Author
Finance • Dec 19, 2025
5 min read
USSD Banking, A Risk-Based Perspective Aligned with ISO/IEC 27001:2022
In many markets, USSD-based mobile banking solutions are adopted as a means to advance financial inclusion, enabling access to basic banking services without the need for internet connectivity or smartphones.
While these solutions are undeniably simple and cost-effective, their alignment with recognised information security management standards requires careful and objective evaluation, particularly within regulated financial environments.
The typical USSD authentication model relies on two primary elements:
In SIM swap scenarios, transaction confirmation mechanisms that rely on the same communication channel, such as SMS, USSD-based OTPs or voice calls, do not constitute independent controls.
From an ISO/IEC 27001:2022 standpoint, this creates control dependencies that significantly reduce overall effectiveness.
For users limited to feature phones, physical hardware tokens remain the only truly independent second factor capable of mitigating this risk. However, they introduce additional operational cost, distribution challenges and lifecycle management complexity, often conflicting with financial inclusion objectives.
Experience from large-scale deployments, including M-Pesa, confirms that SIM swap fraud is a material and recurring risk, with measurable financial, operational and consumer protection implications.
As smartphone adoption increases, including in emerging markets, more robust, auditable and proportionate security control frameworks become feasible.
The NEARSOFT Digital Banking Platform is developed and operated by NEARSOFT, an organisation certified under ISO/IEC 27001:2022, supported by a formally implemented and externally audited Information Security Management System (ISMS).
Within this framework, the platform is designed with:
Financial inclusion remains a strategic priority. However, under ISO/IEC 27001:2022, inclusion mechanisms must be supported by documented risk assessment, appropriate control selection and continuous improvement.
As connectivity improves and smartphone penetration continues to grow, regulators and financial institutions have a clear opportunity to progressively transition from SIM-centric models to device-trusted, cryptographically protected digital channels, without excluding underserved populations.
The NEARSOFT Digital Banking Platform demonstrates that:
While these solutions are undeniably simple and cost-effective, their alignment with recognised information security management standards requires careful and objective evaluation, particularly within regulated financial environments.
The USSD Authentication Model
The typical USSD authentication model relies on two primary elements:
- a mobile number registered with the telecom operator.
- a numeric PIN entered by the user.
Key Security Risks in a USSD Context
- Confidentiality of authentication information: PINs are entered in plain text and may be observed, conflicting with the principle of protecting sensitive information.
- Reliance on SIM possession: SIM swap and SIM cloning attacks undermine identity assurance and access control mechanisms.
- Lack of asset binding: the absence of device-level trust weakens logical access controls.
- Single-factor dependency: compromise of a single factor can result in full account compromise, increasing residual risk.
- Absence of end-to-end encryption: exposure of data within third-party telecom infrastructures challenges confidentiality and integrity requirements.
Transaction Authorisation and Control Effectiveness
In SIM swap scenarios, transaction confirmation mechanisms that rely on the same communication channel, such as SMS, USSD-based OTPs or voice calls, do not constitute independent controls.
From an ISO/IEC 27001:2022 standpoint, this creates control dependencies that significantly reduce overall effectiveness.
For users limited to feature phones, physical hardware tokens remain the only truly independent second factor capable of mitigating this risk. However, they introduce additional operational cost, distribution challenges and lifecycle management complexity, often conflicting with financial inclusion objectives.
Experience from large-scale deployments, including M-Pesa, confirms that SIM swap fraud is a material and recurring risk, with measurable financial, operational and consumer protection implications.
The NEARSOFT Digital Banking Platform Approach
As smartphone adoption increases, including in emerging markets, more robust, auditable and proportionate security control frameworks become feasible.
The NEARSOFT Digital Banking Platform is developed and operated by NEARSOFT, an organisation certified under ISO/IEC 27001:2022, supported by a formally implemented and externally audited Information Security Management System (ISMS).
Within this framework, the platform is designed with:
- Device binding as a trusted asset: logical access is restricted to registered and validated devices, strengthening access control and mitigating SIM-based attacks.
- Layered and risk-based authentication: multiple authentication factors are orchestrated according to transaction risk.
- Independent authorisation for sensitive operations: critical transactions require controls that are not dependent on SIM ownership.
- End-to-end encryption: ensuring confidentiality and integrity from the client device through to the banking core.
A Risk-Based Path to Sustainable Inclusion
Financial inclusion remains a strategic priority. However, under ISO/IEC 27001:2022, inclusion mechanisms must be supported by documented risk assessment, appropriate control selection and continuous improvement.
As connectivity improves and smartphone penetration continues to grow, regulators and financial institutions have a clear opportunity to progressively transition from SIM-centric models to device-trusted, cryptographically protected digital channels, without excluding underserved populations.
The NEARSOFT Digital Banking Platform demonstrates that: