Security of transfers and payment for goods via SBP. Part 2

Ruslan Rakhmetov, Security Vision

In the previous article we examined how transfers via the Bank of Russia Quick Payment System (QPS) are carried out between individuals and analysed the main approaches to ensure security.

In the second part, we will look at payment for goods, the so-called C2B transfers via SBP in favour of legal entities - trade and service companies.

This type of payments is based on the same transfers between individuals (C2C SBP), which are actually performed between banks on accounts. And corresponding advantages: instant speed of receiving money by TSPs, absence of security payments from banks to card payment systems, reduced costs for the transfer itself, as well as simpler implementation of payment via SBP (including information security). There is one more peculiarity - payment for goods via SBP excludes such a popular service as cashback, as the payer's bank does not receive a premium from the payment system for the transfer (it is a mechanism for encouraging spending, when the recipient's bank pays a certain percentage to the payment system, and it transfers a part of these funds to the payer's bank).

Nowadays, virtually the majority of the Russian population has smartphones with a camera and Internet connection via a mobile operator, which has created opportunities for payment with initialisation by the client rather than by the TSP (as in the case of payment by plastic card). Such a scheme shifts part of the costs from the POS and their banks to the client's (client's bank) side.

All of the above factors and peculiarities of the technology have laid the foundation for success. Payments via SBP are actively promoted by retailers themselves, who even offer discounts (in fact, it is the amount of savings on refusal from card acquiring) to customers in case of payment via SBP. Some difficulties arise due to the unfamiliarity of such a payment method for customers and the availability of existing methods. In view of recent events, due to sanctions in the Russian Federation there is a shortage of bank ‘plastic’, which will accelerate the transition of customers to the use of mobile devices to pay for goods.

Fig. 1. Dynamics of the population's use of SBS for payment for purchases

Fig. 2. Dynamics of the introduction of payment via SBP in retail outlets

Let's consider the process of payment for goods via BPS. The parties of interaction are already familiar to you from the first article, but at the same time it is no longer an individual but a retail outlet as a recipient of funds:

• Settlement Centre of the Bank of Russia Payment System.
  
• Operational Payment and Clearing Centre.
  
• In addition to the functions already described in the first article, the OPCC has the task of registering payment requests and issuing identifiers (more details below).
  
• Banks and their customers (payer side).
  
• Banks, TSP Agents. TSP agents are actually responsible for communication between TSP and OPCC in order to ensure information exchange, e.g. for generation of QR codes, transfer of payment status, etc. But in the vast majority of cases, this role is combined by the TSP Banks.
  
• TSPs are sellers of goods and services and final recipients of funds.

Globally, the payment process consists of:

• Non-financial transactions:
  
• registration of the TSP in the BPS
  
• generation of a QR code or link
  
• notification
  
• Subscriptions and subscription payment requests
  

• Financial transactions
  
• payment by QR sticker (static QR)
  
• payment by QR at the cash desk (dynamic QR)
  
• instant bill payment (by link)
  
• subscription payment

Technically, almost all types of payments are built on the transfer of some id pre-registered invoice (request) for payment. Classic transfers using QR codes are transfers using the details decoded from QR codes, and in this case, BPS is a much more technological and secure payment method, eliminating any possibility of tampering with the details in the payment QR or link. Moreover, QR (The SBP uses a two-dimensional QR code format (ISO/IEC 18004-2015) actually encodes a link with a given id, which can be directly transmitted in a browser on a mobile device (just the payment of an instant bill on a website by clicking on a link button, which is not technologically different from payment by dynamic QR), as well as with the help of wireless technologies, for example, with the help of NFC.

A functional BPS link (which among other things is encoded by the BPS QR code) is a URL of the following format:

Examples of links:

Now let's look at the 2 main payment processes static and dynamic QR code.

Static QR is the most convenient to use when the seller does not have specialised means of automation - it is enough to make a QR code and stick it out so that the client can scan it from the counter and enter the amount of payment independently from the words of the seller.

Fig. 3. The process of payment by QR sticker

Let's note the key features of the payment process:

• Steps 2 to 9.1 are done through already existing secure banking channels. The process almost replicates C2C payment and fulfils a number of requirements of the Bank of Russia regulations discussed in the previous article.
  
• Step 1 at first glance carries risks of sticker substitution, but these risks are minimised:
  
• by checking the recipient's details at step 3;
  
• a strict verification procedure for merchants who want to accept payments with QR codes;
  
• notification of the merchant when the payment has been received.

Even if an attacker can pass the verification procedure of his ‘fake’ TSP, substitute a QR code for his own and encourage the buyer to make a payment, it can happen only once and will be instantly detected, which most likely will not give the fraudster the opportunity (time) to withdraw/cash out the stolen funds.

The process of payment by dynamic QR has its own peculiarities - this method is most applicable for payments at cash desks, where there is specialised software for automated calculation of the cost of the whole order and formation of a QR code with the corresponding amount.

Fig. 4. The process of payment by dynamic QR at the cash desk.

Let's note the key features of the payment process:

• Steps 1-2 are carried out to essentially submit a request for payment of a certain amount in favour of the initiating TSP. This request is transmitted in a secure way, with mutual authentication of the participants of information exchange, with application of a number of technological checks (for example, reconciliation of identifiers of the authenticated source of the request and its application identifiers in the request itself) at each stage. It should be recalled that the TSP undergoes a special selection procedure, including procedures for checking the quality of information security. In case of successful completion of all procedures, the TSP receives a payment link in the form of text and/or QR code (Fig. 5). By the way, the QR code can be generated by the cash register equipment on the basis of the link.
  
• Steps 3 - 10.2 are similar to the steps for payment by static QR code. Most often the role of the Merchant Agent is fulfilled by the merchant bank itself. TSP Agents are some entity that takes over the operations of QR registration and TSP transfer. The role of TSP Agent is quite convenient for manufacturers and operators of cash services in shops.
  
• Step 11 is the notification of the TSP about the receipt of the payment from the customer by the previously generated QR code.

Fig. 5. An example of a QR code of the SBP

If you look carefully at the scheme of payment, it can be noted that in the unsecured interaction between the POS and the customer no sensitive information is transmitted, and the risks are generally similar to payments by static QR. Except that there is a risk of hacking of the TSP Agent's infrastructure and the TSP itself. However, the hack will still be aimed at substitution of QR from another verified TSP, the probability of which is minimal, and in case of successful implementation the substitution will be detected quickly enough. There are also possible scenarios of changing the payment amount by hacking the infrastructure of the TSP or the TSP Agent and making changes to the QR registration requests - to cause reputational damage (e.g., overestimation of the payment amount) or material damage (underestimation of the amount). But all these risks are almost unlikely to be realised, and attackers will be much more interested in realising other risks not related to the process of payment via SBP.

Also, one should not forget about the constant monitoring of transactions in OPKC, processing of anomalous events, the system of anti-fraud measures to assess fraud risks, requirements to verification of source codes of application software and other mechanisms to ensure the security of SBP payments, described in the previous article.

To summarise, we can safely say that in terms of protection VPS is much safer than payments using classical QR codes with encrypted transfer details. BPS is very technologically advanced and has a huge potential for development.