The verdict in three sentences
SIM swap — a fraudster takes over your number at the operator — and OTP theft through social engineering are the two dominant mobile money frauds in 2026. Reports rose by roughly +30 %, with an average loss of 50,000 to 200,000 FCFA per victim. The defense is three words: app-based 2FA, lockout after 3 failures, and educating customers to never share their code.
Anatomy of an OTP fraud
The OTP is a 4-6 digit code valid for 60 to 120 seconds. The fraudster pushes the victim to read it out (fake support, fake promo) or hijacks the number via SIM swap to receive the code directly.
| 2026 parameter | Typical value |
|---|---|
| OTP length | 4 to 6 digits |
| Validity window | 60 to 120 s |
| Automatic lockout | after 3 failures |
| SIM reactivation after swap | 24 to 72 h |
| SIM swap reports | +30 % vs 2025 |
| Average loss per victim | 50,000 to 200,000 FCFA |
SMS OTP vs app-based 2FA
SMS OTP is vulnerable to SIM swap. 2FA via an authenticator app (locally generated codes) or push notification no longer depends on the SIM card.
| Criterion | SMS OTP | App-based 2FA |
|---|---|---|
| Sensitive to SIM swap | Yes | No |
| Network interception | Possible | Very hard |
| Cost per send | 10 to 25 FCFA | 0 FCFA |
| Works offline | No | Yes (TOTP) |
| Customer experience | Simple | Simple after setup |
| 2026 recommendation | Complement | Default |
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Ibrahim, a restaurateur in Abidjan, takes 250 online orders per month via mobile money. A SIM-swapped customer disputes 3 hijacked transactions of 45,000 FCFA, i.e. 135,000 FCFA at stake. By enforcing a 100,000 FCFA/day cap on unverified accounts and app-based 2FA re-confirmation beyond it, Ibrahim would have blocked the third operation and limited the loss to 90,000 FCFA, while earning the customer's trust.
FAQ
What exactly is a SIM swap? A fraudster convinces the operator to move your number to a new SIM. They then receive your OTPs. In 2026 reports rose by about 30 % and a legitimate reactivation takes 24 to 72 h.
How long is an OTP valid? Between 60 and 120 seconds depending on the operator, with automatic account lockout after 3 consecutive failures. That short window limits brute-force attempts.
Is app 2FA really safer? Yes: codes are generated locally on the phone, never crossing the network, so they are immune to SIM swap and interception. It is free, versus 10 to 25 FCFA per SMS.
What average loss does a victim suffer? Between 50,000 and 200,000 FCFA in 2026, often across several rapid operations before the victim reacts. Hence the value of daily caps.
What should the merchant do concretely? Cap new accounts, require app-based 2FA beyond a threshold, lock out after 3 failures, and display a reminder: "No agent will ever ask you for your code."
Let's talk about your project. We integrate 2FA, caps and awareness messages into your payment funnel. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
