Pith. sign in

REVIEW 2 major objections 3 minor 130 references

Design and Evaluation of Privacy-Preserving Protocols for Agent-Facilitated Mobile Money Services in Kenya

T0 review · 2 major / 3 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Mobile-money users and agents in Kenya prefer a privacy-preserving KYC protocol that uses biometrics and one-time codes over ID-based checks.

desk verdict Solid usability study with a real contribution; Appendix D's security proof has a genuine gap that needs fixing before publication. read the letter →

arxiv 2412.18716 v2 pith:YA2ZW4TJ submitted 2024-12-25 cs.CR cs.HC

Karen Sowon , Collins W. Munyendo , Lily Klucinec , Eunice Maingi , Gerald Suleh , Lorrie Faith Cranor , Giulia Fanti , Conrad Tucker
show 1 more author
Assane Gueye
This is my paper · ORCID
classification cs.CRcs.HC
keywords mobilemoneyprivacy-preservingKYCbiometricauthenticationagent-facilitatedtransactionsdataminimizationusableprivacyKenyadelegatedwithdrawal
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that privacy-preserving know-your-customer protocols for agent-facilitated mobile-money withdrawals and deposits, in which customers authenticate biometrically to the provider instead of handing their ID to an agent, are preferred by both customers and agents. In role-play and interview sessions with 32 users and 15 agents in Kenya, participants said the new protocols offered better security, better privacy, and more convenient verification, even though most had considered ID-based checks normal. The paper also argues the protocols keep KYC correctness without degrading security: if biometrics work as assumed, an attempted wrong withdrawal fails except with probability at most $2^{-\ell}$ for an $\ell$-bit code. The significance is practical: it offers a path to per-transaction KYC that exposes less personal data to last-mile agents while remaining usable on basic phones.

What carries the argument

The load-bearing mechanism is the redirection of the KYC data flow from agent to provider, coupled with a random, time-limited one-time code. Concretely: after biometric authentication, the provider sends an $\ell$-bit code $c$ and the amount $x$ to both the user and the agent; the code is independent of the user's identity and the agent's side information, and expires after $\Delta$. That independence is what makes the security argument work—any incorrect collector must guess the code, succeeding with probability at most $2^{-\ell}$—and it is the same property used in Proposition 3 to show that the protocol's additional privacy leakage is just $I(U;T \mid V_S)$, the conditional mutual information between user identity and the observed transcript given side information. The delegated variant applies the same machinery to the (sender, collector) pair, so both parties are authenticated to the provider before cash changes hands.

What would settle it

A plausible falsifier would be a field pilot of the proposed withdrawal protocol with a representative Kenyan sample that measures biometric authentication failure rates—fingerprint rejection among manual laborers, voice failure during illness, elderly users unable to complete enrollment—and transaction abandonment. If a nontrivial fraction of legitimate users cannot authenticate and instead revert to ID-based workarounds, or if a spoofing test succeeds against the voice or fingerprint system, the central preference and security claims would lose their foundation.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that moving KYC verification out of the agent's hands—so the provider authenticates the user via biometrics and then issues a time-limited one-time code to both parties—preserves the regulatory function of KYC while reducing what agents see and alleviating a set of long-standing inconveniences. In the proposed withdrawal protocol, a user authenticates by fingerprint or face on a smartphone or by voice on a basic phone, the provider verifies the agent number and sends an $\ell$-bit code valid for a short window $\Delta$ to both user and agent, and the agent dispenses cash only when the code and amount match. For delegated withdrawals, the sender authenticates and designates a collector by phone number; the collector then authenticates and receives their own code, formalizing a process that currently runs on trust and workarounds. The security analysis shows that, under stated assumptions, the protocol fails only with negligible probability in all identified deviation cases, and the privacy analysis bounds the extra information an agent learns to the mutual information between user identity and transaction amount, conditioned on side information—deliberately not cryptographically private because the agent physically sees the customer.

Load-bearing premise

The security guarantees and the usability preference both rest on the assumption that biometric authentication works perfectly: a user can authenticate if and only if they are the rightful owner of the account, with no false acceptances and no false rejections.

Editorial extensions

If this is right

  • If deployed, the withdrawal protocol would stop agents from seeing customers' names, ID numbers, and phone numbers, removing a channel for SIM-card fraud, unsolicited calls, and stalking that participants reported.
  • Delegated withdrawals would become a formal, audited process in which both the sender and the collector authenticate to the provider, reducing the need for users to share PINs or physical IDs with proxies.
  • Removing the ID-presentation step would address a common inconvenience for users and agents, and could help include users who lack physical ID documents, though it would still require a digital identity enrollment.
  • The protocol imposes modest communication overhead—1.5 extra round trips for the base withdrawal—and relies on a code validity window $\Delta$, so deployment would require careful handling of network delays.
  • If the perfect-biometric assumption holds, KYC correctness would be at least as good as the current process, because authentication is performed by the provider rather than by an agent who may rely on imperfect ID checks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Inference: the same one-time-code pattern could transfer to other last-mile KYC settings—such as bank agents, insurance payouts, or government benefits—where a human intermediary must verify identity without seeing documents.
  • Inference: a testable extension is a pilot with a fallback option for users with worn fingerprints or voice changes; the paper's own data (agents citing construction workers and elderly users) suggests biometric failure, not malicious attack, may be the first stress point.
  • Inference: the paper's privacy bound suggests a quantitative follow-up that measures the actual mutual information $I(U;X \mid V_S)$ in a deployed setting to see how much an agent can still infer from amounts and side information.
  • Inference: one gap the paper leaves implicit is that the protocol assumes users trust the provider more than agents; a large-scale survey could test whether that trust survives after a provider data breach.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 3 minor

Summary. The paper designs and evaluates privacy-preserving alternatives to the current KYC process for agent-facilitated mobile money (MoMo) withdrawals and deposits in Kenya. The proposed protocols replace agent-visible ID checks with biometric authentication to the MoMo provider, which then issues a short-lived one-time code to both the user and the agent. A delegated-withdrawal variant authenticates both sender and collector. The authors report a role-play study with 32 users and semi-structured interviews with 15 agents, finding that most participants prefer the new protocols for privacy, security, and usability, while also identifying deployment challenges. The paper includes a formal security and privacy analysis in Appendix D.

