The Central Bank of Nigeria (CBN) recently issued a revised circular on the regulatory framework for Unstructured Supplementary Service Data (USSD) for financial system in Nigeria. This comes on the heels of numerous fraudulent activities being perpetrated via the platform and the attendant geometric increase in fraud complaints reported. Consequently, and in order to reduce customers' expose to the platform, the CBN set daily transaction limit of N100,000.00 and a transaction cap of N20,000.00 above which a combination of PIN and token (2nd factor authentication) will be required to approve transactions effective June 1, 2018. It further required that customers who want to exceed the N100,000.00 daily limit will execute an indemnity with their Deposit Money Banks (DMBs) accepting responsibility for fraud losses arising from such. DMBs and other stakeholders in the USSD payment ecosystem were also required to take measures to ensure security of the platform by implementing encryption and VPN tunneling at all levels/layers of transaction processing.
We all agree that the USSD platform has over the years gained momentum in its rivalry over other traditional payment channels such as ATM, POS, Online Banking, mobile banking, web payment and mobile money due to its simplicity and low cost. One of the foremost Deposit Money Banks [DMBs] in Nigeria recently celebrated N1trillion [$2.75bn] milestone in transaction volume on the USSD platform alone. This is indicative of the acceptance, penetration and explosion of the USSD platform in the Nigerian payment ecosystem.
In the light of the inherent risk associated with the platform, which are concerns of undue exposure of customers/cardholder information to theft due to lack of end-to-end encryption and the inability of operators at all levels to comply with PCIDSS requirement on the handling of cardholder data, the following questions beg for answers in resolving impasse that could arise from the regulation by the CBN.
Debate has emerged in several quarters that although the CBN intervention in the USSD operations was well intended due to rising cases of fraud and abuse witness in the system and failure of stakeholders to stem the tide, the policy will stiffing transaction volume, discourage users from using the platform and come to hunt the CBN's own financial inclusion policy, which has greatly leveraged the USSD platform for its success so far. Also, the introduction of 2nd factor authentication (token) for transactions above N20,000.00 will be counterproductive. There is an argument that soft token, which banks and other financial institutions have largely sold to its customers will not be practicable on this platform. This I find to be true. Where a user is running USSD session on the same smartphone that hold his/her soft token software, it will be impossible to quit/minimize the USSD session to go generate the soft token code. The phone won't allowed that except where different phones are used for both operations. Hence, hard token will be required and this will require banks to resume massive sale of hard token devices to customers who already have purchased the soft token meaning additional cost to customers and revenue to DMBs. This will eventually lead to a lot of frustrations.
On the other hand, stakeholders in the USSD payment ecosystem has done little to nothing to alleviate the concerns of customers and regulators on the security of the platform. Given the lack of end-to-end encryption in the platform and the risk it portends to the payment channel, there is an expectation that stakeholders (banks, payment service providers, mobile money operators, mobile network operators/Aggregators) could come together to agree and implement common framework to reduce the risk. Aside Banks, payment service providers/switches and Transaction Aggregators who are required by CBN to be PCIDSS certified/compliant, the TELCOs are not obligated to do so despite processing cardholder data via their network. There is also concerns that they could be storing card data in the process hence, the need for end-to-end encryption of the entire process. Remote encryption key technology (HSM) have not been implemented in some of the USSD payment gateways with secure key management practices that will enhance security. Also, radio signals between the users' mobile GSM device and the base switch centre and Master switching centre are not tunneled via VPN. These are gaps stakeholders need to close to alleviate the concerns of CBN and minimize the risk posed by the platform.
Hence, the CBN ought to have consulted widely with stakeholders who operate in the USSD space with a view to come up with a sustainable solution to the concerns identified in the USSD platform. This will ensure a collaborative effort and synergy to fix the issue and ensure a thriving platform for all rather than seemingly unilateral and unsustainable approach of stiffing the platform, which has a potential to drastically slow transaction volume and harm the platform.
(Tech Blogger, Author & Cybersecurity Consultant)
Will appreciate your questions and contributions on this post. For sponsorship, ad placement, speaking opportunity and training bookings, please Contact US or Send us an email at firstname.lastname@example.org.