The verdict in three sentences
Mobile money fraud costs poorly protected merchants an average of 2.1 % of GMV, mainly through SIM swap, OTP phishing and fake merchants. A system combining velocity checks, device fingerprint and blacklists cuts the risk by around 80 % while keeping the false positive rate under 1 %. These controls sit as a layer above the checkout, without complicating the customer experience.
The three most common attacks
Understanding the modus operandi is the first defense. Here are the dominant vectors observed in East Africa in 2026.
| Attack | Mechanism | Impact | Key countermeasure |
|---|---|---|---|
| SIM swap | Replay of stolen SIM | Account takeover | Device fingerprint + delay |
| OTP phishing | Fake agent asks for code | Account drained | Never share the OTP |
| Fake merchant | Fraudulent QR/number | Payment diverted | Merchant identity check |
| Social engineering | Manipulating the agent | Unauthorized withdrawal | Dual approval on high amounts |
| Transaction replay | Forged callback | False confirmation | Verified callback signature |
The defense system and its effectiveness
Each control has a setup cost and a measurable gain. The goal: stack layers without degrading conversion.
| Control | Effect | Fraud reduction | False positives |
|---|---|---|---|
| Velocity check | Caps transactions/hour | -40 % | <0.5 % |
| Device fingerprint | Identifies the device | -25 % | <0.3 % |
| Number blacklist | Blocks repeat offenders | -10 % | ~0 % |
| Callback signature | Prevents replay | Eliminates fake payments | 0 % |
| Suspicious account freeze | Freeze within 24 h | Limits losses | <0.2 % |
| Dual approval | Confirms high amounts | -5 % | <0.5 % |
Combined, these controls bring a 2.1 % GMV loss down to under 0.4 %. The average chargeback cost of 5,000 FCFA makes every prevented fraud directly profitable.
Mini case study
David runs an airtime platform in Kampala processing 9,000,000 FCFA equivalent in monthly volume. Without protection he suffered 2.1 % fraud, or 189,000 FCFA/month in losses. After deploying velocity checks + device fingerprint + callback signature, his loss fell to 0.4 %, or 36,000 FCFA/month. Net saving: 153,000 FCFA per month, for a system integrated once. The false positive rate stayed under 1 %, with no customer complaints.
FAQ
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
What is a velocity check in concrete terms?
It is a rule that caps the number of transactions per number, device or card over a time window. On its own it cuts fraud by around 40 %.
How do I protect against SIM swap?
Combine device fingerprint with a security delay on new devices. An account accessed from an unknown device triggers enhanced verification.
Why is callback signature critical?
Without signature verification, a fraudster can send a fake "paid" callback. Verifying the signature eliminates this replay vector entirely.
How fast to freeze a suspicious account?
The 2026 target is a freeze within 24 h once abnormal behavior is detected, which sharply limits cascading losses.
Do these controls slow down honest customers?
No, if well tuned. The target false positive rate stays under 1 %; the vast majority of legitimate payments go through without friction.
Let's talk about your project. We set up velocity checks, device fingerprint and signed callbacks to cut your fraud fivefold. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