Significance. The empirical contribution is valuable and well executed: the study uses a within-subjects role-play design, double-coded transcripts with peer review, native-researcher involvement, and a publicly available dataset. The findings on user and agent preferences for biometric eKYC and on the frictions of ID-based KYC are a useful, concrete input to the design of financial-inclusion-friendly systems in similar contexts. The formal appendix is a more mixed contribution: Proposition 3 is a transparent characterization of leakage, but Proposition 1's security claim does not cover the stolen-after-authentication case that the paper's own threat model names, so the 'better security' assertion in the abstract and Section 6 is not fully established. The flaw is local and fixable rather than destructive of the empirical core.

major comments (2)
  1. [Appendix D, Assumption 1 and Proposition 1] The security proof omits the stolen-after-authentication case that the threat model explicitly names. Assumption 1 states that an honest user may 'lose control of their phone ... during the withdrawal process, between the authentication and the physical withdrawal.' In Proposition 1, however, none of the five sufficient conditions covers this scenario: conditions 1 and 2 require u to still own or control the phone at time t' or throughout [t, t+Δ], condition 3 requires u not to be the account owner, condition 4 requires code expiry, and condition 5 requires an amount mismatch. If the thief takes the phone in (t, t+Δ), the agent's only check—that the code and amount on the presented phone match the agent's SMS—will be satisfied, and the cash is disbursed. Thus the proposition's conclusion that 'incorrect withdrawals ... cannot happen' is false for a failure mode the paper itself identifies, and the claim that the protocols 'offer better security' is not supported for this realistic case. The proof should either add an explicit analysis of the post-authentication theft scenario and a protocol mechanism that prevents it (e.g., re-authentication at cash handover), or the security claim should be narrowed accordingly. The same gap carries over to Proposition 2, whose case 6 ultimately relies on Proposition 1.
  2. [Appendix D, Assumption 2] The perfect-biometric assumption is load-bearing for Proposition 1, case 3, and for the corresponding delegated proof. The paper itself acknowledges demographic bias in biometric systems (Section 3.1) and reports participant concerns about fingerprint failures and hoarse voice (Section 5.3.2), and the protocol for basic phones depends on voice authentication, which is not available on all devices. The proof is correct under its stated idealization, but the abstract's unqualified statement that the protocols 'offer better security' goes beyond what the appendix establishes. Please add a discussion of how false accepts and false rejects affect the security guarantee, and ideally state the security claim in a form that depends explicitly on the biometric system's error rates.
minor comments (3)
  1. [Section 5.3.1] The quote immediately after the phrase 'it will be good for our business as well' is attributed to U3, but the speaker is clearly an agent ('our business'); the identifier should be corrected to an agent participant.
  2. [Section 5.3.2] There is a duplicated word in the sentence 'Both groups also shared concerns with the new processes having many steps'? The text reads 'and and felt that these need to be shared very fast'; the extra 'and' should be removed.
  3. [Section 4.1] The sentence describing the literacy test is slightly ambiguous: 'using a list of menu items on a screen and asking what they would select to: save for their business, identify themselves, and make a phone call to a number not saved on their phone' would be clearer with an explicit list of the menu items and a separate statement of the tasks.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation; empirical preference data are independent and security proofs are explicitly conditional on stated assumptions.

full rationale

The paper's central empirical claim is that users and agents prefer the proposed protocols; this is supported by qualitative data from role-play and interviews, not derived from protocol definitions or fitted parameters. The Appendix D security analysis is conditional on explicitly stated assumptions (perfect biometric authentication, instantaneous network, random codes, uncompromised software); Proposition 1 case 3 explicitly invokes Assumption 2, so it does not pretend to prove biometric security. Proposition 3 is a chain-rule identity for mutual information and is used to characterize leakage, not to predict an outcome from fitted data. There are no fitted parameters whose values are later called predictions. Self-citations [26,46] provide background and motivate design constraints; they are not the sole support for the central preference findings. One genuine weakness is that Proposition 1's sufficient conditions do not cover the threat-model case of an honest user losing the phone after authentication but before cash handover; this is a correctness/security gap, not a circular derivation, so it does not affect the circularity score.

Assumptions & free parameters 0 free parameters · 7 assumptions · 0 invented entities

The protocol's formal guarantees rest on idealized assumptions about biometrics, network, software, and threat model. The empirical preference findings are independent of these axioms. Free parameters are absent because the analysis is qualitative and the formal proofs are probabilistic rather than fitted to data.

