The verdict in three sentences
Mobile money fraud in e-commerce is almost never sophisticated: most often it is a fake SMS or a doctored payment screenshot sent to the seller. On orders that are not verified server-side, it hits 3 to 5% of transactions in 2026. The defense is simple and free: check the real transaction status with the operator, never the customer's screen.
The most common frauds and their countermeasures
Three families dominate: the fake payment proof, reference replay (reusing one real payment for two orders), and cash-on-delivery fraud. Each has a detectable signal and an automatable control.
| Fraud type | Warning signal | Automated control | Risk reduction |
|---|---|---|---|
| Fake payment SMS/screenshot | Operator status ≠ "paid" | Server-side status check | ~95% |
| Replayed reference | Same ref on 2 orders | Reference uniqueness | ~90% |
| Amount mismatch | Received < order total | Match amount + ref | ~85% |
| Multi-accounts same number | Abnormal velocity | Number velocity check | ~70% |
| Blacklisted numbers | History of non-payment | Automatic blacklist | ~80% |
| Delivery fraud (vague address) | Inconsistent address | Address score + deposit | ~60% |
The 10 controls to switch on
Beyond the cases above, here is the operational checklist with setup effort. The guiding principle never changes: the source of truth is the operator's API, not the buyer's phone.
| Control | Setup effort | Priority |
|---|---|---|
| Systematic server-side status check | Medium | Critical |
| Exact amount + reference match | Low | Critical |
| Webhook idempotency | Medium | Critical |
| Transaction reference uniqueness | Low | High |
| Per-number velocity check | Medium | High |
| Number/account blacklist | Low | High |
| Mobile money deposit on COD | Low | Medium |
| Unusual-amount alert | Low | Medium |
| Timestamped audit log | Medium | Medium |
| 3-DS / OTP on international card | Low | Medium |
Mini case study
Moussa sells electronics in Abidjan: 300 orders/month, average cart 45,000 FCFA, i.e. 13,500,000 FCFA of revenue. He used to validate orders on a simple WhatsApp screenshot and suffered 4% fake payments, i.e. 12 phantom orders/month = 540,000 FCFA of goods lost (plus shipping costs). He wires in server-side status verification with amount + reference matching: fake payments drop below 0.3%. He now loses only about 40,000 FCFA/month. Net gain: ~500,000 FCFA/month protected, for a build shipped in one week.
FAQ
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Is a payment screenshot enough as proof?
No, never. A screenshot can be faked in thirty seconds. The only valid proof is the status confirmed by the operator's API server-side, cross-checked with the exact amount and reference.
How big is fake-SMS fraud really?
On orders not verified server-side, it is estimated at 3 to 5% of transactions in 2026. Once server verification is in place, it typically drops below 0.5%.
What is webhook idempotency and why is it critical?
It means processing the same payment event only once, even if the operator sends it multiple times. Without it, an order can be validated or shipped twice: it is a critical control for both security and accounting.
How do you fight cash-on-delivery fraud?
Requiring a small mobile money deposit (e.g. 10% or 5,000 FCFA) filters out most fake orders. Combined with an address score, it cuts risk by about 60%.
Is a number blacklist legal?
Yes, keeping an internal list of numbers tied to proven non-payment or fraud is a legitimate risk-management measure. It must stay proportionate and documented to respect data protection.
Let's talk about your project. We secure your payment funnel with server verification, idempotency and anti-fraud controls. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
