The verdict in three sentences
The most common mobile money fraud is not technical but social: the fake confirmation SMS accounts for nearly 30% of cases merchants suffer. The golden rule: never validate an order on the strength of an SMS, only on an operator API callback confirmation. A baseline fraud rate of about 0.8% can be cut several times over with three simple controls.
The red flags to watch
Most fraud follows known patterns. A back office that surfaces these signals in real time lets you block before shipping, not after.
| Signal | What it reveals | Control |
|---|---|---|
| Customer shows a confirmation SMS | Likely fake SMS | Mandatory API callback |
| More than 5 tx/minute same account | Card testing / bot | Velocity rule |
| Payment then immediate cancel request | Reversal-window abuse | Delay before shipping |
| Beneficiary number changed after order | Payout hijack | Number lock |
| KYC name ≠ delivery name | Stolen account / SIM-swap | Manual review |
The fixes that actually work
Three controls cover the majority of the risk. They cost almost nothing to set up and are configured in the payment module.
| Fix | Effect | Setup cost |
|---|---|---|
| Callback-only confirmation | Kills fake SMS (~30% of fraud) | Low (webhook) |
| Velocity rule (>5 tx/min) | Blocks bots and testing | Low |
| Anti-reversal window | Cuts cancellation abuse | Low |
| Recent SIM-swap alert | Detects hijacked accounts | Medium (operator API) |
| Full logging | Evidence in disputes | Low |
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Aminata sells phones in Dakar and used to hand over the device as soon as a customer showed her a confirmation SMS. In three months she lost 4 phones (worth ~600,000 FCFA) to fake SMS. Switching to callback-API-only validation — the order flips to "paid" only if the operator confirms server-side — she brought her fraud from 0.8% to under 0.1%, saving the equivalent of 1.8M FCFA a year in stock not diverted.
FAQ
Why not trust the confirmation SMS? Because an SMS is trivial to forge or simulate with an app. Fake SMS accounts for about 30% of merchant fraud. Only the operator's server-side callback API confirmation is authoritative.
What is a velocity rule? An automatic control that flags or blocks an account making, say, more than 5 transactions per minute. It is the best filter against bots and stolen-account testing.
What is reversal-window abuse? The fraudster pays, gets the shipment, then exploits the operator's cancellation window to claw back the money. A delay before shipping covering that window neutralises the attack.
Is SIM-swap a real risk? Yes. A hijacker controlling the number can drain a wallet or approve payments. Comparing the KYC name to the delivery name and monitoring recent SIM-swaps helps detect these accounts.
What fraud rate is normal? A baseline around 0.8% is common with no controls. With callback confirmation, velocity and logging, it often drops below 0.2%.
Let's talk about your project. We can install callback confirmation, velocity rules and fraud alerts in your payment system. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