assumptions (7)
  • domain assumption The agent is honest-but-curious: the agent follows protocol but tries to infer information about the user.
    Appendix D, Assumption 1. Scopes the threat model; a malicious agent who deviates from the protocol is not considered.
  • ad hoc to paper A user can authenticate themselves via biometrics if and only if they are the rightful owner of the MoMo account.
    Appendix D, Assumption 2. A strong idealization underpinning the security proofs; failures such as spoofing or false rejects are not modeled.
  • domain assumption Protocol messages are transmitted instantaneously between parties.
    Appendix D, Assumption 3. Ignores network delays, which participants raised as a concern (Section 5.3.2).
  • standard math The random code C is generated independently of user identity and agent side information, uniformly over {0,1}^ell.
    Appendix D, Assumption 4. A standard probabilistic assumption required for the negligible-probability arguments.
  • domain assumption Software on all devices (user, collector, agent, MoMo provider) is uncompromised and runs according to protocol.
    Appendix D, Assumption 5. Excludes malware, SIM swap, or phishing that could capture the code or biometric.
  • domain assumption Users trust the MoMo provider more than individual agents.
    Section 3, 'Trust in MoMo providers'. The protocol design assumes this trust asymmetry; the study partially validates it with a slight majority.
  • domain assumption Identity infrastructure exists that enables digital authentication (e.g., biometrics) for both smartphone and basic phone users.
    Section 3, 'Availability of identity infrastructure'. The protocol depends on services like Jitambulishe; the authors note this is realistic but not universally deployed.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Design and Evaluation of Privacy-Preserving Protocols for Agent-Facilitated Mobile Money Services in Kenya." pith.science (2026). https://pith.science/paper/YA2ZW4TJ

@misc{pith2026241218716,
  author       = {Pith},
  title        = {Pith review of: Design and Evaluation of Privacy-Preserving Protocols for Agent-Facilitated Mobile Money Services in Kenya},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YA2ZW4TJ}},
  note         = {Machine review of arXiv:2412.18716}
}
read the original abstract

Mobile Money (MoMo), a technology that allows users to complete financial transactions using a mobile phone without requiring a bank account, is a common method for processing financial transactions in Africa and other developing regions. Users can deposit and withdraw money with the help of human agents. During deposit and withdraw operations, know-your-customer (KYC) processes require agents to access and verify customer information such as name and ID number, which can introduce privacy and security risks. In this work, we design alternative protocols for MoMo deposits/withdrawals that protect users' privacy while enabling KYC checks by redirecting the flow of sensitive information from the agent to the MoMo provider. We evaluate the usability and efficiency of our proposed protocols in a role-play and semi-structured interview study with 32 users and 15 agents in Kenya. We find that users and agents prefer the new protocols, due in part to convenient and efficient verification using biometrics as well as better data privacy and access control. However, our study also surfaced challenges that need to be addressed before these protocols can be deployed.

Figures

Figures reproduced from arXiv: 2412.18716 by the authors.

Figure 1
Figure 1. Withdrawal under the current protocol (left) and the proposed privacy-preserving protocol (right) [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Sample MoMo UIs: Withdrawal acknowledgment [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Current workarounds for proxy withdrawal [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Users interacting with the paper prototypes [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Current and privacy-preserving techniques for depositing money [PITH_FULL_IMAGE:figures/full_fig_p019_5.png]
Figure 6
Figure 6. Figure 6: Collector’s and sender’s side of the privacy-preserving delegated withdrawal [PITH_FULL_IMAGE:figures/full_fig_p019_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

130 extracted references · 78 canonical work pages

  1. [1]

    https://www.safa ricom.co.ke/media-center-landing/frequentl y-asked-questions/jitambulishe-voice-biome trics

    Jitambulishe – voice biometrics. https://www.safa ricom.co.ke/media-center-landing/frequentl y-asked-questions/jitambulishe-voice-biome trics. (Accessed on 08/25/2024)

    2024

  2. [2]

    How Tala Mobile Is Using Phone Data To Revolutionize Microfinance, 2016

    Susan Adams. How Tala Mobile Is Using Phone Data To Revolutionize Microfinance, 2016. https://www.fo rbes.com/sites/forbestreptalks/2016/08/29/ how-tala-mobile-is-using-phone-data-to-rev olutionize-microfinance/?sh=c3bf17e2a9f2/

    2016

  3. [3]

    Predatory Loan Mo- bile Apps in India: A New Form of Cyber Psychological Manipulation

    Vaibhav Aggarwal, Neha Aggarwal, Barkha Dhingra, Shallu Batra, and Mahender Yadav. Predatory Loan Mo- bile Apps in India: A New Form of Cyber Psychological Manipulation. In Proc. ICETSIS, 2024

    2024

  4. [4]

    Mobile Money, Financial Inclusion and Develop- ment: A Review With Reference to African Experience

    Ahmad Hassan Ahmad, Christopher Green, and Fei Jiang. Mobile Money, Financial Inclusion and Develop- ment: A Review With Reference to African Experience. Journal of economic surveys, 34(4):753–792, 2020

    2020

  5. [5]

    A Decade of Privacy-Relevant Android App Reviews: Large Scale Trends

    Omer Akgul, Sai Teja Peddinti, Nina Taft, Michelle L Mazurek, Hamza Harkous, Animesh Srivastava, and Benoit Seguin. A Decade of Privacy-Relevant Android App Reviews: Large Scale Trends. In Proc. USENIX Security, 2024

    2024

  6. [6]

    Are FinTech lending apps harmful? Evidence from user experience in the Indian market

    Akbar Ali and Vijaya B Marisetty. Are FinTech lending apps harmful? Evidence from user experience in the Indian market. The British Accounting Review , page 101269, 2023

    2023

  7. [7]

    On the possibility of a cash-like CBDC

    Hana Armelius, C.A Claussen, and Isaiah Hull. On the possibility of a cash-like CBDC. https://www.riks bank.se/globalassets/media/rapporter/staff -memo/engelska/2021/on-the-possibility-of-a -cash-like-cbdc.pdf , 2021

    2021

  8. [8]

