Case Study — BI-FAST Payment Module (Real-Time Proxy & Settlement)

One proxy alias flaw = account takeover via phone number. We claimed the proxy before the fraudster did.

Client Context

Digital bank + payment subsidiary — BI-FAST participant (23 endpoints: proxy registration, credit transfer, settlement, exception). Pre go-live BI/OJK certification + 2 corporate clients waiting — 3-week window.

Challenge

BI-FAST adds proxy (phone/email/ID) → account mapping + real-time settlement — complex consent, alias squatting, and idempotency risk. Threat: proxy hijack + duplicate credit + settlement forge.

Scope — Snipeyes Real-Time Payments Pen-Test (CREST, 10-day SLA)

  • BI-FAST proxy & payment flows: registration, deregistration, alias resolution, credit transfer, idempotencyKey & settlementCallback
  • Fraud & limit bypass: per-account/alias rate limit, amount limit, duplicate submission, race condition
  • Participant gateway & key mgmt: HSM/vault, message signing, mTLS, log PII leakage
  • Mapped to OWASP API Top 10, BI-FAST Spec v1.3, OJK POJK 11/2022, PCI DSS 4.0, ISO 27001

Key Findings (redacted)

  • CRITICAL: Proxy phoneNo ownership not verified at re-registration → attacker could hijack proxy alias to own account (PoC: re-bound +62xxx in UAT, funds diverted)
  • HIGH: Missing idempotencyKey uniqueness → replayed credit transfer credited twice (double-credit)
  • HIGH: settlementCallback signature not validated → forged settlement status to participant
  • 19 findings: 1 Critical chain, 3 High, 6 Medium, 9 Low — board impact (real-time fraud + BI sanction model)

Outcome

  • Proxy now ownership-verified (OTP) + cool-down, idempotency enforced via DB unique, callback HMAC verified — retest 100% critical closed in 3 days
  • Passed BI-FAST certification first time, no launch delay, corporate payroll on BI-FAST day-1
  • Fraud rule: proxy change velocity alert hooked to Snipeyes FD

Relevance for you: If you’re a BI-FAST participant, direct or via sponsor bank — we test proxy, idempotency & settlement as attackers do, with free retest before BI audit.

Request BI-FAST Proposal → · See FinTech Security →