Security and Privacy Considerations for Confirming Payments in Rwandan Mobile Money Systems

Mobile money (MoMo) services let users pay individual merchants or businesses using either a smartphone or a basic phone. They are widely used for commerce in African countries, including Rwanda. To better understand the security and privacy aspects of how Rwandan businesses confirm MoMo payments in practice, we interviewed 30 Rwandan business owners and employees. While MoMo services send payment confirmations over SMS to both senders (customers) and recipients (merchants), we found that merchants often inspect confirmation messages on customers' phones, not their own. The reasons included confirmation messages being sent only to business owners' (not employees') phones, busy markets, phones being physically unavailable, and delayed SMS delivery. Trust also played a major role. As the customer controls their phone, this workaround can enable fraud via screenshots of past messages or spoofed confirmations. As these confirmation messages include customers' account balances, participants also reported privacy concerns. In response, we investigated the design space of alternative workflows, finding promise in redesigning customers' confirmation screens to remove private information and to add a secret known only to the merchant. We reflect on designing for security and privacy under the unique constraints of Sub-Saharan Africa.