With the current cashless policies being implemented in Nigeria and unreliable banking systems to meet the huge demand in transfers and other virtual services. Can't a reliable fintech company or app be developed to counter unreliable bank transfers that can take hours or even days before transfers ?

Obasempiree:
With the current cashless policies being implemented in Nigeria and unreliable banking systems to meet the huge demand in transfers and other virtual services. Can't a reliable fintech company or app be developed to counter unreliable bank transfers that can take hours or even days before transfers ?

They're tons of this types of apps now?

Normal bank apps themselves are instant.

Obasempiree:
With the current cashless policies being implemented in Nigeria and unreliable banking systems to meet the huge demand in transfers and other virtual services. Can't a reliable fintech company or app be developed to counter unreliable bank transfers that can take hours or even days before transfers ?

The problem is not the scarcity of good apps.

There is even a glut of fintech apps in Nigeria at the moment.

The problem is the infrastructure on which they are built on.

For banks, a lot of them have old core banking deploys that the fintech apps need to interact with via APIs. Some of them are not scaled to handle hundreds of thousands of requests at a time.

Apart from core banking, there are other middle-wares that need to sign off every transaction. Authentication, fraud prevention, money laundering….

Now add the third party services that the server needs to interface with to process the transaction. Cards, Settlements, Other banks, etc

Now, if any of this points create a hotspot (due to bad codes, bad network, timeouts etc), you have dropped transactions.

If you build the best fintech app in the world today and you bring it to Nigeria, you would need to account for what happens when third parties fail.

truthCoder:


The problem is not the scarcity of good apps.

There is even a glut of fintech apps in Nigeria at the moment.

The problem is the infrastructure on which they are built on.

For banks, a lot of them have old core banking deploys that the fintech apps need to interact with via APIs. Some of them are not scaled to handle hundreds of thousands of requests at a time.

Apart from core banking, there are other middle-wares that need to sign off every transaction. Authentication, fraud prevention, money laundering….

Now add the third party services that the server needs to interface with to process the transaction. Cards, Settlements, Other banks, etc

Now, if any of this points create a hotspot (due to bad codes, bad network, timeouts etc), you have dropped transactions.

If you build the best fintech app in the world today and you bring it to Nigeria, you would need to account for what happens when third parties fail.

Great analysis, maybe there will be a genius Fintech that will come up with ways to develop highly adaptable high performance apps for the Nigerian market..

tensazangetsu20:
Normal bank apps themselves are instant.

If it's the same bank I might agree like access bank I know of but most inter bank transfers are far from instant.

GREATIGBOMAN:



They're tons of this types of apps now?

Most still have serious down time, I mean something highly reliable.

Obasempiree:

Most still have serious down time, I mean something highly reliable.

U can't totally eliminate downtime sha.

Even ATMs still has downtime.

As long as there's much traffic they'd always be some downtime....

Also most of the apps and even bank apps use third party services

Unless you'd find a way to make your app independent of any third party service (Good luck with this)

But u never can tell, maybe u have ideas how to go about what you're thinking.


Even Crypto exchange still has downtime with block confirmations.

Problem is no bank will give your traffic a higher priority within their own server or at their own gateway and you guys get to share other gateways equally in terms of access.

Obasempiree:
With the current cashless policies being implemented in Nigeria and unreliable banking systems to meet the huge demand in transfers and other virtual services. Can't a reliable fintech company or app be developed to counter unreliable bank transfers that can take hours or even days before transfers ?

Let me tell you something you didn't realize.

One of the questions Y combinator usually asks founders when applying to their accelerator is ; " why is how the best time to build this business idea"

Based on your post, it seems you have the perfect idea opportunity to build a money transfer service now.

Here's a free idea for you in conjunction with your post.

Why don't you think of building a USSD money transfer service. Something like MTN Momo.

Users can create bank account, deposit funds into their accounts and transfer money from their accounts using just USSD.

A full USSD bank account just using USSD dialingrequest.

Bloomsbury:


Let me tell you something you didn't realize.

