This paper presents a between-subjects design experiment with 478 people in India to investigate how rural and urban social media users perceive credible and fake posts, and how different types of sources impact their perceptions of information credibility and sharing behaviors. Our findings reveal that: (1) rural social media users were less adept in differentiating between credible and fake posts than their urban counterparts, and (2) source effects on trust and sharing intent manifested differently for urban and rural users. For example, fake posts from family members garnered greater trust among urban users but were trusted the least by rural users. In case of sharing Facebook posts, urban users were more willing to share fake posts from family, whereas, rural users were more inclined to share fake posts from journalists. Drawing on these findings, we propose design interventions to counteract fake news in low-resource environments of the Global South.

Mobile-based scams are on the rise in emerging markets. However, the awareness about these scams and ways to avoid them remains limited among mobile users. We present a qualitative analysis of the dynamics of mobile-based fraud (specifically, SMS and call-based fraud) in Pakistan. We interviewed 96 participants, including different stakeholders in the mobile financial ecosystem: 71 victims of mobile-based scams, seven non-victims, 15 mobile money agents, and three officials from regulatory agencies that investigate mobile-based fraud. Leveraging the perspectives from these stakeholders and analyzing mobile-based fraud with a four-step social-engineering attack framework, we make four concrete contributions: First, we identify the nuances as well as specific tactics, methods, and resources that fraudsters use to scam mobile users. Second, we look at other actors, beyond the victim and the adversary, involved or affected by fraud and their roles at each step of the fraud process. Third, we discuss victims' understanding of mobile fraud, their behavior post-realization, and their attitudes toward reporting fraud. Finally, we discuss possible points of intervention and offer design recommendations to thwart mobile fraud, including addressing the vulnerabilities discovered in the ecosystem, utilizing existing actors to mitigate the consequences of these attacks, and realigning the design of fraud reporting mechanisms with the sociocultural practices.

Abstract Consumer smart home devices are becoming increasingly pervasive. As Airbnb hosts deploy smart devices in spaces shared with guests, we seek to understand the security and privacy implications of these devices for both hosts and guests. We conducted a large-scale survey of 82 hosts and 554 guests to explore their current technology practices, their preferences for smart devices and data collection/sharing, and their privacy and security concerns in the context of Airbnbs. We found that guests preferred smart devices, even viewed them as a luxury, but some guests were concerned that smart devices enable excessive monitoring and control, which could lead to repercussions from hosts (e.g., locked thermostat). On average, the views of guests and hosts on data collection in Airbnb were aligned, but for the data types where differences occur, serious privacy violations might happen. For example, 90% of our guest participants did not want to share their Internet history with hosts, but one in five hosts wanted access to that information. Overall, our findings surface tensions between hosts and guests around the use of smart devices and in-home data collection. We synthesize recommendations to address the surfaced tensions and identify broader research challenges.

SMS fraud has become a growing concern for those working toward financial inclusion, however, it is often unclear how widespread such threats are in practice. This multi-method study investigates SMS fraud in Pakistan through identification and categorization of fraudulent messages as well as the impact on those who receive such messages. We collect fraudulent SMS messages by various means, including byway of a custom-built Android smartphone application. To complement this, we interview people exposed to SMS fraud and representatives of mobile network operators. Based on our analysis, lottery type fraud schemes dominate SMS fraud in Pakistan, and these schemes have the greatest impact on vulnerable low-income, rural populations. We offer a simple heuristic for fraud detection that has a high accuracy rate and is adaptable to evolving fraud schemes, and conclude with a recommendation for a fraud mitigation strategy to target fraudster call back numbers.

Many countries across the globe are engaged in efforts to promote a cashless society. In India, there is a strong top-down push by the government and the private sector for mobile payments. In this work, we examine the benefits and pitfalls people perceive in using mobile payments for customer-merchant transactions. Through interviews with 19 customers and 15 merchants across rural, periurban, and urban India, we explore people's awareness about mobile payment systems, perceived trade-offs among different payment methods, and the security, privacy, and utility barriers in its adoption and use. Overall, we found that customers were interested in adopting mobile payments for referral rewards and sign-up incentives, but were hesitant to regularly use them, whereas merchants saw mobile payments as an unnecessary burden for their business. We discuss the nuanced views of customers and merchants, and offer recommendations to address the barriers in the use of mobile payments for customer-to-merchant transactions.

