The verdict in three sentences
Mobile-money payment fraud costs an unprotected African online store an average of 0.5% to 2% of revenue in 2026. The three dominant vectors are the fake payment screenshot, SIM swap, and the abusive refund (friendly fraud). The only reliable defense is technical: only a server-side signed webhook confirms an order, never a screenshot received over WhatsApp.
The three frauds that empty a till
A merchant who validates an order on a simple Wave or M-Pesa "receipt" is directly exposed. A fake screenshot is now generated in seconds with editing apps. SIM swap targets sellers themselves: the fraudster takes over your number and intercepts validation codes. Friendly fraud comes from the seemingly honest customer who disputes after delivery.
| Fraud type | Warning signal | Recommended countermeasure |
|---|---|---|
| Fake payment screenshot | Screenshot sent, no webhook received | Never confirm without a signed server notification |
| SIM swap (merchant account) | Sudden loss of network, missing SMS codes | Enable carrier PIN + app 2FA, login alerts |
| Abusive refund | Dispute opened after confirmed delivery | Signed proof of delivery + clear return policy |
| Velocity fraud | 5+ payment attempts in 2 minutes | Automatic block by IP/number (velocity check) |
| Stolen-card testing | Repeated micro-amounts (100-500 FCFA) | Minimum cart threshold + checkout captcha |
| Rider overcharge | Gap between amount collected and order | Daily reconciliation of takings vs. orders |
Three simple, low-cost anti-fraud rules
Protection doesn't need a bank's budget. Three rules cover most of the risk for an SME.
| Rule | How to apply it | Setup cost |
|---|---|---|
| Mandatory webhook check | "Paid" status validated only by a signed Wave/M-Pesa callback | Included in a clean integration |
| Amount threshold | Manual review above 500,000 FCFA | 0 FCFA, internal procedure |
| Velocity check | Max 3 attempts / 10 min per number or IP | A few dev hours |
| Number blocklist | Block numbers already flagged | 0 FCFA, spreadsheet or DB |
| Proof of delivery | Signature or photo at handover | Cost of a simple module |
The average cost of fraud isn't only the lost cart: add the processing fees already paid, the shipped product and the time spent on the dispute. On a 40,000 FCFA cart, the real loss often exceeds 50,000 FCFA once everything is added up (2026 order of magnitude).
Mini case study
Awa runs a cosmetics shop in Dakar and processes 300 orders a month at a 25,000 FCFA average basket, i.e. 7,500,000 FCFA in volume. At a 1.5% fraud rate on orders validated by WhatsApp screenshot alone, she was losing about 112,500 FCFA per month. After enforcing webhook confirmation and a 3-attempt velocity check, the rate dropped below 0.3%, cutting the loss to 22,500 FCFA: a 90,000 FCFA monthly saving, over one million FCFA a year.
FAQ
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Is a Wave payment screenshot sufficient proof?
No, never. A screenshot can be faked in seconds and has no legal or technical value. Only the operator's signed webhook notification, received on your server, confirms that a payment of X FCFA is actually credited.
What is a velocity check and why does it help?
It's a rule that limits the number of payment attempts in a time window, e.g. 3 tries in 10 minutes per number or IP. It blocks stolen-card testing and the automated attacks that make up a growing share of attempts in 2026.
Can SIM swap target my merchant account?
Yes. If your number receives validation codes, a fraudster who clones it can intercept your access. Enable a carrier PIN, app-based two-factor authentication (not SMS) and login alerts.
What fraud rate is considered normal in African e-commerce?
Between 0.5% and 2% of volume depending on sector and protections in place. Below 0.5% your setup is solid; above 2% there's a structural flaw to fix urgently.
Is friendly fraud common?
Yes, it's the "friendly" fraud: a real customer disputes after receiving the product. Signed proof of delivery and a written return policy accepted at checkout sharply reduce this risk.
Let's talk about your project. We audit your payment funnel and set anti-fraud rules matched to your volume. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
