Mobile Money Is Africa's Largest Attack Surface — and the Security Industry Is Looking the Wrong Way

A practical threat model for SIM-swaps, agent-network, and USSD-session fraud — and the detection patterns that fit it.

Tabempa Engineering — Insights Cybersecurity by Alpha S. Mansaray

The asset nobody modelled

Start with a number that should reorder your priorities. In 2025, more than two trillion US dollars moved through mobile money wallets worldwide, and roughly 1.4 trillion of it flowed through sub-Saharan Africa — about two-thirds of the global total, across 1.2 billion registered accounts. Forty percent of adults in the region now hold a mobile money account, and for one in five adults it is the only financial account they own. Africa did not adopt mobile money. Africa is mobile money.

Now hold that against how the global security industry is built. The dominant threat models, the certification syllabi, the off-the-shelf fraud-detection products — almost all of them were designed around a different financial system: payment cards, corporate networks, browser-based banking, EMV chips, 3-D Secure. That system barely resembles the one most Africans actually transact on, which runs on SIM cards, USSD menus, a phone number that doubles as a bank account, and a human agent at a roadside kiosk converting cash to digital value and back.

The result is an asymmetry that ought to alarm any working defender on the continent: the world's most concentrated digital-finance ecosystem is being defended with threat models that were never written for it. The fraud is extensively documented. A unified, practitioner-facing threat model is not. This article is an attempt to start closing that gap.

A note on register before we proceed: every claim below is sourced, and where the evidence is partial or contested, it is flagged as such. This is a diagnosis meant to be acted on, not a complaint meant to be shared.

The shape of the problem

The headline finding from the research is uncomfortable and clarifying at once. Across the best available survey of the field — a 2025 mixed-methods study covering Kenya, Ghana, Nigeria, Tanzania, Rwanda, and Uganda — between 58% and 72% of mobile money fraud is social engineering, not technical exploitation. Within that, the two dominant vectors are SIM-swap scams (~43%) and agent-assisted fraud (~38%). Direct losses to this fraud were estimated at 1.5 billion US dollars in 2022, and that figure is almost certainly an undercount, because a large share of victims never report — out of shame, futility, or simple absence of recourse.

This tells you immediately where the battle is. It is not, primarily, in the cryptography. It is at the seams where people, SIM cards, and an insecure signalling layer meet. A threat model that fits Africa has to be built around those seams. Here is one, in three surfaces.

Surface 1 — The SIM as skeleton key

In a card economy, your account number and your phone are different things. In a mobile money economy, your phone number is your bank username, and control of the SIM that carries that number is control of the account. This single architectural fact is the origin of the continent's largest fraud class.

Attacker goal: seize the victim's mobile number, then use it to reset the mobile money PIN, intercept one-time passwords, and drain the wallet — frequently also taking out instant loans in the victim's name before anyone notices.

The chain, at threat-model abstraction:

1. Target selection and reconnaissance. The victim's number is not secret — it propagates with every transaction notification sent to a recipient or merchant, and can be saved, shared, or sold. Privacy researchers have noted this leakage is structural to how the platforms broadcast transaction confirmations.
2. The swap. The attacker convinces the mobile operator to port the number to a SIM they control. The decisive weakness is the verification step: in many African markets, SIM replacement requires little more than a name and a number — the very data already exposed. Where staff verification would stop the attack, it is frequently defeated by insider collusion: a bribed telecom employee processes the swap. Security researchers have documented organised syndicates running this play. One 2024 analysis identified at least seventeen such groups active in Nigeria alone, with corrupt-insider fees as low as the equivalent of a few tens of dollars per swap.
3. Takeover. Once the number is live on the attacker's SIM, PIN resets and OTP interception follow, and the account is emptied — often within minutes.

Why it works in Africa specifically: the convergence of three conditions — phone-number-as-identity, weak SIM-replacement verification, and a labour market where insider bribery is cheap relative to the payoff. None of these is present, at this intensity, in the card economies the global frameworks were built for.

The human cost is concrete, not abstract. A senior Nairobi police officer testified in 2022 that scammers replaced his SIM remotely, moved roughly 597,000 shillings out of his wallets, and took loans in his name — all while his phone was physically in his hand. In 2026 Kenyan detectives charged a suspect over a swap that drained about 450,000 shillings from a victim's M-Pesa account while she was abroad. These are not edge cases; they are the modal attack.