    Central bank digital currency: The quest for minimally invasive technology

    Raphael Auer and Rainer Böhme. Central bank digital currency: The quest for minimally invasive technology. https://www.bis.org/publ/work948.pdf, 2021

    2021

Show all 130 references
  1. [9]

    Regulators, Mount Up! Analysis of Privacy Policies for Mobile Money Services

    Jasmine Bowers, Bradley Reaves, Imani N Sherman, Patrick Traynor, and Kevin Butler. Regulators, Mount Up! Analysis of Privacy Policies for Mobile Money Services. In Proc. SOUPS, 2017

    2017

  2. [10]

    Sherman, Kevin R

    Jasmine Bowers, Imani N. Sherman, Kevin R. B. Butler, and Patrick Traynor. Characterizing Security and Pri- vacy Practices in Emerging Digital Credit Applications. In Proc. WiSec, 2019

    2019

  3. [11]

    Bulletproofs: Short Proofs for Confidential Transactions and More

    Benedikt Bünz, Jonathan Bootle, Dan Boneh, Andrew Poelstra, Pieter Wuille, and Greg Maxwell. Bulletproofs: Short Proofs for Confidential Transactions and More. In Proc. IEEE S&P, 2018

    2018

  4. [12]

    Let’s talk money: Evalu- ating the security challenges of mobile money in the developing world

    Sam Castle, Fahad Pervaiz, Galen Weld, Franziska Roes- ner, and Richard Anderson. Let’s talk money: Evalu- ating the security challenges of mobile money in the developing world. In ASCD, pages 1–10, 2016

    2016

  5. [13]

    The role of gender in agent banking

    Richard Chamboko, Robert Cull, Xavier Giné, Soren Heitmann, Fabian Reitzug, and Morne Van Der West- huizen. The role of gender in agent banking. Develop- ment Research, 2020

    2020

  6. [14]

    Security anal- ysis of mobile money applications on android

    Hesham Darvish and Mohammad Husain. Security anal- ysis of mobile money applications on android. In Big Data, pages 3072–3078. IEEE, 2018

    2018

  7. [15]

    Information privacy and correlates: an empirical attempt to bridge and distinguish privacy-related concepts

    Tamara Dinev, Heng Xu, Jeff H Smith, and Paul Hart. Information privacy and correlates: an empirical attempt to bridge and distinguish privacy-related concepts. Eu- ropean Journal of Information Systems, 22(3):295–316, 2013

    2013

  8. [16]

    Mobile money for financial inclu- sion

    Kevin Donovan. Mobile money for financial inclu- sion. Information and Communications for development, 61(1):61–73, 2012

    2012

  9. [17]

    Demo- graphic bias in biometrics: A survey on an emerging challenge

    Pawel Drozdowski, Christian Rathgeb, Antitza Dantcheva, Naser Damer, and Christoph Busch. Demo- graphic bias in biometrics: A survey on an emerging challenge. IEEE Transactions on Technology and Society, 1(2):89–103, 2020

    2020

  10. [18]

    Tech Startups Are Flooding Kenya With Apps Offering High-Interest Loans, Feb 2020

    Zeke Faux. Tech Startups Are Flooding Kenya With Apps Offering High-Interest Loans, Feb 2020. https: //www.bloomberg.com/news/features/2020-0 2-12/tech-startups-are-flooding-kenya-wit h-apps-offering-high-interest-loans

    2020

  11. [19]

    Identifying and Verify- ing Customers: When are KYC Requirements Likely to Become Constraints on Financial Inclusion? Technical report, Center for Global Development, 2019

    Alan Gelb and Diego Castrillon. Identifying and Verify- ing Customers: When are KYC Requirements Likely to Become Constraints on Financial Inclusion? Technical report, Center for Global Development, 2019

    2019

  12. [20]

    Singpass app

    Singapore Government. Singpass app. https://app. singpass.gov.sg/. (Accessed on 11/13/2024)

    2024

  13. [21]

    The state of the industry report on mobile money 2024

    GSMA. The state of the industry report on mobile money 2024. https://www.gsma.com/sotir/wp-c ontent/uploads/2024/03/GSMA-SOTIR-2024_Re port.pdf, 2024. [Accessed 12-02-2025]

    2024

  14. [22]

    2.5 billion people around the world don’t have a credit score-here’s why that’s a problem, Aug

    Anna Hecht. 2.5 billion people around the world don’t have a credit score-here’s why that’s a problem, Aug

  15. [23]

    Mobile money: The eco- nomics of M-PESA

    William Jack and Tavneet Suri. Mobile money: The eco- nomics of M-PESA. Technical report, National Bureau of Economic Research, 2011

    2011

  16. [24]

    Overcoming the know your cus- tomer hurdle: Innovative solutions for the mobile money sector

    Kennedy Kipkemboi. Overcoming the know your cus- tomer hurdle: Innovative solutions for the mobile money sector. https://www.gsma.com/solutions-and-i mpact/connectivity-for-good/mobile-for-dev elopment/wp-content/uploads/2019/02/Overc oming-the-KYC-hurdle-Innovative-solutions ...

