11 March 2017

Hafiz Adewuyi

GTBank 737 USSD simple banking's recently introduced PIN authentication is misleading

From inception, the sole means of authenticating your transactions on GTBank's USSD banking (popularly known as Bank 737 or Simple banking) has been the last 4-digits of your debit card number (PAN). Over time, this has gotten a lot of criticism from security analysts as well as security savvy customers, on the basis that the 'PIN' was not a private number which by worldwide standards, is expected to live solely in the owner's memory.

Well, many years after, the almighty GTBank finally decided to respond to these concerns this February. A few weeks back, GTBank introduced actual PIN authentication to their 737. The publicity for the new feature reads:

"Simple Banking just got more SECURE. You now require a 4-digit PIN to complete your 737 transactions"
Read on to find out why I highlighted "require" in the above phrase.

The process of creating a PIN is commendably straightforward:

  • Dial *737*5#
  • Input the last 6 digits of your Debit card number
  • Create your 4-digit PIN

GTBank 737 Simple Banking - How to create a 4-digit USSD banking PIN
GTBank 737 Simple Banking - How to create a 4-digit USSD banking PIN

Digressing a bit for some background

I generally spend my weekends on creative pursuits and of recent, one of the things which my mind obsesses over is how to make Fidelity Bank's 770 USSD banking (also known as Instant banking; who copied who) more valuable to the bank's customers. Spurred by the excitement of the ideas streaming through my mind, I set out for the office as early as 8 a.m. this morning when I would normally still be trying to catch up on all the sleep I lost during the week. My office is my favourite place to be on a Saturday when I want to be useful. Great air-conditioning, great lighting and zero power and human interruptions make for pure paradise for a creative person.

After having two cups of milky Nescafe breakfast within a space of one hour and reading several random articles online, I finally set out to get creative on Fidelity Bank 770. With GTBank having reached heights that make the phrase "GTBank and others" pretty agreeable, I naturally tend to look to their simple banking to see if there's anything new I can copy. So I dialled *737# and as soon as the menu came up, I got the idea to do one potentially self-flattering test.

While building Fidelity bank 770, I did a lot of unnecessary, howbeit nifty things, one of which I got the idea to test for on GTBank 737. Generally, in Nigeria's USSD banking systems (including Fidelity Bank and GTBank's), a customer can buy airtime for their own phone without any authentication. Ergo, there are two Airtime options on the GTBank 737 menu:

  • Airtime - Self
  • Airtime - Others

GTBank 737 and Fidelity Bank 770 USSD airtime recharge options: Self and Others
GTBank 737 and Fidelity Bank 770 USSD airtime recharge options: Self and Others

If you choose the "Self" (GTBank) or "This phone" (Fidelity Bank) option, you will not need to enter your phone number as the bank already has it from the moment you dialled the shortcode. Also, as I mentioned earlier, the transaction is PIN-free. However, if you choose the "Others" option, you will be required to authenticate the transaction with a PIN, to ensure your frenemies don't convert your phone into a makeshift business centre when they're broke.

The nifty thing which I did while building Fidelity 770 Instant banking was to include some sceptical logic behind the recharge another phone option. This logic screens the phone number which the user supplied (as "other") and if it finds the phone number to be the same as that which initiated the USSD transaction, it will make your phone shout out loud: Pinnochio then the no PIN rule for self-recharge overrides the PIN required rule for other-recharge. Quite nifty, innit? When my 3rd line manager at the time found out about this algorithm, he said, "Damn! You're just too smart for my liking".  

In truth, that additional consideration is absolutely unnecessary, since there is no additional security exposure if you decide to use PIN for an authentication-free transaction. It's just maybe you prefer a stressful life to a stress-free life or you're just bored and have a bit of time to burn typing in your own phone number and a PIN when you don't have to. The only thing the logic does is make the particularly observant user think to himself: 

"Nice one. I think Fidelity Bank really pays attention to detail".

Now, the test idea I got was to see if GTBank 737 had this nifty consideration as well, which of course I did not expect to be the case. I entered my own phone number after selecting the Airtime-Others option and voilà, the next page asked me to enter my 4-digit PIN or the last 4-digits of my card PAN! GTBank 737 0 - 1 Fidelity Bank 737.

GTBank 737 "Enter PIN or the last 4 digits on your GTBank debit card to Top Up"
GTBank 737 "Enter PIN or the last 4 digits on your GTBank debit card to Top Up"

Back to the subject

The highlighted phrase at the end of the previous paragraph brings us back to the point of this post. A natural assumption which I made after selecting my 4-digit PIN last week, was that by doing that, I was protecting my USSD account from getting hacked by anyone who had access to my phone and my debit card. Hence, my surprise when I saw that I still had the option to use the 4-digit card number which the PIN was supposed to wipe out.

What I need right now is for someone to explain to me exactly how increasing the number of options I have to authenticate my transactions while still leaving a vulnerable one intact made "GTBank Simple banking just get more secure".

Finally, who is deceiving who when you require not 4 but 6 PAN digits to create a PIN. But then anyone can still use only 4 PAN digits to debit my account, even after I've set my PIN and been led to believe that to hack my account without this PIN, they would need up to 6 digits of my PAN in order to reset my PIN. Now, I know that after all my trouble, the resultant security effect of setting a PIN on my GTBank 737 USSD account is zero

Convenience wise, it's nice because if my 4-digit PIN leaks out of my memory, I can take a quick peek at my card and proceed with the transaction. However, marketing the new feature as a security enhancement is a sheer misnomer.

I suspect that this fact did not go over the heads of the smart people at GTBank. Instead, I believe that GTBank left the 4-digit PAN option in place intentionally. Introducing PIN authentication makes it seem like you've tightened the security of your system and as such, you can tick off some boxes on regulatory compliance. However, you know at the back of your mischievous mind that the ease-of-use which implementing PIN-only authentication would remove, is still very much in place, howbeit masked behind your introduction of PIN.

Nice one GTBank, very thinking. No wonder your Y-O-Y profits keep growing by leaps and bounds, despite the persistent recession in Nigeria, the country which holds your major operations. Please don't vex and take this article personal o, because I'm still planning to apply and come and join to share all those billions.

Honestly, in spite of this article, I still think GTBank is an awesome organisation, as they're the cynosure of all eyes, including those of their peers in the banking business. I'm just being an attention seeking whore by writing this article. If I were much wiser, I would have obeyed the Yoruba adage which goes:
"Bójúrí, ẹnu á dákẹ́" (shut up except absolutely necessary)

Subscribe to this Blog via Email :