Surface 2 — The agent network as a trust exploit

Mobile money's reach depends on its human edge: in 2024 there were roughly 28 million registered agents (about 10 million active monthly), and agents cashed in some 356 billion dollars — over half of all funds entering the ecosystem. That edge is also an attack surface, in two directions.

Attacker-as-impersonator (the dominant agent-fraud pattern): the fraudster poses as an agent, a provider's customer-care representative, or a familiar contact, and talks the victim into revealing a PIN, "reversing" a transaction that never happened, or paying for a deposit that does not exist. This works because of a documented literacy gap: research cited by CGAP found that a large share of users do not understand what a PIN protects — in one Tanzanian study, 29% of active users admitted to sharing their PIN to complete a transaction. You cannot phish a secret the user does not know is a secret.

Agent-and-insider fraud: the agent (or a provider employee) is the attacker. The World Bank's review of mobile financial services catalogues consumer-facing fraud by agents, fraud committed against agents, and internal fraud by provider staff — including a 2011 case in which MTN Uganda lost an estimated 3.4 million dollars to employee collusion, and a 2014 case costing Tigo Rwanda around 700,000 dollars. Internal fraud is the quietest and often the costliest category, because it operates inside the trust boundary every external control assumes is intact.

A risk worth naming explicitly: the evidence shows this fraud is not evenly distributed. Studies cited by CGAP find women digital-finance users in Africa and South Asia are more exposed to social-engineering scams and roughly twice as likely to suffer identity theft. A threat model that treats the user base as uniform will under-protect the people most often targeted.

Surface 3 — The USSD and signalling layer

This is the surface the global frameworks miss most completely, because it lives below the application — in the 1970s-era telecom signalling that still carries these transactions.

Most mobile money in Africa runs over USSD (those *123# menus), chosen because it works on basic feature phones without data. But USSD was not designed as a secure financial channel. As security analyses bluntly put it, USSD is not a particularly secure protocol, which is why operators often run it separately from the financial core. Underneath it sits SS7, the inter-network signalling system whose trust model has, in the words of repeated technical assessments, simply collapsed: it was built for a small club of trusted state carriers and now processes messages from anyone with interconnect access.

Attacker goal: intercept or forge the signalling that authorises a transaction, without ever touching the victim's device.

The two technique families, at abstraction:

• SS7 / USSD forgery and interception. Penetration testing by Positive Technologies demonstrated that an intruder with modest resources can perform USSD forgery requests resulting in fund transfers, intercept the SMS that carries an OTP, and track or manipulate a subscriber, and that even top-tier carriers tested vulnerable. The 2024 interception of European bank customers' SMS at scale used this same class of weakness, with no malware and no software bug — just the protocol.
• USSD-session man-in-the-middle leading to account re-registration. The ITU's Financial Inclusion Global Initiative — the most authoritative public technical treatment of this threat — documents the chain directly: an attacker establishes a man-in-the-middle USSD session, then uses it to register a new device to the victim's account, change the PIN, and add an attacker-controlled number, after which transfers proceed as if legitimate. This is SIM-swap's technical cousin: same outcome, different layer, and almost entirely invisible to an application-layer fraud product.

Why this matters for the model: Surfaces 1 and 2 are exploited through people. Surface 3 is exploited through the network itself, and it is the one an African security team has the least power to fix alone — because the vulnerable infrastructure belongs to the mobile network operator, not to the defender. Hold that thought; it becomes the catch.

Detection patterns that actually fit

A threat model is only useful if it tells you what to watch for. The detection patterns below are mapped to the three surfaces and chosen for realism under African constraints — they assume a small team, intermittent connectivity, and limited leverage over third parties. None is a silver bullet; the point is layered coverage.

Against SIM-swap (Surface 1):

• Correlate "SIM recently changed" with transaction risk. The single highest-value signal is a recent SIM-swap or device change immediately preceding a high-value transfer, PIN reset, or loan request. Where a carrier or regulator exposes a SIM-status check, query it before authorising sensitive actions — this is the design behind Nigeria's regulator-mandated Telecom Identity Risk Management System (TIRMS, 2026) and the GSMA Open Gateway SIM-swap APIs now live on some networks.
• Cooling-off windows. Impose a hold on high-value cash-out for a defined period after a SIM swap or device change. East African markets already use quarantine periods and till restrictions to blunt agent-side fraud; the same logic applies to swaps.
• Velocity and behavioural baselining. Flag rapid-fire sessions, transfers from a new location, or a sudden drain pattern that breaks the account's history.