One of the questions Y combinator usually asks founders when applying to their accelerator is ; " why is how the best time to build this business idea"

Based on your post, it seems you have the perfect idea opportunity to build a money transfer service now.

Here's a free idea for you in conjunction with your post.

Why don't you think of building a USSD money transfer service. Something like MTN Momo.

Users can create bank account, deposit funds into their accounts and transfer money from their accounts using just USSD.

A full USSD bank account just using USSD dialingrequest.

Very good suggestion, but won't this require serious capitalization and license before launch?. It will also require extensive testing that can take at least a year for approval. The main issue is not even with third party apps but banks , if a bank has a downtime in their system definitely the third party apps will not process or delay in processing its transaction.

Obasempiree:

Very good suggestion, but won't this require serious capitalization and license before launch?. It will also require extensive testing that can take at least a year for approval. The main issue is not even with third party apps but banks , if a bank has a downtime in their system definitely the third party apps will not process or delay in processing its transaction.

Plus USSD is highly insecure

Bloomsbury:


Let me tell you something you didn't realize.

One of the questions Y combinator usually asks founders when applying to their accelerator is ; " why is how the best time to build this business idea"

Based on your post, it seems you have the perfect idea opportunity to build a money transfer service now.

Here's a free idea for you in conjunction with your post.

Why don't you think of building a USSD money transfer service. Something like MTN Momo.

Users can create bank account, deposit funds into their accounts and transfer money from their accounts using just USSD.

A full USSD bank account just using USSD dialingrequest.

Isn't this 1000% already in existence

GREATIGBOMAN:


Isn't this 1000% already in existence

It has been in existence since o.

As airsaylongcome said earlier, it us highly insecure.

You would need extra funding for losses that you would incur through “local wire”.

I am building a fintech startup at the moment but not along these dynamics. Unfortunately, due to the simple reason that there are people smarter than me here and possibly better funded, I cannot disclose the USP.

truthCoder:


It has been in existence since o.

As airsaylongcome said earlier, it us highly insecure.

You would need extra funding for losses that you would incur through “local wire”.

I am building a fintech startup at the moment but not along these dynamics. Unfortunately, due to the simple reason that there are people smarter than me here and possibly better funded, I cannot disclose the USP.

USSD and SMS are two pieces of rubbish that should never have been used in any banking or financial solutions. The level of insecurity in them is mind bending. My bachelors final year project was about developing a software to encrypt SMS messages. Interesting time that was. I learned how to build a ‘fake’ BSS to compromise people’s phones and prove that indeed SMS was highly insecure. This was when we all ran “Java” and Symbian phones. Omo, Nokia SDK suffer for my hand that year sha

truthCoder:


It has been in existence since o.

As airsaylongcome said earlier, it us highly insecure.

You would need extra funding for losses that you would incur through “local wire”.

I am building a fintech startup at the moment but not along these dynamics. Unfortunately, due to the simple reason that there are people smarter than me here and possibly better funded, I cannot disclose the USP.

I'd love to know why it's insecure

Message me if you're serious I can do it for you,contact us on WhatsApp- +218916628043

GREATIGBOMAN:


I'd love to know why it's insecure

https://medium.com/josue-martins/ussd-top-10-security-risk-for-mobile-payments-bcd64d0a34dc

My research was on 1 and 2.

GREATIGBOMAN:


I'd love to know why it's insecure

No encryption. Sent as plain text over the network.

In addition, there is no MFA (multi factor authentication) and MITA (man in the middle attacks) is possible and easy to implement.

Best use case is for small transactions like airtime recharges or if your business can swallow the risk, small amount transfers

Obasempiree:
With the current cashless policies being implemented in Nigeria and unreliable banking systems to meet the huge demand in transfers and other virtual services. Can't a reliable fintech company or app be developed to counter unreliable bank transfers that can take hours or even days before transfers ?

After reading some comments and doing some research, due to some old legacy banking structures and money transfer systems and API, this won't be easy to achieve ...let's not even talk about the amount of Angel investing it seed rounds you have to raise to bring this fintech idea to market.

