A surprising amount of mobile innovation originated in Africa. Building on pervasive access to mobile phones, the banking industry is being smart about providing phone banking services as just the latest example.
Turning 'problems' into 'opportunities' is a key step in marketing. The banking industry across Africa has faced a range of challenges, some of which obscure the very real market potential behind them.
With extensive uptake of mobile phones across the continent, there was suddenly the chance to realise this potential and resolve issues that have kept African financial services at an almost 19th-century level of technology outside of urban areas.
The reasons why this development was first considered and is still being actively pursued are quite straightforward. The logistics of brick-and-mortar bank branches in many parts of Africa are horrendous. There are definite security issues, the unwillingness of skilled staff to relocate to remote, rural areas and then the frequent or entire lack of reliable communications by post, fixed-line or the Internet.
At the same time, there are enormous numbers of people who are unbanked, not only because of traditional attitudes that encourage mattress banking but also because simply finding a branch to deal with is burdensome or impossible. Some studies put the figure of unbanked people in the region at over 80 percent, a very considerable market of some 400 million potential customers, even calculated on a conservative basis assuming only about half the population are potential customers.
In parallel to this, there is pervasive mobile phone access. From some 1 million phones in 1996, Africa now has 400 to 500 million mobile phones (estimates vary), many of which are used by more than one user. That indicates at least half the region's people have mobile access.
It was an obvious choice to look at ways to bring phone banking to the masses, despite the conservative and risk-averse nature of banking institutions.
Practically all banks across Africa offer mobile banking services and the major banks all do. It is a huge market, even if you subtract the customers who have Internet access or personal access to branches and simply run mobile banking for convenience.
The real challenge, of course, is the fact that most of the potential customers are 2G users and very few have smartphones. The real innovations in Africa have been a matter of meeting that challenge, rather than just introducing and promoting mobile banking for the masses.
While a workable solution can be created using no more than voice and text channels, the real security of 2G GSM technology - as opposed to 3G/CDMA networks and true Internet banking that just uses the mobile phone as a terminal - lies with an obscure protocol known as unstructured supplementary service data (USSD). If you have used callback or balance checking on your phone, using odd entries that begin with an asterisk, those queries have been going directly from your handset to the MNO's servers via USSD. With a little tweaking and some secure integration of the operator?s servers and your bank's servers, USSD can be used as a secure channel for transactions.
Most of the mobile banking solutions use USSD or STK (SIM application toolkit) to create secure, verifiable channels for transactions. Although STK is claimed to be more secure, it has the limitation that changes and upgrades require either that the SIM be exchanged or that the SIM, phone and network is set up to use secure SMS SIM updating.
In Africa and other developing economies, USSD has proved sufficiently secure and robust to underpin mobile banking without having the update problems associated with STK.
A second area which has been a great challenge is authentication, making sure the user really is the right person. This is not a small matter. To take online credit card transaction problems as an example, banks in South Africa report a 77 percent increase for 2011, bringing the fraudulent transaction amount for 'card not present' to around ZAR 140 million (USD 18.5 million) for the year.
The issue is not identifying the phone. That is what a SIM does. The simple-seeming SIM does a few other things as well. It has its own unique serial number (ICCID), the subscriber identity (IMSI), and two passwords (the user PIN and the 'unlock PIN' password or PUK). As far as device identity verification goes, a SIM is a fairly comprehensive solution.
As far as network and system security goes, there is encryption, as with any remote banking solution, and use of secure SMS and TAC (transaction authorisation codes, often called one-time passwords or OTP).
Verifying the actual user is less certain. The standard is to use two-factor authentication, where one factor is something the customer has (like the SIM) and the second is something the customer knows (like the bank PIN or some other password-style datum). This style of authentication is still the most common globally although it has the obvious flaws that the assumed customer may not actually have the SIM (it could be stolen or used by unauthorised persons) and the PIN or password could be compromised where insiders in the system have leaked the information.
The chances of these happening are small but they do happen. However, what cases that have been made public prove is that auditing fairly rapidly identifies the problem and corrective action happens quickly. As with all security matters, there is no perfect solution that is still user-friendly enough to gain wide adoption, especially among customers who are not experienced with technology.
Mobile banking in many parts of Africa has been a success. It continues to be a necessary and well utilised service in South Africa, the Great Lakes region, Nigeria, Ghana and many francophone countries.
If it is to build on this success, mobile banking needs to be rolled out in countries that are at lower levels of technology and infrastructure maturity. It also has to deal with an unknown but significant number of potential customers who still lack access to mobile phones. These are often the people who are not in a position to take on paid-for services. Global charities and NGOs are playing important roles in this area.
Even so, mobile banking across Africa has already been a surprisingly well-adopted solution that drives economic progress and upliftment of disadvantaged communities.
Date of Publication: 8 June 2012