Lobby the govt to keep NUUP access to Free Software users

How secure is USSD? They outlawed "pull" requests in UPI citing the fraud angle. They have a good argument for USSD too.

@Life is Tetris it depends on how the application is deployed. Details are sparse but from what I can make out, USSD by itself is not very secure (subject to MITM attacks for example) though it is possible to add further protection.

However, I don't buy "the fraud angle" as an argument to stop providing services. By that logic, UPI itself should be outlawed as it increases the possible ways of conducting bank fraud. The real solution is well designed interfaces and proper user education. As one example, IMHO the proliferation of OTPs for every little thing has increased the possibility of fraud as it leads to an "OTP blindness" of sorts and makes it easier for people to claim that an OTP is required for some other purpose too when in reality it is being generated for a fraudulent transaction. One of my Internet banking portals now requires an OTP even to sign in to the account. My recommendation would be to use OTPs only when a sensitive financial transaction or card unlocking is happening: in other words "OTP" means "money is going to be debited". This makes it easier to educate people and form a clear association making it hard for fraudsters to claim that "we need this OTP to complete you KYC", "...for you to receive the funds into your account", etc. This is just a rough starting point of course and ideally something that a professional design team would decide.

In practical terms, the "pull" request related frauds cited by the government were more about social engineering than about technical security. (Unfortunately this affected NUUP users because asking the receiver to make a "pull" request was one workaround when bugs prevented direct initiation of transfer via UPI ID.) We can only hope the government won't decided to axe USSD as that would more or less make UPI transactions impossible for us, outlawed or not.

While looking at Apple and Google monopolies and possibility of filing complaint with CCI, I think we can use the same strategy against BHIM. We can file a complaint against NCPI for favoring only Airtel with *99# implementation. I think the responsibility of fixing other providers is with NPCI.

@Nemo what do you think about this angle? Even though NPCI may not be doing this on purpose, the result is they are favoring a single telecom provider in practice.

For people moving away from Apple or official Android / play integrity locked worlds, this is the only option at present.

Benson Muite is working on a cross platform *99# wrapper, https://git.sr.ht/~bvkcm/JiuJiuPayLN

It can already process QR codes and extract upi id.

I have made the process easier and smooth on my gnu/linux mobile already. I can now more confidently scan and pay without manually extracting the upi id from url.

Scan -> copy -> launch direct upi screen -> paste.

https://codeberg.org/jiujiupay/jiujiupay

Btw is there any recent progress with the reverse engineering efforts?

I think this is the only leverage we have, though they have an easy way out - to break Airtel as well :(

I discussed this with Anuvind from SFLC India, he will check with Prasanth Sugathan as well.

I don't see why we shouldn't try this (CCI) , but the end result is unlikely to be something that will help us. At worst, I can imagine NPCI pulling NUUP entirely, and at best NPCI will blame the Telcos and I doubt will lead anywhere.

On the RE side, we published the CL implementation: https://github.com/52-1ab/cl , but nothing since. I moved to Berlin and haven't had time to look into it any further.

If we can make valid complaint to CCI, at minimum NPCI will have to provide an answer to CCI why they provide this only on Airtel in practice. Since we are not getting an answer from them, at least we can force them to provide an answer.

Literally read through each comment here:

I think, we should again ask NPCI for an official position.

• Is *99# still a supported UPI interface?

• Which operators are expected to support it?

• Is Airtel the only compliant operator?

• Are operators required to implement it?

Based on their response we can publish the findings.

Then probably get FSCI, LibreFin and SFLC to sign a joint letter.

Finally, let us see what NPCI confirms about the list of operators who should support it. If they say all, good, but if they don't, then we have a much stronger basis for approaching regulators or, if appropriate, considering a competition complaint.

NPCI wise - Unless we get a bounce, then we should escalate again through RBI rather than NPCI. AFAIK, NPCI operates UPI, but it does so under RBI's oversight.

@FbIN (VB) the tricky part is, different people tried different options to get an answer from NPCI. So CCI may be the only option to force them to provide an answer. If you can figure out a way to get an answer from NPCI through a different channel, we can try that.

@FbIN (VB) from our point of view, it is evident that this works only in Airtel. We tried contacting NPCI through bhim customer care, but they did not even know they have such a service. So CCI is an investigation agency, we have a complaint, let them investigate. We can provide them evidence that it only work on Airtel and they did not accept our complaint through their documented support channels.

@Pirate Praveen Ohh, I just saw this response. Somehow I have to reload the page for new replies to be shown.

@Pirate Praveen 
Do we have something for example:

along with:

• screenshots,

• dates,

• handset models (if relevant),

• bank used,

• ticket numbers (if any complaint raised),

• bounced emails,

• BHIM responses,

@FbIN (VB) We have some data here https://wiki.fsci.in/NUUP though not in this format. We can collect this information from the community.

