Simple and Practical Receipt Authentication for Branchless Banking

Branchless banking has become a key mechanism for enabling financial inclusion in the developing regions of the world. A fundamental requirement of all branchless banking systems is a mechanism to provide reliable evidence to users about the occurrence of transactions, which is implemented in the form of receipts delivered after every transaction. Existing receipt delivery mechanisms (normally implemented using SMS or paper) provide no security guarantees to users and in multiple events in the recent past, attackers have used fake receipts to compromise systems, resulting in significant financial losses to service providers. In this paper, we propose a simple and practical protocol to enable users to authenticate transaction receipts in branchless banking systems. Our protocol makes novel use of missed calls (sent from users to the bank) to enable users to distinguish real receipts from spoofed ones and can be implemented on any mobile phone, without requiring software installation. Besides preventing spoofing attacks, the protocol enjoys significant advantages of usability, cost and deployability, which make it a more practical choice than other (more secure) schemes. We also discuss ways to use missed calls to mitigate man-in-the-middle attacks during money transfer transactions. We position our exposition in the context of an active branchless banking provider in India named Eko India Financial Services Limited. Our protocol design was informed by numerous interactions with the providers and the users of Eko, and we are working towards a deployment with them.