The verdict in three sentences
The fake payment SMS and the edited confirmation screenshot are the most common frauds against online sellers across West Africa in 2026, because they cost the scammer nothing and exploit your eagerness to ship. The only reliable defence is server-side verification: a signed webhook or a status API call, never an image or an SMS the customer shows you. A merchant who ships on visual proof alone loses on average 2% to 6% of revenue in vanished goods.
Why visual proof proves nothing
A screenshot is just an image file: any free photo editor lets you change an amount, a name or a date in ten seconds. An SMS can be spoofed with a fake sender ID that reads "MoMo" or "Payments". Even a phone call from a supposed "agent" asking you to "confirm receipt" is a textbook social-engineering play.
Payment truth exists in exactly one place: the operator's servers. Your site must query that source, not the customer's screen.
| "Proof" channel | Forgeable? | Real reliability | Use it? |
|---|---|---|---|
| Screenshot sent by the customer | Yes, in 10 s | None | Never |
| SMS "receipt" shown by the customer | Yes | None | Never |
| Call from an "agent" confirming | Yes | None | Never |
| Status checked in your merchant app | No | Medium | For troubleshooting |
| Signed webhook (HMAC) hitting your server | No | High | Always |
| Server-side status API call | No | High | Always |
Server-side verification, concretely
When a customer pays, the operator (Flutterwave, MTN MoMo, Paystack) sends a notification to your server: the webhook. That message is signed with a secret key (HMAC signature) known only to the operator and you. Your code recomputes the signature: if it matches, the payment is authentic. You release the shipment only after that green light.
| Warning sign | What the fraudster does | Server-side response |
|---|---|---|
| "I already paid, look" | Shows a screenshot | Verify status by transaction ID |
| Slightly different amount | Edits the figure | Compare to the exact expected amount |
| Extreme urgency, "I'm leaving" | Pushes you to ship fast | Minimum delay before shipping |
| Reference not found | Invents a code | No webhook = no payment |
| Payment stuck "pending" | Abandoned session | Status != SUCCESS => block |
Golden rule: no signed webhook, no shipment. Also set a buffer delay (say 15 to 30 minutes) for high-value orders while the status settles.
Mini case study
Ada runs a cosmetics shop in Lagos and sells heavily on Instagram. Over one month she gets 140 orders; 6 customers present a fake transfer screenshot. Average basket: 32,000 FCFA equivalent. Before, she shipped on trust: 6 x 32,000 = 192,000 FCFA of goods lost, plus delivery costs. After wiring a signed webhook into her site, those 6 orders stay locked at "unpaid": the loss drops to 0. Setup cost: one day of development, recouped in the first month.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
What share of revenue can I lose without verification?
Between 2% and 6% depending on sales channel and average basket, based on 2026 order-of-magnitude figures among social sellers. On revenue of 3,000,000 FCFA a month, that is 60,000 to 180,000 FCFA gone.
What does a fraudulent order cost on average?
Between 15,000 and 80,000 FCFA depending on the product, goods plus delivery included. A single lost electronics order can wipe out the margin of ten honest sales.
Is a webhook hard to set up?
No: it is a URL on your server that the operator calls. Typical development takes one to two days and is tested in a sandbox before going live.
What if I only sell on WhatsApp with no website?
At minimum, use your official merchant app to verify each transaction by its ID, and never ship on a screenshot alone. A mini-checkout tied to a webhook remains the safest option.
Should I require verified prepayment from everyone?
For orders above 50,000 FCFA or to an unknown address, yes. Below that, a 15-minute buffer plus the webhook usually suffices.
Let's talk about your project. We wire server-side payment verification into your store to kill fake-transfer fraud. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