Anyone wants to create a form for this data collection? NextCloud form can collect attachments too.

@Pirate Praveen Yup, I added details myself, if you recall. It would be good to have that.

@Pirate Praveen I could create this form, if you could expose your NextCloud form on the net.

I actually think there is a path before CCI, and it may be stronger legally.

The problem with going to CCI first is that CCI is not a discovery mechanism. They won't investigate simply because NPCI isn't replying to emails. We will still need to show either:

• abuse of dominant position under the Competition Act, or

• anti-competitive conduct.

At the moment, what we have is more like failure of accountability than evidence of anti-competitive conduct.

NPCI is an RBI-authorised payment system operator. If it is not responding to policy questions or its published support channels are ineffective, RBI is the supervisory authority under the Payment and Settlement Systems Act.

Rather than asking RBI to answer questions about NUUP, we should ask something like:

We have repeatedly attempted to obtain clarification from NPCI regarding the operational status and support commitments for the NUUP (*99#) service. Multiple community members have used the available support channels without obtaining a substantive response. Kindly advise:

1. Which authority is responsible for policy decisions regarding NUUP?

2. Does RBI expect NPCI to provide a mechanism for responding to public queries regarding payment systems operated under RBI authorisation?

3. If not NPCI, which authority should be approached?

Basically we are reaching out for accountability, rather than asking questions, which I am sure RBI cannot ignore to come back to.

BTW, I just saw that NPCI has a complaint register page (https://www.npci.org.in/complaint-register). I am sure we must have already tried it, and if not, maybe we should try that out too.

@FbIN (VB) I got a 500 error visiting that page. I was just thinking out loud if we can use lack of competition as a leverage. See if you can reach RBI via email or there may be a specific format for contacting them.

@Pirate Praveen Odd. Probably some temp error. Here is the snapshot.

Also, I wrote a small letter (medium letter tbvh). Please point out what corrections, amendments we should make to this. This is very high level (maybe some missing info) letter.

Preserving NUUP (*99#) as an Open Interface to UPI

The Free Software Community of India (FSCI) has been discussing the future of the National Unified USSD Platform (NUUP), accessible via *99#, as it is currently one of the very few ways to access UPI without depending on proprietary mobile applications.

This discussion did not begin as an advocacy campaign. It began because several members noticed that the service was no longer working reliably and tried to understand why.

Over the past few months, members have tested *99# across different telecom operators, banks and locations. Although the exact point of failure varies, the overall pattern has been remarkably consistent. Airtel users are generally able to complete transactions, whereas users of other major operators such as Jio, Vi and BSNL encounter failures at one stage or another. The problem has been reproduced by multiple people using different devices and bank accounts.

We do not know why this happens.

It may be a technical issue, an operational issue, a contractual issue between NPCI and telecom operators, or something else entirely. At present there is no public information that explains the situation.

Before considering any formal action, members of the community tried to report the problem through the channels made available by NPCI.

Some contacted the published BHIM support email addresses. Others used the BHIM feedback form. In one case the support team replied, but appeared to treat the complaint as one relating to a third-party UPI application and seemed unaware that the *99# service itself existed. Other emails either went unanswered or were returned as undeliverable. Collectively, these attempts have not produced any meaningful explanation of the current status of NUUP or why it appears to work only on one telecom network.

The result is an accountability gap. We have a nationally deployed payment interface that behaves differently depending on the telecom operator being used, yet there is no obvious authority willing or able to explain why.

This matters for reasons that go beyond the Free Software community.

NUUP was introduced as a way of making digital payments available on basic mobile phones without requiring Internet access. Those benefits remain relevant today. It is useful for feature phone users, people in areas with unreliable connectivity, users of older devices, and anyone who wants a simple, low-bandwidth method of accessing UPI.

For Free Software users, it has become even more important. Modern UPI applications increasingly depend on proprietary mobile platforms and technologies that are difficult or impossible to support in independent implementations. While projects such as LibreFin are working to improve the situation, reverse engineering proprietary systems is always vulnerable to changes outside the developer's control. An officially supported interface such as *99# provides a far more stable foundation.

We are not asking that NUUP be preserved simply because it is old or because it is useful to a small technical community. We are asking for clarity.

If NUUP remains an officially supported interface to UPI, users should be able to expect broadly consistent access regardless of which participating telecom operator they use. If this is not currently the case, it would be helpful to know why and what, if anything, is being done to address it.

If there has been a decision to withdraw or discontinue the service, that decision should be communicated publicly rather than allowing the service to fail gradually without explanation.

At present we are left with an unusual situation. The service appears to function reliably only on Airtel, repeated attempts to obtain clarification from NPCI through its published support channels have been unsuccessful, and there is no publicly available explanation of whether this is expected behaviour or evidence of a wider problem.

