E-Financial
Revealed: mPoS Devices at Risk from Hackers
Researchers have found that most popular mobile point of sale (mPoS) devices which accept chip-and-pin cards contain several vulnerabilities,
Jon Butler, head of research at MWR InfoSecurity, and a researcher named Nils, studied six of the most popular mPoS, according to their presentation at the annual Black Hat security conference recently.
A patch has been available since April but hasn’t been widely applied, leaving many devices vulnerable.
They uncovered vulnerabilities in the device’s firmware update process.
Butler and Nils were able to look at the USB interface and gain access to the device’s command line to execute commands.
A stack-based buffer overflow bug in the EMV parsing library also opened up the devices to be fully compromised and under the attacker’s control.
They found hints that mPoS could also be compromised via a smartphone infected with malware.
These vulnerabilities, according to the researchers, would not allow attackers to clone the chip on EMV cards.
Attackers can take the available information and the captured PIN to create a cloned card that could be used where EMV is not as widely deployed, such as the United States.
The researchers successfully used a maliciously crafted EMV (chip and pin) card to install and run a Flappy Bird-like game on the device.
A real world version of this attack would likely involve the attacker using a rogue card to modify the mPoS to stealthily copy card details and PINs of every payment card it processes.
The attacker could later return with another card to extract the harvested information.
Chip cards should not be considered trusted, Butler said. Every card has not been freshly issued by a bank, he warned.
These mPoS devices have a small screen, a card reader, and an input pad to accept PINs.
Even though they may look entirely different, Butler said 75 percent of the devices actually are the same when considering the underlying software and tools available.
These devices generally run Linux, or a variant of, and communicate via Bluetooth with smartphones.
The platform vendor was cooperative when Butler and Nils reported the vulnerability and released the patch for the EMV library in April.
There was some delay in releasing the patch because the modified library had to be re-certified again.
“Legal standards actually make it difficult for manufacturers to release security patches in a timely manner. Some of the mobile device vendors have not yet released the firmware update containing the new EMV library”, Nils said.
Unlike many embedded devices, mPoS can potentially be updated easily, as the firmware can be pushed over Bluetooth by the mobile app.
“Even with the uncovered flaws, mPoS devices are potentially more secure than traditional PoS devices”, Butler said.
“They are simple enough that so long as implementation follows security best practices, there’s not much that can go wrong”, he said.
Federal High Court in Lagos has fixed July 1, 2025, for the commencement of trial in a money laundering case involving Cititrust Holdings PLC and three of its subsidiaries.
The subsidiaries are Cititrust Funding PLC, Cititrust Credit Limited and Cititrust Financial Services Limited,
The companies are facing an eight-count charge filed by a team of prosecutors from the Economic and Financial Crimes Commission (EFCC), comprising Anasoh Henry Onyekachi, Frankklin Ofoma, Abdulhamid Lamido Tukur, and A.A. Usman.
According to the charge, between 2021 and 2023, the companies, all incorporated in Nigeria, allegedly operated investment management services without a valid licence from the Central Bank of Nigeria (CBN).
This act contravenes Section 57 of the Banks and Other Financial Institutions Act (BOFIA) 2020 and is punishable under Section 57(5) of the same legislation.
The prosecution also alleged that the companies conducted a Collective Investment Scheme without registering with the Securities and Exchange Commission (SEC), another violation of regulatory requirements.
In one of the counts, Cititrust Credit Limited is specifically accused of failing to report high-value financial transactions to the Nigerian Financial Intelligence Unit (NFIU).
These transactions include a N20 million transfer on January 7, 2021; a N200 million transfer on April 4, 2021; and a N200 million lodgement on January 29, 2021.
Additionally, both Cititrust Credit Limited and Cititrust Financial Services Limited are alleged to have made a single transfer and lodgement respectively of N42 million into their bank accounts on January 29, 2021, without proper disclosure to relevant authorities.
The alleged offences are in breach of Sections 11(1)(b) and 11(3) of the Money Laundering (Prohibition) Act 2022, as well as Section 54(1) of the Investment and Securities Act 2007, and are punishable under the respective laws.
The court is expected to begin full proceedings on July 1.
Ecobank Nigeria’s long-term issuer credit rating has been downgraded to ‘CCC-’ from CCC, with the outlook placed at negative by S&P Global Ratings. This is a resultant effect of the $150 million bond buyback offer on the bank’s $300 million Senior Unsecured Eurobond.
Part of the tender offer made by Ecobank includes an early tender premium of $12.50 for every $1,000 in principal (equivalent to 1.25%), with the anticipated settlement date set for July 8, 2025. The offer also requests bondholders’ consent to eliminate the capital adequacy covenant on the outstanding notes.
These actions also led S&P to downgrade the $300 million Eurobond from ‘CCC’ to ‘CCC-’. Although S&P notes that it does not consider the tender offer a distressed debt restructuring.
However, this assessment is at risk of changing if the bank does not receive the promised capital injection from the parent group, Ecobank Transnational Incorporated (ETI).
