Why mobile money operators get hacked
Mobile money apps are completely different from regular apps. You deal with millions of micro-transactions. You manage complex agent networks. You rely on USSD gateways. You rely on third-party POS machines. Every single connection is a target for organized crime.
Standard security scanners cannot understand a mobile money network. A scanner does not know what an "agent float" is. A scanner does not know how a USSD session works. You need human experts who understand the exact business logic of African payments.
We act like real attackers. We test the deep logic flaws that destroy mobile money operators. We attack the trust between the agent and the central server. We attack the trust between the POS machine and the gateway. We prove exactly how easy it is to steal your float.
The anatomy of an agent float attack
Let us look at a real-world mobile money attack. A mobile money operator has super-agents and sub-agents. The super-agent has a massive cash float. The sub-agent has a tiny cash float.
The sub-agent logs into the mobile app. The sub-agent clicks "Transfer Float". The app sends an API request to the backend server. The request looks like this: `source_account=sub_agent_id&amount=5000`.
The hacker intercepts this request using a proxy tool. They change the `source_account` to the `super_agent_id`. They forward the tampered request to the server. If the server does not verify that the logged-in user actually owns the `source_account`, the server transfers the money out of the super-agent's float.
This is a Broken Object Level Authorization (BOLA) flaw. Scanners never find this. We find it. We test every single endpoint to make sure nobody can touch an account they do not own.
What we test in a mobile money review
We test your entire ecosystem. We test the consumer app. We test the agent app. We test the USSD code. We test the admin dashboard. We cover every angle.
USSD application security
USSD is highly vulnerable. It does not use HTTPS. It does not use complex tokens. It uses short sessions. We test your USSD gateway integration. We test for session hijacking. We see if an attacker can guess a session ID and take over a live transaction. We test your USSD PIN validation. We ensure attackers cannot brute-force a user's PIN code.
Tier limit bypass
Mobile money accounts have strict tiers. A Tier 1 account can only move 50,000 Naira per day. Attackers try to bypass this rule. They run scripts to transfer 1,000 Naira fifty-one times. They test if your server counts the limit correctly. They send massive concurrent requests to see if the database locks properly. We launch these exact race condition attacks to break your tier limits.
POS terminal integration flaws
Agents use physical POS machines to process cards. These machines talk to your server over mobile networks. We intercept that traffic. We try to fake a successful card transaction. We try to manipulate the offline processing mode. If the POS machine approves a transaction offline, we see if we can replay that same transaction twice when the machine reconnects. We test the integrity of your hardware network.
Split payment and commission fraud
Agents earn a commission on every transaction. We attack the commission logic. We see if an agent can split a single 10,000 Naira transfer into ten smaller 1,000 Naira transfers to trick the system into paying ten separate commission fees. We find the logical gaps that drain your revenue.
Admin portal vulnerabilities
Your back office controls everything. A compromised admin account is game over. We attack your admin portal aggressively. We bypass the login screen. We try to steal admin session cookies using Cross-Site Scripting (XSS). We check if an attacker can elevate a basic support agent into a super admin. We lock down your internal tools.
The tools we use to break your platform
We use advanced offensive security tools. We write custom scripts to exploit your specific business rules.
- Burp Suite Professional: We intercept every single HTTP request from your mobile app. We change the data before it hits your server to find BOLA flaws.
- Frida and Objection: We hook into the live memory of your Android app. We bypass SSL pinning. We extract your hidden API keys.
- Custom Python Scripts: We write bespoke Python scripts to attack your tier limits. We send hundreds of concurrent requests to break your database locks.
- Jadx and Ghidra: We decompile your Kotlin and Swift binaries. We read your raw code to find weak encryption algorithms.
USSD session hijacking led to full account takeover
A mobile money operator asked us to test their USSD application. The USSD gateway generated session IDs using a weak, predictable random number generator. The session IDs were only four digits long. An attacker dialed the USSD code from a burner phone. The attacker guessed the session ID of a real customer who was currently making a transfer. The attacker hijacked the session and changed the destination account number. The real customer unknowingly confirmed the transfer to the hacker's account. We proved the flaw in one hour. The operator updated their gateway to use secure, unpredictable session IDs immediately.
The final delivery and remediation process
We do not leave you alone to fix the mess. We give your engineering team the exact tools they need to secure the platform quickly and permanently.
You receive a massive, detailed technical report. We rank every vulnerability by risk level using the CVSS framework. We provide the exact HTTP request logs. We write out the exact steps to reproduce the attack. Your engineers can copy our steps and watch the bug happen on their own screens.
We give you precise code snippets to fix the flaws. We show you how to implement strict server-side validation for all agent floats. We show you how to secure your USSD endpoints. We show you how to enforce robust database row locking to prevent race conditions.
We jump on a video call with your developers. We explain the risks plainly. We answer every single question. After you deploy the fixes, we retest the application to prove the bugs are gone. We issue a clean security certificate.
Regulatory compliance and CBN audits
Mobile money operators face the strictest regulatory audits in the country. The Central Bank of Nigeria (CBN) demands proof that your system is secure. If you fail an audit, you lose your license.
We map every single vulnerability we find to the major compliance laws. We map our tests to the CBN cybersecurity guidelines. We map our tests to the NDPA privacy rules. We map our tests to the OWASP Top 10 standard.
Our Head of Compliance Oversight reviews your final report. We ensure the document satisfies your banking partners, your investors, and your regulators. You prove that you take customer funds seriously. You pass your audits. You operate your network without fear.
Secure your mobile money platform today. Stop hackers from stealing your float.
Book a Security ReviewFrequently asked questions
Do you test USSD application security?
Yes. USSD is a huge target for hackers. We test the USSD gateway. We test the session logic. We find out if an attacker can hijack a session and steal funds using only a basic phone.
How do you test agent networks?
We test the agent float logic. We test if a sub-agent can steal the super-agent's float. We find BOLA flaws in the hierarchy that let agents manipulate commissions and balances.
Do you test for transaction limit bypass?
Yes. Tier 1 accounts have strict transfer limits. We test if a user can split a large transfer into tiny pieces to bypass the daily limit. We test if a user can force a massive transfer through a race condition.
Can you test our point-of-sale (POS) terminal integrations?
Yes. We test how your POS machines talk to your backend server. We attack the offline mode. We intercept the network traffic to see if a merchant can fake a successful card payment.
Does your report map to CBN regulations?
Yes. Mobile money operators face strict CBN audits. We map every vulnerability directly to the CBN cybersecurity guidelines. We help you pass your regulatory audits.