The verdict in three sentences
Mobile money fraud stays rare — around 0.15 % of transactions — but it is getting professional: SIM swap up 23 % in 2025, fake transfers and fake screenshots making up 60 % of attempts. The defense is not one wall but a chain of controls: webhook verification (never a screenshot), OTP, and velocity rules. Well calibrated, that chain prevents an average of KES 6,000 in losses per month without breaking conversion.
The frauds that target mobile money
Most attacks break no technology: they exploit human trust. The fraudster sends a fake SMS or a screenshot "proving" a payment, and the seller releases goods before real verification.
| Fraud type | Frequency (2026) | Target | Key defense |
|---|---|---|---|
| Fake payment screenshot | 60 % of attempts | Seller | Operator webhook |
| Fake confirmation SMS | 20 % | Seller | API status |
| SIM swap | +23 % in 2025 | Customer account | OTP + callback |
| Social engineering (OTP) | 12 % | Customer | Awareness |
| Fraudulent refund | 8 % | Merchant | Velocity rules |
The golden rule: never validate an order on the strength of a screenshot. Only the operator's confirmation webhook counts.
Controls and their impact on conversion
Each control adds security but can add friction. The art is dosing it by amount and risk.
| Control | Fraud effect | Conversion impact | Cost |
|---|---|---|---|
| Confirmation webhook | Kills fake payments | None | Integration |
| OTP on large baskets | -70 % SIM swap | -1 to -2 % | Low |
| Velocity rules | Blocks bursts | Near zero | Config |
| Callback verification | -60 % account fraud | None | Integration |
| Manual hold > threshold | Filters big risks | -0.5 % | Agent time |
Webhooks and velocity rules are mostly a one-time integration cost; reserve OTP for risky baskets to limit friction.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Koffi sells phones in Nairobi, 900 orders/month, KES 8,000 basket. He used to release goods on a screenshot, losing about KES 6,000/month to fraud. By requiring webhook confirmation, adding OTP on baskets above KES 15,000, and velocity rules (max 3 attempts/10 min), he brings losses near zero. Cost: a one-time integration and just a 1.5 % conversion dip on large baskets, largely offset.
FAQ
Is a payment screenshot proof? No, never. 60 % of fraud attempts rely on fake screenshots. Only the operator's confirmation webhook proves a real payment.
What is SIM swap? The fraudster gets the victim's number moved to a new SIM to intercept their OTPs. These attacks rose 23 % in 2025; callback verification and OTP limit them.
Does OTP hurt conversion? Slightly, 1 to 2 % on affected baskets. Reserving it for high amounts keeps the impact marginal against the losses prevented.
What are velocity rules? Rules that block suspicious bursts, e.g. more than 3 payment attempts in 10 minutes from one profile. They cost almost nothing in conversion.
How much can I save? On a typical merchant profile, a well-tuned control chain prevents an average of KES 6,000 in losses per month for a one-time integration cost.
Let's talk about your project. We integrate webhook verification, smart OTP and velocity rules to secure your payments without breaking sales. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
