USSD Security: How to Protect Mobile Transactions from Fraud
Is USSD banking safe? Yes, when the platform behind it is built with the right security controls. Without those controls, USSD sessions are exposed to SIM swap fraud, session hijacking and social engineering attacks that cause significant losses for businesses and their customers.
If you run a USSD service that moves money, USSD security comes down to three jobs: know the attacks, put the right controls in place, and meet what regulators in your market expect.
Why USSD Security Matters: Africa’s Mobile Money Ecosystem at Risk
According to GSMA, mobile money surpassed two billion registered accounts and over half a billion monthly active users globally in 2024. Africa is the epicentre of that growth. As reported by Ecofin Agency, citing the GSMA State of the Industry Report on Mobile Money 2025, Africa processed 65% of global mobile money transaction value in 2024, totalling $1.1 trillion.
USSD is the backbone of much of this activity. It works on every phone, including feature phones that cannot run mobile apps, requires zero data, and powers everything from mobile banking to airtime purchases. That reach also makes it a high-value target for fraud.
Fraud against mobile money causes serious losses for providers and their customers, and identity theft is a major driver of digital financial crime. For any business deploying USSD financial services, mobile money security starts with USSD security. It is the foundation.
What Are the Main Security Threats to USSD Transactions?
Five common threat categories drive USSD-related fraud. Here is how each one works and what USSD fraud protection requires for each.
| Threat Type | How It Works | Severity | Key Mitigation |
|---|---|---|---|
| SIM Swap Fraud | Attacker convinces the carrier to transfer your number to a new SIM, then intercepts USSD sessions and OTPs | Critical | SIM status checks before transactions, multi-factor confirmation |
| Session Hijacking | Attacker exploits an active USSD session through malware or a compromised device to take over the interaction mid-flow | High | Strict session timeouts, automatic termination on inactivity, active transaction monitoring in central systems, as recommended in AFI Guideline Note No.37 |
| SS7/Signaling Vulnerabilities | Attacker exploits weaknesses in the SS7 signaling protocol (the system networks use to route calls and messages) to intercept or redirect USSD messages between the handset and the network | High | Carrier-level SS7 firewalls, plus HTTPS or VPN on your own link to the gateway |
| Social Engineering | Attacker impersonates a bank, telco, or agent to trick the user into revealing PINs, OTPs, or account details | High | User education, transaction confirmation prompts |
| Man-in-the-Middle (MITM) | Attacker intercepts communication between the user’s device and the USSD gateway, capturing session data in transit | Medium | Carrier-side controls on the handset-to-gateway leg; payload encryption (AES/RSA) and HTTPS or VPN on your own gateway-to-server link |
How Does SIM Swap Fraud Target USSD Banking?
SIM swap is one of the most damaging threats to USSD-based financial services. The attack is straightforward: a fraudster persuades (or bribes) a mobile network agent to transfer the victim’s number to a new SIM card. Once the swap completes, every USSD session, OTP, and mobile money notification goes to the attacker’s device.
According to TechTrends Africa, citing Nigeria Inter-Bank Settlement System data, Nigerian banks reported a 300% increase in SIM swap-related fraud cases between 2022 and 2024.
When an insider helps, the fraudster does not need to fool the customer at all. The weak point is human access to carrier systems, which no amount of user caution can close on its own.
The defence starts at the platform level. Banks and fintechs deploying USSD services need SIM status verification: checking whether a SIM was recently swapped before authorising a transaction. In Nigeria, the regulator’s TIRMS system (covered in the regulatory section below) is designed to address exactly this gap. In Ghana, ask your mobile network partner or USSD provider whether a SIM-swap or number-status check is available to you, and make it a procurement question.
Phone number verification confirms that a customer controls a number when they sign up. It is not a SIM-swap check, so pair it with one.
9 Security Measures Every USSD Platform Must Have
If you are building or procuring a USSD service, these nine controls form the USSD security baseline. Each one addresses a specific attack vector from the threat table above.
- Session timeouts. Terminate inactive USSD sessions after a short window. The GSM specification (ETSI TS 123 090) sets no fixed session length. The window is determined by the network operator and gateway configuration, so agree the value with your provider and document it. In Ghana, Bank of Ghana requires regulated financial institutions to define session time-out criteria after a specified period of inactivity. Timeouts prevent session hijacking on unattended devices.
- PIN management and lockout. Enforce strong PIN requirements and lock accounts after consecutive failed attempts. This blocks brute-force attacks. Set the attempt limit in your risk policy; in Ghana, lockout is also a Bank of Ghana requirement (see the regulatory section below).
