How a Payment Lookup Oracle Confirms Predictable Identifiers
This paper demonstrates that national payment resolution oracles, such as Thailand's PromptPay, enable the deterministic confirmation of predicted national identifiers by allowing attackers to verify guesses against public data and leaked records, a vulnerability exacerbated by the fact that recipient names are returned unmasked despite partial-name masking efforts.
Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
In the modern world of instant money transfers, a simple safety check has become a powerful tool for privacy invasion. When you send money to a friend using a phone number or a national identification code instead of a long bank account number, your banking app performs a quick lookup. It asks a central system, "Who does this number belong to?" and displays the name on your screen so you can be sure you are sending money to the right person. This feature, known as a resolution oracle, is designed to prevent mistakes and fraud. However, researchers have discovered that this same mechanism, which is meant to confirm a known identity, can also be used to discover the identity of a stranger. The problem arises when this open lookup system is combined with the fact that many national identification numbers are not random; they follow a predictable pattern based on birth dates and locations. In the past, security experts knew that these numbers could be guessed, but they believed there was no way to know if a guess was correct. The new finding is that the payment system itself provides the answer, turning a wild guess into a confirmed fact.
Two researchers from King Mongkut's University of Technology Thonburi in Thailand set out to measure exactly how much danger this combination creates. They focused on Thailand's PromptPay system, a widely used instant payment network where people register their mobile numbers or national ID cards to receive money. The researchers did not try to steal money or hack into any bank's computer systems. Instead, they treated the payment app as a tool to ask questions and analyzed the answers it gave. They started by looking at the structure of the Thai national ID card. It is a thirteen-digit number where the first few digits indicate the province and district where the person was registered, and the final digit is a mathematical check that ensures the number is valid. Because of this structure, the total number of possible valid ID numbers is much smaller than it appears. The researchers calculated that the rules of the system reduce the pool of potential candidates by a factor of one hundred and thirty-five before any specific information about a person is even known.
The study then examined what happens when an attacker already has a list of leaked ID numbers, which is a known reality in the digital world. A recent public leak exposed over 1.2 million Thai national ID numbers. In the past, having such a list was only half the battle; an attacker would have a number but no way to know the name attached to it. The researchers showed that the payment lookup system solves this missing piece. By entering a leaked ID number into a banking app, the system immediately returns the full name of the account holder. This turns a static list of numbers into a live, verified directory of names. The researchers demonstrated that even if some digits of an ID number are hidden or redacted in a document, the mathematical rules of the ID card limit the number of possible missing combinations to a very small set. A user could simply try each of these few possibilities in the payment app, and the system would confirm the correct one by displaying the name, while rejecting the wrong ones.
To understand how well current privacy measures work, the researchers also looked at a new policy adopted in Singapore, where payment apps now hide parts of a person's name on the screen to prevent casual observers from reading it. They tested this idea using a database of thousands of Thai names. They found that the Singaporean method, which hides only the second half of each name, is surprisingly weak. Because Thai surnames are often unique to a single family, and because the first half of a name is often enough to identify a person, the mask leaves the name effectively visible in more than half of all cases. The researchers found that for a large portion of the population, the masked name is unique enough that a person could still identify the individual. More importantly, they showed that this type of masking does not stop a determined attacker who already has a candidate name to test. If an attacker suspects a name belongs to a specific ID number, they can simply check if the masked version matches their guess, rendering the display protection useless against a targeted attack.
The researchers then went to the banks themselves to see what actually happens in Thailand. They used their own bank accounts and mobile phones to test the system across seven different banks, including state-owned, private, foreign, and Islamic institutions. In every single case, without exception, the apps displayed the full, unmasked name of the account holder. There was no redaction, no hiding of letters, and no variation between the different banks. This confirmed that the system is uniform across the entire country and that the current privacy protections are non-existent. The researchers also observed that the system did not slow down or stop them when they repeatedly asked for the same name, suggesting that there are no strict limits on how many times a person can look up an ID number in a short period.
The core conclusion of the work is that the danger lies not in the display of the name, but in the ability to ask the question. The researchers argue that simply hiding the name on the screen is the wrong solution because it does not stop the underlying confirmation process. If an attacker has a list of leaked numbers, the payment system acts as a machine that confirms which numbers are real and who owns them. The researchers suggest that the solution must be to control the questions, not the answers. This means that the system should limit how many times a single user can look up different numbers in a day, or flag unusual patterns of searching. They emphasize that this is not a software bug that can be patched, but a design feature of the payment system that serves a useful purpose for honest users while creating a risk for privacy. The study concludes that for instant payment systems to be secure, operators must implement strict limits on how often these lookups can be performed, ensuring that the system remains a tool for confirming a known recipient rather than a directory for discovering strangers.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.