    2019

  17. [25]

    Verifiable creden- tials in the token economy

    Mary C Lacity and Erran Carmel. Verifiable creden- tials in the token economy. In Blockchains and the Token Economy: Theory and Practice, pages 113–138. Springer, 2022

    2022

  18. [26]

    User Expe- riences with Third-Party SIM Cards and ID Registration in Kenya and Tanzania

    Edith Luhanga, Karen Sowon, Lorrie Faith Cranor, Giu- lia Fanti, Conrad Tucker, and Assane Gueye. User Expe- riences with Third-Party SIM Cards and ID Registration in Kenya and Tanzania. arXiv:2311.00830, 2023

    2023 arXiv

  19. [27]

    Digital divide: Who in africa is connected and who is not

    Libuseng Malephane. Digital divide: Who in africa is connected and who is not. Afrobarometer Report (PDF),

  20. [28]

    Internet users’ information privacy concerns (iuipc): The construct, the scale, and a causal model

    Naresh K Malhotra, Sung S Kim, and James Agarwal. Internet users’ information privacy concerns (iuipc): The construct, the scale, and a causal model. Information systems research, 15(4):336–355, 2004

    2004

  21. [29]

    Exclusion and in- clusion in identification: Regulation, displacement and data justice

    Aaron Martin and Linnet Taylor. Exclusion and in- clusion in identification: Regulation, displacement and data justice. Information Technology for Development, 27(1):50–66, 2021

    2021

  22. [30]

    Mobile money accounts are surging globally, especially in africa and asia - our world in data

    Edouard Mathieu. Mobile money accounts are surging globally, especially in africa and asia - our world in data. https://ourworldindata.org/data-insights/ mobile-money-accounts-are-surging-globall y-especially-in-africa-and-asia , June 2024

    2024

  23. [31]

    A survey on decentralized identifiers and verifiable credentials

    Carlo Mazzocca, Abbas Acar, Selcuk Uluagac, Rebecca Montanari, Paolo Bellavista, and Mauro Conti. A survey on decentralized identifiers and verifiable credentials. arXiv preprint arXiv:2402.02455, 2024

    2024 arXiv

  24. [32]

    Reliability and Inter-Rater Reliability in Qualitative Re- search: Norms and Guidelines for CSCW and HCI Prac- tice

    Nora McDonald, Sarita Schoenebeck, and Andrea Forte. Reliability and Inter-Rater Reliability in Qualitative Re- search: Norms and Guidelines for CSCW and HCI Prac- tice. Proc. CSCW, 2019

    2019

  25. [33]

    Zerocoin: Anonymous distributed e- cash from bitcoin

    Ian Miers, Christina Garman, Matthew Green, and Aviel D Rubin. Zerocoin: Anonymous distributed e- cash from bitcoin. In Proc. IEEE S&P, 2013

    2013

  26. [34]

    The dark side of mobile money: Perspectives from an emerg- ing economy

    Emmanuel Mogaji and Nguyen Phong Nguyen. The dark side of mobile money: Perspectives from an emerg- ing economy. Technological Forecasting and Social Change, 185:122045, 2022

    2022

  27. [35]

    Transaction authorization from Know Your Customer (KYC) information in online banking

    Prakash Chandra Mondal, Rupam Deb, and Moham- mad Nurul Huda. Transaction authorization from Know Your Customer (KYC) information in online banking. In Proc. ICECE, 2016

    2016

  28. [36]

    Desperate Times Call for Desperate Measures

    Collins W. Munyendo, Yasemin Acar, and Adam J. Aviv. “Desperate Times Call for Desperate Measures”: User Concerns with Mobile Loan Apps in Kenya. In Proc. IEEE S&P, 2022

    2022

  29. [37]

    Know-Your-Customer measures: mitigating money-laundering risks in mobile banking transactions

    Hettie-Annette Nel. Know-Your-Customer measures: mitigating money-laundering risks in mobile banking transactions. PhD thesis, North-West University (South Africa), Potchefstroom Campus, 2017

    2017

  30. [38]

    Kenya_preliminary-report_sdg5b1.pdf

    Kenya National Bureau of Statistics. Kenya_preliminary-report_sdg5b1.pdf. h t t p s : //data.unwomen.org/sites/default/files/doc uments/Publications/Kenya_Preliminary-Rep ort_SDG5b1.pdf, 2022

    2022

  31. [39]

    A terminol- ogy for talking about privacy by data minimization: Anonymity, Unlinkability, Undetectability, Unobserv- ability, Pseudonymity, and Identity Management, 2010

    Andreas Pfitzmann and Marit Hansen. A terminol- ogy for talking about privacy by data minimization: Anonymity, Unlinkability, Undetectability, Unobserv- ability, Pseudonymity, and Identity Management, 2010

    2010

  32. [40]

    How platform-user power relations shape algorithmic accountability: A case study of instant loan platforms and financially stressed users in india

    Divya Ramesh, Vaishnav Kameswaran, Ding Wang, and Nithya Sambasivan. How platform-user power relations shape algorithmic accountability: A case study of instant loan platforms and financially stressed users in india. In Proc. FAccT, 2022

    2022

  33. [41]

    Mo (bile) money, mo (bile) problems: Analysis of branchless banking applications.ACM TOPS, 20(3):1– 31, 2017

    Bradley Reaves, Jasmine Bowers, Nolen Scaife, Adam Bates, Arnav Bhartiya, Patrick Traynor, and Kevin RB Butler. Mo (bile) money, mo (bile) problems: Analysis of branchless banking applications.ACM TOPS, 20(3):1– 31, 2017

    2017

  34. [42]

    Pochi La Biashara: Frequently asked ques- tions

    Safaricom. Pochi La Biashara: Frequently asked ques- tions. https://www.safaricom.co.ke/media-cen ter-landing/frequently-asked-questions/poc hi-la-biashara, 2021

    2021

  35. [43]

    Demystifying the misery behind loan apps in india

    Mora Saritha. Demystifying the misery behind loan apps in india. Indian Journal of Finance and Banking, 13(1):104–109, 2023

    2023

  36. [44]

    Zerocash: Decentralized anonymous payments from bitcoin

    Eli Ben Sasson, Alessandro Chiesa, Christina Garman, Matthew Green, Ian Miers, Eran Tromer, and Madars Virza. Zerocash: Decentralized anonymous payments from bitcoin. In Proc. IEEE S&P, 2014

