Securing Financial Apps in Nepal: Best Practices for 2FA and OTP Verification

Nepal’s fintech revolution has transformed digital commerce. From mobile wallets like eSewa, Khalti, and IME Pay to mobile banking applications powered by connectIPS, millions of financial transactions occur daily. However, rapid growth brings increased target visibility for cybercriminals attempting account takeover (ATO), SMS interception, and brute-force verification attacks.

Nepal Rastra Bank (NRB), the central monetary authority of Nepal, strictly enforces guidelines requiring multi-factor authentication (MFA) for electronic fund transfers, wallet top-ups, password resets, and account registration. In this article, we outline the engineering security standards every developer in Nepal must follow.

1. Cryptographically Secure OTP Generation

Standard pseudo-random number generators like PHP's rand() or JavaScript's Math.random() are deterministic. An attacker who determines the seed can predict subsequent generated OTPs.

// DO NOT DO THIS (Insecure PRNG)
$otp = str_pad((string) rand(0, 999999), 6, '0', STR_PAD_LEFT);

// DO THIS INSTEAD (Cryptographically Secure Pseudo-Random Number Generator)
$otp = (string) random_int(100000, 999999);

2. Timing-Attack Resistant In-Memory Verification

When checking a user-supplied OTP code against the code cached in Redis or stored in your database, standard string equality comparison (===) exits early on the first mismatched character. An attacker measuring response time differences in microseconds can deduce the OTP digit by digit.

// Secure constant-time hash verification
public function verifyCode(string $userInput, string $storedHash): bool
{
    $inputHash = hash('sha256', $userInput);
    
    // hash_equals takes constant execution time regardless of character match position
    return hash_equals($storedHash, $inputHash);
}

3. Enforcing Strict Maximum Failed Attempt Rate Limits

A 6-digit numeric OTP contains exactly 1,000,000 combinations (000000 through 999999). Without attempt rate limiting, a multi-threaded bot script can brute-force all combinations in minutes.

4. Protecting Against SIM Swapping Fraud

SIM swapping occurs when an attacker fraudulently ports a victim's mobile number to a new SIM card. While carrier-level SIM swap detection APIs are still developing in Nepal, financial apps should implement contextual risk triggers (e.g., flagging login attempts from new device fingerprints or unverified IP subnets before issuing an OTP).