Mitigating Security Vulnerabilities in Offline USSD Payments in non-Smartphones

This paper addresses security vulnerabilities in Unstructured Supplementary Service Data (USSD) based peer-to-peer (P2P) transactions, which often expose users to social engineering attacks and shoulder surfing due to unmasked Personal Identification Number (PIN) entries. We propose a novel P2P system that integrates unique wallet identifiers and partial PIN entry to mitigate these risks. Validation tests show a significant reduction in unauthorised access through shoulder surfing, with a success rate of just 0.05% under simulation conditions where the failed login throttle was deactivated.Additionally, unique wallet identifiers significantly reduce the risk of social engineering attacks by eliminating the need to exchange personal information during transactions. Furthermore, we explore a voucher-based alternative for P2P money transfers within the USSD framework.Overall, our findings demonstrate that integrating unique wallet identifiers and partial PIN entry methods greatly enhances the security of USSD-based financial transactions, significantly reducing the risk of unauthorised access and social engineering attacks. These security improvements remain within acceptable USSD session timeout thresholds, strengthening user trust and paving the way for broader adoption of USSD-based financial services.