PromptPay hackable
Re "PromptPay sows doubts", (Editorial, Aug 24).
People should be sceptical about PromptPay, and the banks' willingness to take responsibility in case of fraud or hacking.
As suggested in "PromptPay warning to mobile users," (BP, July 13) the banks have plenty of "wiggle room" to deny responsibility for this.
Many rural Thais, who have very little knowledge of mobile digital commerce or the risks, would like to enrol in PromptPay to receive government subsistence payments. They are easy targets (though small ones) for phishing attacks, or a large-scale hack on the SS7 network.
Banks should configure their PromptPay software so that clients can designate an account as either: a) use PromptPay only to receive funds (cannot transfer out), or b) send and receive funds via PromptPay.
This is a pretty easy software change for the banks (I used to teach software engineering at Kasetsart University.)
People would trust the system more if they know it cannot be used to withdraw funds from their account, thereby increasing enrolment, which the Finance Ministry wants.
Over time, if the system is secure and useful, bank customers may eventually switch to "send and receive" mode.
By the way, SMS is known to be hackable, due to a long-standing lack of security in the SS7 signaling protocol that is used by all telephone networks.
The National Institute of Standards & Tech (NIST) has deprecated the use of SMS for 2-factor authentication because of this.
There's even a YouTube video demonstrating how to hack into someone's Facebook or WhatsApp account using the flaw. I think the same hack could be used with PromptPay.
Comments will be moderated at 06:00-18:00 (UTC+7). Multiple duplicate comments, immoral, unlawful, obscene, threatening, libelous, anything related to the Thai Royal family, self-advertising, or racist comments will be ignored. For full policies, please view www.bangkokpost.com/terms (section 1.1.1).