Against agent and social-engineering fraud (Surface 2):

• Inbound-channel hardening on agent tills. Barring non-provider incoming calls and SMS to agent tills — already used in parts of East Africa — removes a common pretexting vector.
• Anomaly detection on agent behaviour. Watch for tills with abnormal reversal rates, repeated "failed deposit" patterns, or transaction mixes that diverge from peer agents in the same area.
• PIN-never-shared reinforcement in the flow. Because the root cause is users not knowing a PIN is a secret, the cheapest control is in-session messaging in the user's own language at the moment of risk — which connects directly to the localisation gap most awareness programmes ignore.

Against the signalling layer (Surface 3):

• SS7 firewalling and signalling monitoring at the operator edge — the ITU/FIGI report's central recommendation — to detect anomalous MAP/USSD operations and message injection.
• Out-of-band transaction confirmation for high-value transfers, so a forged USSD session alone cannot complete a withdrawal.
• Secure the application-to-gateway link (HTTPS/VPN) and enforce strict session timeouts and termination, closing the session-hijack and re-registration paths at the layer you do control.

The honest hierarchy: Surfaces 1 and 2 are where a determined provider or fintech can move now, mostly with data they already hold. Surface 3 requires the carrier.

The catch: you cannot defend what you don't control

Here is the structural problem the whole field has to confront. The most dangerous part of this threat model — the SIM-replacement process and the SS7/USSD signalling layer — sits inside the mobile network operator, not inside the bank, the fintech, or the security team trying to defend users. A fintech can baseline behaviour, throttle velocity, and harden its own gateway. It cannot fix weak SIM-swap verification at the telco, and it cannot patch SS7. Those require the operator's cooperation, and that cooperation has historically been slow, commercially negotiated, and uneven.

The evidence that this is the binding constraint is in the few places it has been broken. The interventions that actually moved the needle were structural and regulator-forced, not technical heroics by individual defenders:

• Nigeria linked banks directly to the telecom grid via TIRMS — a single, regulator-mandated platform aggregating SIM data from all operators and accessible to every licensed financial institution — because operator-by-operator commercial APIs left gaps. Reported electronic-payment-fraud losses fell from about 52 billion naira in 2024 to about 26 billion in 2025, a roughly 51% drop, alongside identity-linkage efforts (BVN/NIN).
• Kenya's central bank approved Safaricom's request to mask customer phone numbers in transaction notifications in 2026 — a fix aimed squarely at the number-leakage that seeds SIM-swap targeting. Note what it took: a central bank approval, not a product decision.

The lesson for any African security practitioner is therefore double-edged. Most of this threat model is real and immediate; a meaningful slice of the mitigation is not in your hands, and pretending otherwise produces security theatre. The realistic posture is: own everything on your side of the boundary completely, instrument heavily so you can prove where the failure originated, and treat telco and regulator engagement as a first-class part of the security programme rather than an afterthought.

What this means, and where it goes next

The takeaway is not pessimism. It is precision. Africa runs the world's largest and fastest-growing mobile money economy, and it is being defended with imported threat models built for a financial system most Africans don't use. The fraud that results is overwhelmingly social-engineering-led, SIM-and-agent-centric, and signalling-exposed — a profile that off-the-shelf card-fraud tooling barely sees. Closing that gap is not primarily a budget problem or a talent problem. It is a modelling problem, and modelling is cheap. What it requires is the willingness to build for the system that actually exists.

Three things follow for anyone serious about this. First, build the model into the product: SIM-change correlation, agent anomaly detection, and out-of-band confirmation are achievable now. Second, treat the operator relationship as security infrastructure, because the most dangerous surfaces live on their side of the line. Third — and this is the longer game — the continent needs its own threat intelligence and its own published models, generated from African transaction patterns rather than imported from elsewhere, because you cannot defend a system you have only ever described in someone else's terms.

That last point is the thread we will pull in the next piece in this series: why global threat intelligence is structurally blind to Africa, and what it would take to build the telemetry the continent is currently missing.