The first step is simply to establish the facts. Who is responsible for NUUP today? Is it still an officially supported interface to UPI? Are all participating telecom operators expected to support it? If not, why not?

Once those questions have been answered, it will be much easier to have an informed discussion about the future of the service.

Finally, I believe we should not be going only to CCI, or directly only to CCI. We need to reach to multiple ones, starting with RBI, including to SFLC for an intake.

https://pad.fbin.in/p/NUUP-Letter
Working on a revised draft here. Always open to any additions or revisions. @FbIN (VB) who is this letter intended for? NPCI, RTI, or RBI? Knowing that I could tailor the message.

I want to focus on the main questions, we could maybe link or source the FSCI wiki's NUUP page for data on our tests:

1.What is the official status of the NUUP?

2.If the official status of the NUUP is active, 

(a)What is currently being done to remediate the inconsistencies in service quality across different telecom operators, banks, and regions?

(b) Why was very little technical information publically communicated about this service?

3.If the official status of the NUUP is inactive,

(a) Why was the deactivation of this service not officially communicated publically?

(b) Why are telecom operators and banks allowed to continue to operate this service in a degraded, inconsistent manner anyway?

@Derpitron I actually think there are three distinct audiences, and I would approach them in order. Each has a different purpose.

1. RBI - Address it to:

Chief General Manager
Department of Payment and Settlement Systems (DPSS)
Reserve Bank of India

DPSS is the department responsible for payment systems, including authorisation and supervision. (RBI System Health)

• Select Department of Payment and Settlement Systems

This isn't a complaint asking RBI to fix a bug. It is a representation asking:

• Who is responsible?

• Is NUUP still officially supported?

• Why is there no effective grievance mechanism?

1. NPCI - Address it to:

Managing Director & Chief Executive Officer
National Payments Corporation of India

or

Head – UPI / BHIM

NPCI has a formal complaint mechanism and corporate office. (NPCI)

• NPCI complaint portal

1. Competition Commission of India (only if the first two fail)

This is where our paper becomes evidence.

We will not be asking CCI: Please fix NUUP.

Instead: We request the Commission to investigate whether the present implementation results in discriminatory access to a nationally important payment infrastructure.

Our evidence becomes:

• Airtel works.

• Other operators fail.

• Extensive testing (NUUP Wiki can come into play here).

• NPCI support channels ineffective.

• No public explanation.

I have one more suggestion.

I would also send it to SFLC. Not because they can solve it directly. But because they can advise whether this is better pursued as:

• a representation,

• RTI,

• writ petition,

• RBI complaint,

• or CCI information.

Since Anuvind was already consulted earlier, getting their view on the legal framing would be valuable.

Finally, for NPCI, we can connect to the NPCI Board as well. A representation copied to:

• Managing Director & CEO

• Chairman

• Independent Directors

is much harder to ignore than one sent to customer support.

Board members have governance responsibilities. They are much more likely to recognise:

"We cannot even determine whether an official payment interface still exists."

as a governance issue rather than a customer support issue.

Basically:

1. NPCI Board / CEO (formal representation, not customer support)

2. RBI – Department of Payment and Settlement Systems (copy of the same representation)

3. Wait 30–45 days (with maximum 2 chasers, one each in 2 weeks time).

4. If there is no substantive response:

   • approach SFLC for legal advice; and

   • consider CCI if the evidence continues to indicate a systemic disparity in access rather than isolated technical failures.

@FbIN (VB) Could you please write the drafts for the first 2 (RBI and NPCI)? I'll look at them in the morning. I think you would get the specifics down better. Also, would these be sent as an RTI or an informal mail?

@Derpitron Check this, and let me know: https://pad.fbin.in/p/NUUP-Letter-II (read the notes at the end to add the NUUP Wiki page and other detailed analysis).

@FbIN (VB) Hi, within the same link I've rewritten your NPCI mail, left the RBI section alone, as I was not sure how to approach it. At this point, I think we would need legal advice to potentially improve the mail any more. At this point, it's needlessly toying around with framing/wording.

I think we've added all the points we need, and included any justification/reasoning we can. I think we should begin reaching out to SFLC with this draft, because to me it seems good enough. Let me know what you think, as I'm not sure what our next process should be.

To be honest, I'm not sure what the difference should be between the NPCI and RBI mails in tone/content. Since Praveen seemingly hasn't posted an update on his own consultation with SFLC, I'm not sure where to go next. May be good to keep this letter ready on hand, in case we can use it.

Also, I'm not sure how we should add/attach the annexure. I've added a citation number in each mail which would be used to link to our wiki page.

@Derpitron Give me a few days time please. I have been stuck with a lot of work. Will be back to this topic soon. Apologies for making everyone wait.