- Payload encryption (AES/RSA). Encrypt sensitive fields, such as PINs and account data, inside the messages your application exchanges with the USSD gateway. This protects the data itself on the gateway-to-server leg. It does not cover the handset-to-gateway leg, which runs inside the carrier network.
- HTTPS/VPN transport security. Secure the connection itself between your application and the carrier’s USSD gateway with HTTPS or a dedicated VPN tunnel. Control 3 protects what is sent; this control protects the channel it travels over. SS7 weaknesses inside the network still need carrier-level controls.
- Transaction velocity limits. Cap the number and value of transactions within a time window. This limits damage if an account is compromised. Base the window and caps on your own risk policy and normal customer behaviour.
- SIM swap detection integration. Check whether a number’s SIM was recently swapped before authorising high-value transactions. In Nigeria, the regulator’s TIRMS system is designed for this; elsewhere, use the provider check covered in the SIM swap section above. It is the most direct defence against SIM swap fraud.
- Audit logging and real-time monitoring. Log every session, input, and transaction with timestamps. Trigger alerts on anomalous patterns such as an unusual location, rapid-fire requests or large transfers.
- Two-factor confirmation for high-value transactions. Require a second confirmation step (callback, SMS OTP to a registered alternate number, or in-app approval) before processing transactions above a threshold your risk policy defines.
- Regular software and firmware updates. Keep the USSD application, gateway middleware, and supporting server software patched and current. Ageing, unpatched components accumulate known vulnerabilities, so schedule updates and security reviews rather than leaving the platform to run untouched.
For guidance on building secure USSD menu flows that incorporate these controls, see our design best practices guide.
Building a USSD application in Ghana? Arkesel’s USSD API gives you session management and a multi-level menu API to build these controls into your flows. Explore Arkesel USSD Solutions.
How to Protect Your USSD Transactions as a User
Much mobile money fraud relies on social engineering: phishing calls, fake SMS messages, and impersonation of bank or telco agents. Your behaviour is your first line of defence when it comes to secure USSD transactions.
- Never share your USSD PIN or OTP with anyone, including someone claiming to be from your bank or network provider. Treat any request for them as a warning sign.
- Ask your mobile network whether it offers SIM-swap notifications, and sign up if it does, so you hear quickly if your number moves to another SIM.
- Set a SIM lock PIN on your device. This prevents unauthorised SIM removal and reuse.
- Review transaction alerts immediately. If you receive a confirmation for a transaction you did not initiate, contact your bank and carrier without delay.
- Avoid initiating USSD sessions on shared or public devices. If you must, close the session fully before stepping away.
- Report suspicious calls or messages to your carrier and bank. Early reporting gives them the chance to block the number and warn other customers.
Regulatory Developments Strengthening USSD Security in Africa
Regulators in Nigeria and Ghana are working on the identity and security gaps that fraudsters exploit. Three developments stand out for institutions running USSD services.
Nigeria: TIRMS Number-Status Checks
The Nigerian Communications Commission (NCC) is behind the Telecom Identity Risk Management System (TIRMS). According to the NCC’s TIRMS API documentation, it is designed to let approved banks, fintechs and insurers verify a mobile number’s status, including whether its SIM was swapped, for onboarding, authentication or transactions.
Ghana: New Number Registration Exercise
According to Ghana’s National Communications Authority (NCA), the NCA and the National Identification Authority (NIA) are preparing a new exercise that will register individual phone numbers and link each one to a verified identity. The start date is still to be announced.
The NCA says a validation exercise in June 2025 found SIM records that could not be verified against the NIA database, incorrect identity information and unverifiable biometric data. The practical lesson for your service: do not treat existing SIM registration as SIM-swap protection on its own. Keep your own verification and SIM status checks in place.
If you are deploying USSD services in Ghana, our guide on how to get a USSD shortcode in Ghana walks through the setup.
Ghana: Bank of Ghana Cyber and Information Security Directive
Bank of Ghana’s Cyber and Information Security Directive (March 2026 edition) applies to banks, specialised deposit-taking institutions, payment service providers and any other institution Bank of Ghana licenses or regulates. Among its requirements:
- Encryption in transit. Bank of Ghana requires strong encryption for sensitive data sent through APIs, and information carried over the internet must be encrypted at the highest level.
- Tamper-proof logs. Logs must be tamper-proof and record all activities carried out in the system at application level.
- Lockout. Software an institution develops must address session management and temporarily lock access after consecutive failed login attempts.
