Who Moved My Transaction? Uncovering Post-Transaction Auditability Vulnerabilities in Modern Super Apps

2025-10-30

AI Summary

This study identifies a critical security flaw in super-apps’ post-transaction audit trails: users can permanently delete transaction records, thereby concealing unauthorized or sensitive activities—exposing a systemic gap in current mobile security paradigms, which overemphasize pre-transaction authentication while neglecting audit trail integrity. Through cross-app comparative experiments, we empirically evaluated six mainstream super-apps with six human participants. All six apps permitted transaction record deletion; five (83%) lacked strong authentication for deletion, and only one enforced biometric verification. To our knowledge, this is the first systematic demonstration of the ubiquity of this vulnerability. We advocate a paradigm shift—from “pre-transaction authentication” to “audit integrity assurance”—and provide empirical grounding and design insights for building tamper-resistant, verifiable transaction logging mechanisms.

Technology Category

• Application Domains: Security
• Data Mining & Knowledge Management: Representing, Reasoning, and Using Provenance, Trust
• Machine Learning: Privacy

Application Category

• Security and Privacy: Data transparency and provenance
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Web Mining and Content Analysis: Web data provenance, reliability, and authenticity

Abstract

Super apps are the cornerstones of modern digital life, embedding financial transactions into nearly every aspect of daily routine. The prevailing security paradigm for these platforms is overwhelmingly focused on pre-transaction authentication, preventing unauthorized payments before they occur. We argue that a critical vulnerability vector has been largely overlooked: the fragility of post-transaction audit trails. We investigate the ease with which a user can permanently erase their transaction history from an app's interface, thereby concealing unauthorized or sensitive activities from the account owner. To quantify this threat, we conducted an empirical study with 6 volunteers who performed a cross-evaluation on six super apps. Our findings are alarming: all six applications studied allow users to delete transaction records, yet a staggering five out of six (83+%) fail to protect these records with strong authentication. Only one app in our study required biometric verification for deletion. This study provides the first concrete evidence of this near-ubiquitous vulnerability, demonstrating a critical gap in the current mobile security landscape and underscoring the urgent need for a paradigm shift towards ensuring post-transaction audit integrity.

Problem

• Investigating post-transaction audit trail fragility in super apps
• Quantifying unauthorized transaction history deletion vulnerabilities
• Identifying widespread weak authentication for record deletion

Innovation

• Identified post-transaction audit trail vulnerabilities
• Conducted empirical cross-evaluation on six super apps
• Demonstrated need for biometric verification protection