    2014

  37. [45]

    Are our IDs safe in MTN Momo Agents’ hands? — thebftonline.com

    Sedem Segbefia. Are our IDs safe in MTN Momo Agents’ hands? — thebftonline.com. https://theb ftonline.com/2021/04/13/are-our-ids-safe-i n-mtn-momo-agents-hands/ , 2021

    2021

  38. [46]

    The Role of User-Agent Interactions on Mobile Money Practices in Kenya and Tanzania

    Karen Sowon, Edith Luhanga, Lorrie Faith Cranor, Giu- lia Fanti, Conrad Tucker, and Assane Gueye. The Role of User-Agent Interactions on Mobile Money Practices in Kenya and Tanzania. In Proc. IEEE S&P, 2023

    2023

  39. [47]

    Mobile money policy and regulatory handbook 2024

    Rebecca Spriggs. Mobile money policy and regulatory handbook 2024. https://www.gsma.com/solutio ns-and-impact/connectivity-for-good/mobile -for-development/wp-content/uploads/2024/11 /2024-Mobile-Money-Policy-and-Regulatory-H andbook-.pdf, 2024

    2024

  40. [48]

    Kenya: registered mobile money accounts 2021-

    Statista. Kenya: registered mobile money accounts 2021-

    2021

  41. [49]

    Stronger digital voices from africa: Building african digital foreign pol- icy and diplomacy

    Sorina Teleanu and Jovan Kurbalija. Stronger digital voices from africa: Building african digital foreign pol- icy and diplomacy. Technical report, DiploFoundation, 2022

    2022

  42. [50]

    Digital identity guidelines: Identity proofing and enrollment

    David Temoshok, Christine Abruzzi, Yee-Yin Choong, James Fenton, Ryan Galluzzo, Connie LaSalle, Naomi Lefkovitz, and Andrew Regenscheid. Digital identity guidelines: Identity proofing and enrollment. Technical report, NIST, 2024

    2024

  43. [51]

    M-pesa – africa’s leading fintech platform – marks 15 years of transforming lives

    V odafone. M-pesa – africa’s leading fintech platform – marks 15 years of transforming lives. [Online; accessed 2025-01-26]

    2025

  44. [52]

    In- formation privacy concerns: Linking individual percep- tions with institutional privacy assurances

    Heng Xu, Tamara Dinev, Jeff Smith, and Paul Hart. In- formation privacy concerns: Linking individual percep- tions with institutional privacy assurances. Journal of the Association for Information Systems, 12(12):1, 2011

    2011

  45. [53]

    Access to mobile services and proof of identity 2021

    Erdoo Yongo, Christopher Lowe, and Yiannis Theodorou. Access to mobile services and proof of identity 2021. Technical report, GSMA, 2021. A Interview Script - Agents Thank you for participating in our study. We are in the process of testing mobile money transfer processes for ...

    2021

  46. [57]

    Is the process I have just shown to you similar to the current process that customers currently follow when they are withdrawing money?

  47. [58]

    Currently when you register users and when users are using mobile money, how do you know who they are? (probe: What do you use to confirm their identity?)

  48. [59]

    Why is this confirmation important/necessary?

  49. [60]

    How often do you need to verify people’s identity?

  50. [61]

    What do you think about using IDs to authenticate your customers?

  51. [62]

    Is there anything you would change about the authentication process using IDs that you use at the moment? (a) Probe: are there any difficulties or challenges you experience from using physical ID to authenticate mobile money users?

  52. [63]

    What information is contained in the current transaction messages you receive as a summary of the customer’s transaction?

  53. [64]

    Your telco provider wants to change the content of the message you receive about the customer’s transaction by removing unnecessary information. They have come to you to know the following: (a) What information is necessary for your records that you would want to keep in the S...

  54. [65]

    They will follow the process that I have just demonstrated to register and authenticate themselves

    In the new process you have seen, customers will not need to show their ID when transacting. They will follow the process that I have just demonstrated to register and authenticate themselves. (a) What do you think about using such a process where customers authenticate themse...

  55. [66]

    Is there any situation where you think customers would prefer to still use their IDs instead of authenticating themselves this way? Show redacted message and also show what the customer would receive:

  56. [67]

    What do you think of this transaction message that you would receive when a customer transacts? (a) Which message would you prefer? This one or the one you currently get? Why? Proxy-Withdraw Privacy Preserving Process Before showing the proxy-withdraw process, ask:

  57. [68]

    Has any of your customers ever transacted and sent someone else to collect the money? If yes, how do customers normally do this? If no, imagine someone (a child or an adult) comes to your shop and says they have been sent by someone who happens to be your customer who has with...

  58. [69]

    As an agent, is there anything you like or dislike about this process where customers transact away from your kiosk and send other people to collect the money? (a) Is it possible to give money to the wrong person? (b) Have you or another agent ever given money to the wrong per...

  59. [70]

    As an agent, given the option to educate customers on one of these methods, which one would you point them to? Why?

    When customers are sending other people to collect money, they can ei- ther provide the person they are sending or to you specific information about the transaction, or they can use the process I have just shown you. As an agent, given the option to educate customers on one of...

  60. [71]

    Is there anything you like about such a MoMo process where a cus- tomer can send someone else?

  61. [72]

    Is there anything you dislike about it?

  62. [73]

    Are there any challenges you foresee in such a process? Other Questions

  63. [74]

    Are you aware of data privacy laws in Kenya?

  64. [75]

    I will enter my phone number

    (If yes), What are your responsibilities as a mobile money agent as defined by these laws? B Interview Script - Users Introduction Thank you for being here. We are in the process of testing mobile money transfer processes for a new mobile money product called MoMoPesa from a c...