But I also noticed a big problem for developers. Coding is hard and sometimes it can be very fustrating when your codes start throwing errors and you can detect what's wrong.

Also a lot of developers have questions regarding the codes they are working with or ask mature software engineers questions regarding a piece of code or software development methodology but can hardly get access to them.

That's why am building a coding an AI CODING ASSISTANT CHROME EXTENSION

How you can use it.

1. For experienced developers

You can ask it to write a code for you to speed up your work and it will produce 100% original code.

You can paste codes and ask it to explain the codes you just pasted or produce documentation for it.

You can paste a code and ask it to detect errors in your code.

You can ask it to produce technical writing on any concept in computer science and it will do just that in second.
2. For beginners to CODING and software development

You can ask it to teach you for instance coding in Python and it will start outputting an interactive lecture between you and it in Python programming or any language you ant to learn.

You can ask it to explain any hard concept or code you come across and it will start explaining it for you.

I want to make it more available to everyone so it will cost just $10/mo to use the chrome extension... Everything the AI will do is 💯 Original work.

I hope this becomes a welcome development in Nigeria Sha...my people sometimes hardly appreciate something of their own lol....

Would love to hear your reviews on this software am building

truthCoder:


No encryption. Sent as plain text over the network.

In addition, there is no MFA (multi factor authentication) and MITA (man in the middle attacks) is possible and easy to implement.

Best use case is for small transactions like airtime recharges or if your business can swallow the risk, small amount transfers

If man in the middle attack is very easy.

Why isn't there more USSD based scams and hacks? At least Ij Nigeria.

Not talking about the one where a scammer steals your SIM card and reset your bank details to transfer your money.


I mean the real hacks done by a hacker on multiple sims or USSD based device

I want to learn more

airsaylongcome:


https://medium.com/josue-martins/ussd-top-10-security-risk-for-mobile-payments-bcd64d0a34dc

My research was on 1 and 2.

Alright thanks

GREATIGBOMAN:


If man in the middle attack is very easy.

Why isn't there more USSD based scams and hacks? At least Ij Nigeria.

Not talking about the one where a scammer steals your SIM card and reset your bank details to transfer your money.

I mean the real hacks done by a hacker on multiple sims or USSD based device

I want to learn more

As i said earlier, communication between the user’s phone and the service provider is unencrypted.

The attacker can use a fake base station or cell tower to intercept the session and modify the transaction.

Once the user has your pin, they can complete transactions on your behalf.

To attack, it costs money to buy network spoofing equipment and the attacker needs to be patient enough to know when the potential victim is ready to initiate a ussd transaction.

This is why such attacks are minimal.

Ussd service providers are basically using security through obfuscation and banking on the premise that attack costs are higher than potential losses.

This is why such attacks are not common. It doesn’t imply they are not possible.

truthCoder:


As i said earlier, communication between the user’s phone and the service provider is unencrypted.

The attacker can use a fake base station or cell tower to intercept the session and modify the transaction.

Once the user has your pin, they can complete transactions on your behalf.

To attack, it costs money to buy network spoofing equipment and the attacker needs to be patient enough to know when the potential victim is ready to initiate a ussd transaction.

This is why such attacks are minimal.

Ussd service providers are basically using security through obfuscation and banking on the premise that attack costs are higher than potential losses.

This is why such attacks are not common. It doesn’t imply they are not possible.

It’s not so expensive to to build and deploy BSS/BTS these days o. With the right software (I don’t want to mention two readily available ones) and small technical know how you can build one in no time. Now think about a MITM attack in a location where it is known that mobile internet is almost non existent and people there use USSD as primary means of banking transactions. Carnage. Yes it is a very targeted attack. But as long as it’s possible, it’s very high risk

Obasempiree:

Great analysis, maybe there will be a genius Fintech that will come up with ways to develop highly adaptable high performance apps for the Nigerian market..

As long as the third party (bank) fail, you are still left with the same problem.


It’s just a rabbit hole. Our banks and CBN are the problem.