Following the naira devaluation, Ecobank was unable to meet the regulatory Capital Adequacy Ratio (CAR) requirement, as its CAR dropped to 7 per cent. This was below the 10 percent regulatory minimum. The breach of the CAR caused the bank to seek the consent of its bondholders to pause the capital adequacy notes on the Eurobond notes till September 2025.
Following this development, the bank received a $50 million prepayment on promissory notes from its parent company, ETI, along with early repayments on certain foreign currency loans. However, it has been insufficient in restoring the capital adequacy to regulatory levels.
According to S&P, the bank is expected to receive another $50 million capital injection from its parent group before August 2025. However, the ratings agency notes that if the bank is unable to receive this capital injection, it will inevitably default on its bonds. A situation that would cause a further downgrade to ‘CC’.
It was recommended that Ecobank Nigeria consider raising $150 million through additional Tier-1 instruments to strengthen its liquidity buffers. Additionally, the bank was advised to intensify efforts to recover its foreign currency-denominated loans.
Fidelity Bank Plc, leading financial institution has reaffirmed its commitment to corporate social responsibility with the donation of food and essential items to the Old People’s Home in Yaba, Lagos.
The donation was made possible through the generosity of the bank’s Nexus Inductees Class, under its Corporate Social Responsibility initiative known as the Fidelity Helping Hands Programme (FHHP).
Through the FHHP, staff across Fidelity Bank branches nationwide identify crucial interventions needed in their immediate community and raise funds to execute them. The bank’s management then matches this contribution with an equal amount and disburses it for the selected project.
Commenting on the donation, Divisional Head, Brand and Communications, Fidelity Bank Plc, Dr Meksley Nwagboh, emphasized the bank’s unwavering commitment to impacting its host communities positively noting that the community is an essential part of the bank success story.
“Today’s donation is a token of our appreciation for our incredible parents and guardians who have raised outstanding individuals that trust us with their banking needs.
“Our donation to the Old People’s Home reflects our deep commitment to supporting the well-being and dignity of our senior citizens.
“We are honored to contribute to a cause that ensures they receive the care, comfort, and respect they deserve.” Nwagboh stated.
Appreciating the gesture from the bank, the Director-in-Charge of the Home in Yaba, Adetutu Ipaye, said “Community support initiatives such as this from Fidelity Bank is vital to sustaining our mission and enhancing the quality of life for the elderly.
“We urge other organizations to follow in the Bank’s footsteps as this kind of support will go a long way to ensure that the elderly live with dignity and comfort”.
One of the beneficiaries from the home, Mr. Kamoru Adeyetu noted that, “Your presence today has brought us immense joy, and our greatest happiness lies in seeing the younger generation thrive. Beyond the gifts, your visit means the world to us and please remember to visit us regularly.”
Ranked among the best banks in Nigeria, Fidelity Bank Plc is a full-fledged Commercial Deposit Money Bank serving over 9.1 million customers through digital banking channels, its 255 business offices in Nigeria and United Kingdom subsidiary, FidBank UK Limited.
The Bank is the recipient of multiple local and international Awards, including the 2024 Excellence in Digital Transformation & MSME Banking Award by BusinessDay Banks and Financial Institutions (BAFI) Awards; the 2024 Most Innovative Mobile Banking Application award for its Fidelity Mobile App by Global Business Outlook, and the 2024 Most Innovative Investment Banking Service Provider award by Global Brands Magazine. Additionally, the Bank was recognized as the Best Bank for SMEs in Nigeria by the Euromoney Awards for Excellence and as the Export Financing Bank of the Year by the BusinessDay Banks and Financial Institutions (BAFI) Awards.
Lebara, New Operator Enters Nigerian Telecom Arena, Sells Minutes, Not Airtime
EFCC Drags Cititrust to Court over Unreported ₦200mTransfers
ARCON to Tackle Digital, Recommits to Ethical Standards
Africa Gears Up For Digital Sovereignty At 13th Edition Of Digital Africa Conference 2025
Over 7m Streaming Accounts’ Credentials were Leaked in 2024 – Report
Telecom2 days agoMTN Says New N6.98 USSD Charge Won’t Affect Airtime Recharge
Telecom2 days agoNnaemeka Ani Calls on African Techies to Rewrite the Narrative
General News2 days agoStudy Reveals 7% of Industrial Organizations Tackle Vulnerabilities Only When Necessary
- E-Business17 hours ago
Over 7m Streaming Accounts’ Credentials were Leaked in 2024 – Report
E-Financial2 days agoSofri Rejigs Digital Platforms for Better Customer Experience
E-Financial17 hours agoS&P Global Ratings Downgrades Ecobank Nigeria’s Credit Rating to CCC-, Outlook Negative
General News2 days agoNITDA, NCFRMI Forge Strategic Alliance for Inclusive Digital Transformation of Displaced Nigerians
Telecom17 hours agoPIN Pushes for Equitable Digital Governance at World Internet Forum