Access to financial services through a mobile phone, known as Mobile Financial Services (MFS), creates an opportunity to expand the reach of financial services to the 1.7 billion unbanked adults worldwide. Nevertheless, MFS adoption has been inconsistent, which motivates a need to identify the challenges that MFS users confront in different countries. In this work, we explore the Twitter as a potential data source to understand such challenges. More broadly, we assess whether (and how) publicly available Twitter data can augment the findings of expensive, large-scale research studies on MFS barriers. Our Qualitative Content Analysis of 9,000 mobile money grievance tweets that were extracted from 54 MFS customer care twitter feeds across six countries reveals service and access issues, incorrect transactions, and fraud as three main challenges MFS users report on Twitter. We discuss the nuances around these challenges and the substantial differences between the common issues reported in different countries. Ultimately, we conclude that Twitter data can elucidate the challenges of MFS adoption and also that it can augment the results of other types of MFS studies.

Rotating Savings and Credit Association (ROSCA) is a mechanism of informal collaborative savings that is widely used across the globe. Despite its popularity and prevalence, it is not well-studied from HCI and CSCW perspectives. The global increase in mobile penetration has created opportunities to serve the unbanked using mobile-based Digital Financial Services (DFS) for greater financial inclusion but there have not been any DFS-based interventions around ROSCAs. In this paper, we report a qualitative study involving 80 individuals to understand the dynamics of ROSCAs and opportunities for their digitization in the Pakistani context. We also present a smartphone-based Digital ROSCA platform designed on top of a simulated mobile money system. The platform was designed to be inclusive towards low-literate users. We present qualitative findings of its evaluation with 15 users (3 individual ROSCA groups). We find that digitization has the potential to support and strengthen traditional ROSCAs by mitigating issues like record-keeping, delayed payments, collection, distribution, and safety of money. It also allows the creation of payment history for individuals that can be used to score their financial credibility.

Phone-based mobile money is becoming the dominant paradigm for financial services in the developing world. For example, mPesa has a cash flow of over thirty billion USD, equivalent to nearly half of Kenya's GDP. Inside of these markets, competitors have appeared who leverage ThinSIMS, small SIM-card add-ons, to provide alternative mobile money implementations. However, the security implications of ThinSIMs are not well understood.

Prior research suggests that security and privacy needs of users in developing regions are different than those in developed regions. To better understand the underlying differentiating factors, we conducted a systematic review of Human-Computer Interaction for Development and Security & Privacy publications in 15 proceedings, such as CHI, SOUPS, ICTD, and DEV, from the past ten years. Through an in-depth analysis of 114 publications that discuss security and privacy needs of people in developing regions, we identified five key factors---culture, knowledge gaps, unintended technology use, context, and usability and cost considerations---that shape security and privacy preferences of people in developing regions. We discuss how these factors influence their security and privacy considerations using case studies on phone sharing and surveillance. We then present a set of design recommendations and research directions for addressing security and privacy needs of people in resource-constrained settings.

Common authentication methods based on passwords, tokens, or fingerprints perform one-time authentication and rely on users to log out from the computer terminal when they leave. Users often do not log out, however, which is a security risk. The most common solution, inactivity timeouts, inevitably fail security (too long a timeout) or usability (too short a timeout) goals. One solution is to authenticate users continuously while they are using the terminal and automatically log them out when they leave. Several solutions are based on user proximity, but these are not sufficient: they only confirm whether the user is nearby but not whether the user is actually using the terminal. Proposed solutions based on behavioral biometric authentication (e.g., keystroke dynamics) may not be reliable, as a recent study suggests. To address this problem we propose Zero-Effort Bilateral Recurring Authentication (ZEBRA). In ZEBRA, a user wears a bracelet (with a built-in accelerometer, gyroscope, and radio) on her dominant wrist. When the user interacts with a computer terminal, the bracelet records the wrist movement, processes it, and sends it to the terminal. The terminal compares the wrist movement with the inputs it receives from the user (via keyboard and mouse), and confirms the continued presence of the user only if they correlate. Because the bracelet is on the same hand that provides inputs to the terminal, the accelerometer and gyroscope data and input events received by the terminal should correlate because their source is the same - the user's hand movement. In our experiments ZEBRA performed continuous authentication with 85% accuracy in verifying the correct user and identified all adversaries within 11s. For a different threshold that trades security for usability, ZEBRA correctly verified 90% of users and identified all adversaries within 50s.