  65. [76]

    What were your impressions of this process? (prompt: what makes it their response) [Researcher’s note: Also ask about any observations that were not addressed through the think aloud: I noticed that. . . ]

  66. [77]

    Was the procedure you just completed similar to the process you would usually follow when cashing out mobile money? (a) (If no) What about it was different? (b) Anything you particularly liked about this process? (c) Anything you did not like?

  67. [78]

    Why do you think you are asked to provide your ID when you transact at an agent?

  68. [79]

    Have you ever been inconvenienced by the need to show your ID when withdrawing mobile money? (If yes) How so?

  69. [80]

    What information do you think the agent receives when you transact using the procedure you just followed? (prompt with: Did the agent receive your name? Your ID? Your phone number? How much money you wanted to transfer?) (a) Is there any situation where you would not want to s...

  70. [81]

    What information do you think is sent to the MoMo provider when you initiate a withdrawal using the procedure you just followed? (a) Is there any situation where you would not want to share any of this info with the MoMo provider? (prompt: what and why?)

  71. [82]

    [Researcher’s note: Show the Swahili or English message depending on what language participant uses for their MoMo]

    Have you seen a sample message the agent gets when you transact? Additional Questions - After Being Shown the Agent Notification I will now show you a sample agent notification message of your just com- pleted transaction. [Researcher’s note: Show the Swahili or English messag...

  72. [83]

    Consider the transaction summary that the agent received. (a) What do you think about it? (b) Did the content of the message surprise you? (c) (If yes) What surprised you? (d) (If no) Why were you not surprised? (e) Would you change the information contained in the message? (f...

  73. [84]

    Is there anything you would change about the process you just used? If yes, what and why? Task 2: Participant Withdraws Using Privacy-Preserving Process Advertisement Material Thank you fake name for completing the first task. Before we move on to the other two tasks, I will s...

  74. [85]

    What did you think of this process? (What makes it their response)

  75. [86]

    Is there anything you liked about this process compared to the process of withdrawing money that you normally follow? (prompt for how e.g., if they say it was more secure)

  76. [87]

    Is there anything you disliked about this process compared to the process that you normally follow? (prompt for how/what e.g., if they say it was difficult to use)

  77. [88]

    If your provider (e.g., Safaricom) offered you a choice between this process and the one you use, which one would you choose? (Why?)

  78. [89]

    Why do you think you did not have to provide your ID when complet- ing the transaction using this process?

  79. [90]

    Why? What makes their option better for you?

    Compared to the previous process where you had to show your ID: (a) Anything you liked about the new process of being identified? (b) Anything you disliked about the new process of being identi- fied? (c) If your provider gave you a choice of using either your ID, or this new ...

  80. [91]

    What information do you think the agent received when you transacted using this process? (prompt: Did the agent receive your name? ID? phone number? How much money you wanted to transfer?) (a) Is there any situation where you would not want to share any of this information wit...

  81. [92]

    What information do you think is sent to the mobile money provider when you complete the transaction using this process? (a) Is there any situation where you would not want to share any of this information with the mobile money provider? (b) (If yes) Which information would yo...

  82. [93]

    Consider the transaction summary that I have just shown you. (a) Did you notice any difference in this message from the one you saw earlier? (If yes), what was different? (b) Do you think the notification provides the agent any way to be sure he is giving the money to the righ...

  83. [94]

    We have one more task, but before you start, I would like to ask some questions to help me understand how people use MoMo

    Is there anything about this whole process you would change? (prompt: Like anything you are concerned about, or something you feel could be better?) If yes, what and why? Task 3: Proxy Withdraw Using Privacy-Preserving Process Pre-Task Interview Thank you for completing the se...

  84. [95]

    Have you ever sent someone else to withdraw money or to collect money that you have withdrawn? (If yes) Please tell me how you usually go about the process. (If not) Give scenario: Imagine you were sick and could not get to the agent and so you needed to send someone; how woul...

  85. [96]

    During this task, you might encounter some screens where we use X to hide part of the phone number and only show the last 4 digits like this (show sample screen)

    Is there anything you wish you could change about the way you cur- rently send someone? [Researcher’s note: I will show you one more ad from Momocom that shows the different ways you can withdraw using their new process Comprehension Questions • What are ways you can withdraw ...

  86. [97]

    What did you think of the process?

  87. [98]

    Is there anything you liked about this process compared to the current one that people use when sending someone else to collect?

  88. [99]

    Anything you disliked about this process compared to the current one that you (would) use when sending someone else to collect?

  89. [100]

    Is there anything you found difficult? (if yes, what and how so?)

  90. [101]

    Is there anything you found confusing? (if yes, what and how so?)

  91. [102]

    If you were using this process: (a) What would you consider more carefully compared to when you send someone the normal way? (b) What would you consider less carefully (or would be less im- portant) compared to when you send someone the normal way (c) Would your decision of wh...

  92. [103]

    Are there any reasons why you would not use this process?

  93. [104]

    What info did the person you were sending need to have or see when you sent them to collect using the procedure you just followed? (a) Is there any situation where you would not want to share some or all of the information you mentioned with the person you were sending? (If ye...

  94. [105]

    What information do you think the agent received when you transacted using this last procedure that you just followed? (a) Is there any situation where you would not want to share any of this information with the agent? (Note: correct participant after they respond if they hav...

  95. [106]

    What information do you think was sent to the mobile money provider when you transacted using this procedure? (a) Are you comfortable with the mobile money provider having access to this information? Why or why not? (b) Is there any situation where you would not want to share ...