PPIA:

As long as the third party (bank) fail, you are still left with the same problem.


It’s just a rabbit hole. Our banks and CBN are the problem.

Sad and people won't fully diverse to virtual banks from end to end. U are very correct as far as a sending or a recieving end is affiliated with a Nigerian bank there will always be a problem.

airsaylongcome:


It’s not so expensive to to build and deploy BSS/BTS these days o. With the right software (I don’t want to mention two readily available ones) and small technical know how you can build one in no time. Now think about a MITM attack in a location where it is known that mobile internet is almost non existent and people there use USSD as primary means of banking transactions. Carnage. Yes it is a very targeted attack. But as long as it’s possible, it’s very high risk

You are more of cyber security expert.

GREATIGBOMAN:


If man in the middle attack is very easy.

Why isn't there more USSD based scams and hacks? At least Ij Nigeria.

Not talking about the one where a scammer steals your SIM card and reset your bank details to transfer your money.


I mean the real hacks done by a hacker on multiple sims or USSD based device

I want to learn more

You're right. Such attacks are not common in Nigeria. Theoretical knowledge is different from practical demonstration. There are other types of USSD scams but haven't got many reports of on path attacks.

airsaylongcome:


It’s not so expensive to to build and deploy BSS/BTS these days o. With the right software (I don’t want to mention two readily available ones) and small technical know how you can build one in no time. Now think about a MITM attack in a location where it is known that mobile internet is almost non existent and people there use USSD as primary means of banking transactions. Carnage. Yes it is a very targeted attack. But as long as it’s possible, it’s very high risk

The USSD mechanism has different security lapses but I don’t see the on path attack as easy as you stated. As greatigboman pointed out, it’s not been used in Nigeria for the following reasons.

The BTS you’re purchasing has many limitations. One of them is range, it can also be detected on networks.

The attacker will need knowledge of electronics and telecoms. Knowing how to make certain adjustments and tweaking, understanding Air interface, Abis Interface.

There is an end-to-end encryption over VPN that uses SSL or TLS to secure communication since 2017.

USSD is encrypted for mobile transactions. So, the attacker will need to understand decryption techniques and rainbow tables.

If there’s an incident, the device is blacklisted, and you go again to buy another device and change location. The same location may not work for your new device.

Even if an attacker succeeds, the investment to reward ratio is low and he also needs to cover his tracks.

In the past 5 years how many reports of such attacks have you heard of?

truthCoder:


It has been in existence since o.

As airsaylongcome said earlier, it us highly insecure.

You would need extra funding for losses that you would incur through “local wire”.

I am building a fintech startup at the moment but not along these dynamics. Unfortunately, due to the simple reason that there are people smarter than me here and possibly better funded, I cannot disclose the USP.

Your USP is what sets your business apart, if it is truly unique getting funds will not be an issue.

studyless123:


The USSD mechanism has different security lapses but I don’t see the on path attack as easy as you stated. As greatigboman pointed out, it’s not been used in Nigeria for the following reasons.

The BTS you’re purchasing has many limitations. One of them is range, it can also be detected on networks.

The attacker will need knowledge of electronics and telecoms. Knowing how to make certain adjustments and tweaking, understanding Air interface, Abis Interface.

There is an end-to-end encryption over VPN that uses SSL or TLS to secure communication since 2017.

USSD is encrypted for mobile transactions. So, the attacker will need to understand decryption techniques and rainbow tables.

If there’s an incident, the device is blacklisted, and you go again to buy another device and change location. The same location may not work for your new device.

Even if an attacker succeeds, the investment to reward ratio is low and he also needs to cover his tracks.

In the past 5 years how many reports of such attacks have you heard of?

So my knowledge in these techniques is dated. 2005 when I had to build a proof-of-concept. We attacked the UE/BTS connection which was unencrypted at the time (has this changed?) Perhaps they have tightened it.

Now you are going to make me get one of those OSS BTS solutions and maybe try some techniques. You are right though. The aim of security is not to make it 100% impenetrable. It’s to increase the cost of penetration versus the benefit