MTN app is a hacker's dream, and there's NO WAY to undo their damage
Last month, my parents were contacted by a ********** 'MTN Operator' telling them that their cellphone number was going to be reassigned unless they could authenticate it over the phone. They then requested a number of OTP's which were sent to the phone, which my parents provided.
People (including some MTN shop assistants) are quick to point fingers and say 'you should never have provided an OTP, it's your fault' - but in no way, shape or form do my parents (or me for that matter - and i'm a software developer - I know hacking well) ever need/use OTP's with MTN - so why would they be suspicious? Sure, credit card purchases and bank pins - but MTN? Never in my life.
It turns out that all you need to create a profile on the MTN app is someone's cell number and a single OTP - if you can swindle that, you'll have access to their entire account, including the authority to buy airtime and data, and alter their contract settings. No further OTP's will be requested (other than to change your contract limit, as my parents' hacker did) and your session will NEVER DIE! Once you have logged into the app once, you can return and 'resume session' at any stage - no matter how long it's been. I've tested this on my phone since finding out about this.
First of all - who even knew MTN had an app? I certainly didn't. We've been buying airtime over the counter for years, and paying a fixed contract fee every month. Why would my 60+ year old parents ever think that someone might be creating a ********** profile on an app they had no idea existed?
Furthermore - HOW CAN YOU ONLY REQUIRE ONE OTP TO CREATE A PROFILE ON SOMEONE'S ACCOUNT??? OTP's are supposed to be part of 2-factor authentication - you provide a password (factor 1) and then you provide an OTP (factor 2). How can an app have only a single step auth process? What if I just stand behind someone in the checkout aisle at the shop and read the OTP over their shoulder? It's completely insufficient!
So I deeply empathize with my parents falling for this ***** - they don't know about MTN OTPs, and they don't want to 'have their cell number reassigned'.
What's even more disappointing than the weak app security, is the lack of retrospective action that can be taken. You can return and refund pretty much anything in this entire world - except airtime and data! It's ridiculous. I stopped all data share privileges etc on their app (my mom isn't even connected to the MTN APN as she uses Afrihost data!) and so they had the 2 x 100GB bundles and 1 x 50GB bundle (coming to a total cost of R10 500) sitting in their accounts/on their profiles - totally unused.
They made numerous trips to the MTN store to seek counsel, logged tickets, got police affidavits - everything asked of them! But MTN still deducted the full amount, with no explanation, assistance or reasoning.
That it just plain wrong - if you're going to have such poor app security on a platform that allows people to purchase on credit - you HAVE to have a means of cancelling purchases - surely? How can that be fair, MTN? My parents can't afford that kind of waste - they have ~R300 contracts per month each. They never even used a single kB of that **********ly purchased data, and they did everything in their power to reverse/cancel the transaction - and yet, here we are.
You are the country (and Africa's) biggest network provider - surely you can do better? Please - help us out.