Mobile Financial Services Fraud ADIL ILYAS

Introduction Any electronic Device that can either STORE, PROCESS or COMMUNICATE can be used to either commission an offense or be used as a target of an Offense. Examples Regular Phones, Smart Phones Computers Storage Devices ( Flash Disk, CDs etc)

Who can commit an offense ? Over 20 million people in Tanzania are connected to Mobile Phone Networks Over 8 million people in Tanzania are connected to the internet, with or without knowledge of their connection state. More than 7% of the population owns a PC Anyone of these can commit an offense Mostly likely they will use the same available technology to facilitate that offense. Practically they have the weapon for offense. We are left out in the dark. Defenseless.

In order to commit the offense MOTIVATION & OPPORTUNITY

MOTIVATORS t FINANCIAL PERSONAL MOTIVATIONS ADVENTURE / POWER HI-TECH

Opportunities 7 YEARS AGO Ally Dar Es Salaam Joanitha Arusha

Opportunities 4 YEARS AGO Ally Dar Es Salaam Joanitha Arusha MPESA

Opportunities 1 YEAR AGO Ally Dar Es Salaam Joanitha Arusha MPESATIGO PESA

Opportunities NOW Ally Dar Es Salaam Joanitha Arusha CRDB BANK NMB BANK MPESA TIGO PESA MPESA OR MOBILE BANKING CARDLESS WITHDRAWO

MFS One of the most rapidly growing services that facilitates money transfer, deposits to the un- banked community. An additional banking channel via mobile phones for the existing banked community in the market. The most common technology to facilitate the service is a Mobile Phone, via USSD.

Regulators BOT Regulates the financial aspects of Mobile Financial Services for both Bank-Led or Non-Bank-Led Service Providers. ( A service provider must be Licensed by TCRA to prequalify to offer MFS Services. ) TCRA Regulates the technological aspect of Mobile Financial Services for both Bank-Led and Non Bank Service Providers.

Service Providers Bank Led CRDB BANK – SIM BANKING NMB BANK – NMB MOBILE Non Bank Led Airtel - Airtel Money Zantel - EazyPesa Vodacom - Mpesa Tigo - TigoPesa

Situational Analysis High Inter-Dependencies between Service Providers for facilitating the services. o Technological o Processes between SPs not very clear. SIM Swapping is a major concern * Until recently efforts taken by TCRA, there were no proper standards. Challenges of Data Handling, in an event of swap. No Automated Technological Methods to Isolate/Block Certain Services. No Strong SLAs between Service Providers as Yet.

How does Fraud Occur Insiders – Misuse of MIS / Assisting on Fraudulent Swaps Poor Swap Process. Social Engineering o Friends & Family o Strangers using IDENTITY THEFT Methods Creating of Fictious Retailers / Wakalas Creating of Fictious Employees to allow Transfers/Approvals Fraud Occurs on both Service Provider Levels and End User Level ( Both get victimized )

Applause to TCRA :- Taking an initiative to call upon all stakeholders to a common place to reach a census on how to reduce MFS Fraud. BOT:- Setting up the new regulations for the MFS Industry. BOT & TCRA: Working together in harmony to reach a common goal. AIRTEL & CRDB: Sharing Data to reduce Fraud during Fraud. MNOs: A Good Response from MNOs to update their swap processes.

Quick Wins FOR BANKS: Use TWO UNIQUE IDENTIFIERS on your systems ( MSSIDN & IMSI ) FOR BANKS & MNOs: Improve SLAs between yourselves to ensure proper service delivery to your consumers. FOR MFS SERVICES PROVIDERS: Educate your consumers, Educate your staff, improve internal processes. Launch Secure Products.

The foreseeable future SMARTPHONE SPYING: It is currently possible to install spyware on smartphones such as IOS – iphones, blackberry, Android Phones, Symbian OS Phones ( Nokia ). These spy apps can collect data such as : - Call Logs, SMS, USSD Strings, Location, Pictures, Passwords etc. USSD HACKS: USSD Security is now solely dependent of GSM Security standards which is A5/1 or A5/2 which is currently comprisable but not to the normal Joe Hacker.

Case Studies Mobile Financial Services – Service Provider Fraud Mobile Financial Services – End User, Bank Led Mobile Financial Services – End User, Non Bank Led