problems: Analysis of Branchless Banking Applications in the Developing World},
}