Ubuntu Pay is a cross-border payment protocol that uses Nokia's cellular network infrastructure as a cryptographic trust oracle. By combining Nokia Network as Code CAMARA APIs with Gemini 3.1 AI scoring and Polygon blockchain settlement, we enable any African with a SIM card to send and receive money across borders in 11 seconds for less than 1% in fees — with no smartphone, no bank account, and no seed phrase.
"We are not moving money. We are moving trust. The SIM is the passport. The phone number is the bank account number. Nokia is the identity layer."
850 million Africans have no bank account. This is not an accident — it is a business decision made by legacy financial institutions that calculated these populations were not profitable to serve.
The consequences are severe. Cross-border remittances — which represent a larger share of GDP than foreign direct investment in many African countries — cost between 7% and 16% through Western Union. A house painter in Nairobi sending KES 5,000 to his family in Lagos loses KES 840 to fees. Ubuntu Pay charges KES 15.
Existing solutions fail for different reasons. M-Pesa GlobalPay requires a smartphone and charges ~7%. Cryptocurrency wallets require seed phrases that illiterate users cannot safely store. Account abstraction platforms still require internet connectivity. Ubuntu Pay requires only a basic phone and the ability to dial *384#.
The core insight of Ubuntu Pay is that every African SIM card already contains a richer identity signal than any government ID document: the MSISDN (phone number), IMSI (SIM card identity), and IMEI (device hardware identity) are known to the cellular network and cannot be spoofed by an attacker who does not physically possess the SIM in the original device.
We use these three identifiers — combined with a user-chosen 4-digit PIN and run through Argon2id memory-hard key derivation — to deterministically generate a Polygon wallet address. The key is never stored. It is regenerated on demand whenever the user needs to transact.
If a SIM is stolen and moved to a new device, Nokia's CAMARA APIs detect the IMEI change. The wallet derivation produces a different address for the attacker — the original address is inaccessible without the original device. The Nokia network is, effectively, a hardware security module.
Nokia Network as Code exposes standardised CAMARA APIs that provide real-time signals from the cellular radio network. Ubuntu Pay uses six of these APIs in parallel for every transaction:
d.verify_device_swap(max_age=72) → device_changed: bool
Detects whether the SIM was moved to a different physical device within the last 72 hours. 94% of mobile wallet drains follow a device swap event. This single signal eliminates the majority of account takeover attacks.
d.get_sim_swap_date() → compare to now() - timedelta(hours=72) → sim_swapped: bool
Checks whether the physical SIM card itself was replaced recently. Distinct from device swap — this catches attackers who obtained a replacement SIM from the operator via social engineering.
d.verify_number(access_token="") → number_verified: bool
Silently confirms the device owns the phone number via cellular data. No OTP SMS is sent — this check cannot be intercepted by a SIM swap attacker who has redirected the number to their own device.
d.get_kyc_match() → kyc_score: float (0.0–1.0)
Matches the current SIM holder's identity against the operator's SIM registration records. A score below 0.5 indicates the person holding the phone is not the registered SIM owner.
verify_location_proximity(agent_lat=-1.286389, agent_lng=36.817223) → near_agent: bool, delta_m: int
Confirms the device is physically near the agent location at the point of cash-in. An attacker attempting a remote transaction cannot fake physical proximity at the cellular network layer. Delta under 50 metres is required for cash-in transactions.
d.get_roaming() → roaming: bool, country_code: str
Verifies the physical location of the device. A transaction from a Nairobi-registered number where the device is physically in Budapest is an immediate high-risk signal. Gemini scores this as 0/100 and blocks the transaction.
All 6 Nokia CAMARA signals are assembled into a structured forensic case file and sent to Gemini 3.1 Flash-Lite. The model returns a trust score from 0 to 100, a decision (ALLOW/BLOCK/STEP_UP), and plain-English reasoning. The minimum passing score is configurable in TrustGate.sol (default: 70).
Joseph dials *384#
↓
USSD Gateway (FastAPI)
↓
Trust Oracle — POST /trust/check
↓ ↓ ↓ ↓ ↓
Nokia NaC CAMARA APIs (parallel)
↓
Gemini 3.1 Flash-Lite scoring
↓
Score ≥ 70 → ALLOW
↓
Yellow Card: KES → USDC
↓
TrustGate.sol: USDC escrow (15s)
↓
TrustGate.sol: finalizeTransfer()
↓
Yellow Card: USDC → NGN
↓
John's MTN MoMo wallet
Ubuntu Pay removes the seed phrase entirely. A user's wallet address is derived deterministically from four factors that only they can provide:
network_access_iddevice_ididentity_bundle = f"{msisdn}:{imsi}:{imei}".encode()
salt = sha256(identity_bundle)[:16]
private_key = argon2id(
secret = pin.encode(),
salt = salt,
time_cost = 3,
memory_cost = 65536, # 64MB — brute force resistant
parallelism = 4,
hash_len = 32
)
wallet_address = eth_account.from_key(private_key).address
The 64MB memory cost of Argon2id makes brute-forcing a 4-digit PIN computationally expensive — approximately 186 days on a modern GPU for all 10,000 possible PINs. Combined with Nokia's device swap detection, any attacker who obtains the PIN but not the original SIM in the original device will derive a different wallet address.
Ubuntu Pay uses USDC on Polygon Amoy as an invisible settlement rail. Users never interact with cryptocurrency — Joseph sees KES, John sees NGN.
POST /deposit.execute() function places USDC in a 15-second escrow with the check ID.finalizeTransfer() releases USDC to the receiver's address.Total time: approximately 11 seconds. Total fee: 0.3% (KES 15 on KES 5,000). Western Union equivalent: KES 840 (16.8%).
TrustGate.sol is deployed on Polygon Amoy at 0xaa5D997CaD5C528DCf9AC1D07d8DD5154C3D66D5. It provides:
Ubuntu Pay operates a dual-engine business model: B2C payments and B2B Trust-as-a-Service.
The B2B Trust Oracle is the highest-margin revenue stream. It requires no payment licence in any jurisdiction — it is purely a data API. The same Nokia + Gemini infrastructure that protects Ubuntu Pay users can be sold to Zenith Bank, Equity Bank, Capitec, or any African fintech at $0.05 per call.
Ubuntu Pay is not competing with banks. It is building the infrastructure for the people banks decided were not worth serving. The technology stack is live: Nokia NaC is connected to the real Safaricom network, Gemini 3.1 is scoring transactions, TrustGate.sol is deployed and verified on Polygon Amoy, and the full end-to-end flow from USSD dial to MTN MoMo payout has been demonstrated.
The painter does not know what USDC is. He just got paid in 11 seconds for KES 15. That is the product. That is Ubuntu Pay.
Live demo: ubuntupay.africa/demo-ussd · Pitch deck: ubuntupay.africa/deck · Smart contract: Polygonscan