With all the banks in the country now having Unstructured Supplementary Service Data (USSD) codes for banking transactions, the Central Bank of Nigeria has issued an exposure draft regulatory framework for the use of USSD codes in the country.
USSD are short codes used on mobile phones.
Almost all the banks in the country now have short codes through which customers can transfer cash, check account balances, pay bills, buy airtime and do many other financial transactions.
Customers can also check their BVN numbers via the short codes on their phones.
Report of unauthorised transfers and other fraud had prompted the apex bank to make the move to regulate the use of USSD codes in the financial system.
The regulatory framework according to the apex bank is to ensure that the vulnerabilities in the technology world does not put customers fund at risk.
CBN Director, Banking and Payment Systems, ’Dipo Fatokun, had earlier noted that the apex bank was in discussions with the banks to ensure the safety of customer funds through the USSD baking platforms.
CBN in the exposure draft stated that the vast applications of the USSD technology in terms of available services on mobile phones have raised the issue of the risks inherent in the channel.
“In this regard, concerns have been expressed on the likely exposure of CBN approved entities to the possible breaching of the USSD based financial services in view of likely vulnerabilities in the technology and the ever growing threats,” Fatokun said.
Under the new regulatory framework which is still up for more contributions and comments, the CBN directs that a USSD based financial transaction require end to end encryption to protect the integrity of the financial information.
To this end, it said “all USSD-based financial services shall put in place a proper message authentication mechanism to validate that requests/ responses are generated through authenticated users.”
They are also to ensure that USSD communications channels use strong encryption mechanism and implement masked pin entry.
Also financial service providers are not to use USSD service to relay details of other electronic banking channels to their customers to prevent compromise of other electronic banking channels through the USSD channel.
This means that customers’ information such as their BVN and other baking details would no longer be assessible via USSD codes.
