Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In this interview with Bill Gates and Bill Clinton, they discuss their work with Digicel, who I assume is this company, to enable mobile banking with normal KYC protections.

This site is full of exploits for SMS phones, and so I can't conceive of it being secure enough to handle banking transactions... yet it seems to be working with a number of people.

How can SMS banking possibly be used for finance when there are so many security issues with the technology?

  • Am I simply overestimating an adversary's competence and power?

  • Or am I overlooking mitigations that would put the odds on my side?

share|improve this question

1 Answer 1

I read both articles and didn't see SMS banking mentioned anywhere. NFC, Mobile Internet, etc... not sms. So I did a bit more digging and found items such as: SMS Banking - Top Up via SMS which do discus sms and digicel.

Lets be clear, sms is not in any way, shape or form secure.

But from the articles I've found thus far, you can't do very much through sms. Most possibilities include checking balances and mundane things like that. The only possible transaction I've found is the ability to add money to a TopUp account from an already setup/linked Visa/Mastercard/etc. So yes, one could move money from one account you have to another account you have through sms. Not much of an attack vector. You'd have to compromise the TopUp acct/card/phone as well, so if you had your wallet/purse/phone stolen you'd be at a high risk. But one is normally at a high risk when these items are stolen.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.