  96. [107]

    If you were to send someone to collect, would you want them to use this new process of collection or would you prefer the current method?Why?

  97. [108]

    If you were to collect money for someone else, would you want to use this new process of collection? Why?

  98. [109]

    Overall, if you needed to withdraw money and send someone else to collect and your MoMo provider offered you this process as an option, which one would you choose – Would you use this process or would you prefer not to use this process at all? Why?

  99. [110]

    Is there anything about this process you would change?(Additional probe: Like anything you are concerned about, or something you feel could be better). If yes, what and why? C Additional Figures Table 1: Participant demographics for users and agents Users Agents Smartphone Fea...

  100. [111]

    That is, the agent follows protocol, but tries to infer informa- tion about the user

    Threat model: Agent: We assume the agent is honest-but-curious. That is, the agent follows protocol, but tries to infer informa- tion about the user. User: We model a user that can violate protocol in the following ways: (1) An honest user (i.e., a person who follows protocol)...

  101. [112]

    Security of Biometric Authentication: We assume a user u ∈ U can authenticate themselves (using the bio- metric authentication application) if and only if they are the rightful owner of the MoMo account

  102. [113]

    Network latency We assume that protocol messages are transmitted instantaneously between parties

  103. [114]

    Specifically, for a random code C, a random user U, and a random side information vector Vs, we observe that P(C = c | U = u,VS = vS) =P(C = c), and C ∼ Unif({0,1}ℓ)

    Random Code Generation We assume that the random code C ∈ Bℓ is generated independently of the user’s identity and the agent’s side information. Specifically, for a random code C, a random user U, and a random side information vector Vs, we observe that P(C = c | U = u,VS = vS...

  104. [115]

    Software Integrity We assume that the software on all devices (user, collector, agent, MoMo provider) is uncompromised and runs according to protocol. D.1 Security We first prove that under our assumptions, incorrect with- drawals (e.g., stemming from a stolen phone or an atte...

  105. [116]

    u ̸= u′ and u has ownership of their phone at time t′

  106. [117]

    in the interval [t,t + ∆]

    u ̸= u′ and u maintains control of their phone for at least ∆ time after authentication, i.e. in the interval [t,t + ∆]

  107. [118]

    u = u′ and u ̸= Ω(a)—that is, the user who initiates and executes the withdrawal is not the owner of the account

  108. [120]

    x ̸= x′—that is, the amount of money disseminated is dif- ferent from the amount requested during the withdrawal request on the mobile phone. Proof. We consider each of the above cases in succession:

  109. [121]

    This can happen with probability at most 2−ℓ (Assumption 4)

    If u ̸= u′ and u has ownership of their phone at time t′, then at some time in the interval [t′ − ∆,t′], user u′ must have guessed the code c and amount x exactly. This can happen with probability at most 2−ℓ (Assumption 4). 3We say that a function f : N → R is negligible if f...

  110. [122]

    Either u′ acquired (e.g., stole) user u’s phone after time t + ∆, or u′ inferred the code c

    If u ̸= u′ and u maintains control of their phone for at least ∆ time after authentication, then there are two op- tions. Either u′ acquired (e.g., stole) user u’s phone after time t + ∆, or u′ inferred the code c. If u′ acquired user u’s phone after time t + ∆, the random cod...

  111. [123]

    This cannot happen by Assumption 2

    If u = u′ ̸= Ω(a) then u incorrectly authenticated them- selves as Ω(a) (i.e., this is a failure of the biometrics system). This cannot happen by Assumption 2

  112. [124]

    If u′ uses u’s phone to with- draw (e.g., either because u = u′ or because u′ obtained u’s phone at time t′), then if t′ > t + ∆, the random code has expired on u’s device

    Again, we have two cases. If u′ uses u’s phone to with- draw (e.g., either because u = u′ or because u′ obtained u’s phone at time t′), then if t′ > t + ∆, the random code has expired on u’s device. The agent follows protocol (Assumption 1), and the protocol only allows the ag...

  113. [125]

    If u′ withdraws from a different phone but displays code c, this can happen with probability at most 2−ℓ

    If x ̸= x′ and u′ withdraws from u’s phone, the agent will again not disseminate the amount because the protocol tells the agent to disseminate amount x to the person whose phone displays the random code, and the agent follows protocol (Assumption 1). If u′ withdraws from a di...

  114. [126]

    w ̸= u′ and w has ownership of their phone at time t′

  115. [127]

    in the interval [t,t + ∆]

    w ̸= u′ and w maintains control of their phone for at least ∆ time after authentication, i.e. in the interval [t,t + ∆]

  116. [128]

    w = u′ and w ̸= Ω(b)—that is, the collector who initi- ates and executes the collection is not the owner of the delegated collector’s account, b

  117. [129]

    t ′ > t + ∆—that is, the validity period of the random code expires

  118. [130]

    x ̸= x′—that is, the amount of money disseminated is dif- ferent from the amount requested during the withdrawal request on the mobile phone

  119. [131]

    w = u′, but u did not complete the delegation process to w (account b). Proof. Cases 1-4 follow the same logic as Proposition 1. For case 5, if u does not complete the delegation process, then the MoMo provider does not provide user w with a delegated withdrawal transaction fr...

  120. [2019]

    https://www.cnbc.com/2019/08/22/tala -aims-to-help-anyone-with-an-android-phone -have-access-to-loans.html

    2019

  121. [2022]

    (Accessed on 09/19/2024)

    2024

  122. [2023]

    [Accessed 12-02-2025]

    https://www.statista.com/statistics/ 1188510/registered-mobile-money-accounts-i n-kenya/, 2025. [Accessed 12-02-2025]

    2025

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.