It also carries the session time-out duty covered in the checklist above. The directive does not name USSD: these are general obligations that apply to whatever channel you run, USSD included. For a fuller walkthrough, see our guide to USSD security best practices.
Whichever market you operate in, build these requirements into your USSD application architecture from day one.
How Arkesel Secures Your USSD Service
Arkesel is ISO 27001:2022 certified and operates to a high-availability standard, the security and reliability baseline your USSD service needs. Read the full Arkesel information security statement for details on our security posture.
Related Articles
- 7 Business Uses for USSD: Banking, Payments & More
- How to Get a USSD Shortcode for Your Business in Ghana
- USSD vs Mobile App in Africa: Which Channel Wins?
- USSD Financial Services in Africa: Mobile Money Guide
- USSD Menu Design: What a USSD Menu Is and 10 Best Practices
- How to Build a USSD Application: Developer Guide for Africa
- USSD vs SMS vs WhatsApp: Which Channel Wins in Africa?
- USSD Healthcare in Africa: 5 Patient Services, No App
- USSD Shortcode Provider Ghana: Buyer’s Checklist (2026)
- What Is USSD? Meaning, How It Works, and Business Uses
- USSD Banking: How Mobile Banking Works Without Internet
The Arkesel USSD platform delivers zero data cost for end customers and works on any mobile device, including feature phones. It includes session management and a multi-level menu API that lets you build interactive USSD flows programmatically. Teams without developers can use managed USSD setup instead.
For businesses in Ghana building USSD for interactive customer experiences, your service runs on direct connections to MTN, Telecel and AirtelTigo. If you are still weighing USSD, SMS, or WhatsApp as your primary channel, our comparison guide sets the three side by side. The protections in this guide apply equally to USSD healthcare services and financial services.
Ready to deploy a secure USSD service? Get started with Arkesel or view pricing.
FAQ
Are USSD codes safe for mobile banking?
Yes, when USSD security is built into the platform: session timeouts, PIN lockout, encryption on your gateway link, and SIM swap detection. Without these controls, the session-based architecture is vulnerable to interception and fraud.
What is USSD session hijacking and how do you prevent it?
Session hijacking occurs when an attacker takes control of an active USSD session, typically through malware on the device or by exploiting a session that was not properly terminated. Prevent it with strict session timeouts, automatic session termination on inactivity, and active transaction monitoring in the provider’s central systems.
How long does a USSD session last?
There is no fixed USSD session timeout. The network controls the session and can end it when a timer expires, so the window depends on the network and gateway configuration. Agree the value with your provider and document it.
What security features should a USSD platform have?
At minimum: session timeouts, PIN management with lockout, payload encryption (AES/RSA), HTTPS or VPN transport security, transaction velocity limits, SIM swap detection, audit logging, regular software and firmware updates, and two-factor confirmation for high-value transactions.
How does SIM swap fraud work?
A fraudster convinces a mobile carrier, through social engineering or insider collusion, to transfer your phone number to a new SIM card. Once the swap is done, the attacker receives all your USSD sessions, OTPs, and mobile money notifications.
How can I protect my mobile money from fraud?
Never share your PIN or OTP. Ask your mobile network whether it offers SIM-swap notifications. Set a SIM lock on your device. Review transaction alerts immediately and report anything suspicious to your bank and carrier.
How do I stop or disable a USSD code running on my phone?
Press your phone’s Cancel or End Call button. USSD is session-based, so ending the call closes the session immediately, and the network terminates it on its own after a short inactivity window. If USSD prompts keep appearing without you dialling anything, a subscribed service or an app on the device is triggering them: unsubscribe from that service or ask your mobile operator to block it, and never dial USSD codes shared from untrusted sources.
What are the latest USSD security regulations in Africa?
In Ghana, Bank of Ghana’s Cyber and Information Security Directive requires the institutions it regulates to define session time-outs, encrypt sensitive data in transit, keep tamper-proof logs and lock access after repeated failed logins. The NCA is preparing a new number registration exercise, start date to be announced. In Nigeria, the NCC’s TIRMS is designed to let approved banks, fintechs and insurers check whether a number’s SIM was swapped.
WhatsApp Ticketing System: Turn Chats Into Tickets With SLAs That Fit the 24-Hour Window
A WhatsApp ticketing system turns chats into tickets with owners, statuses and SLA clocks. See how…
Email List Segmentation: How to Segment Your List for Higher Conversions
Email list segmentation for African marketers: the segments to build first, a decision table, list hygiene,…
How to Combine SMS, WhatsApp and Email Marketing in Africa
How to combine SMS, WhatsApp and email marketing in Africa: which channel carries which message, a…
