East Africa leads the world in mobile money, and millions of people now bank, borrow, pay taxes and access government services from their phones. That convenience rests on a fragile assumption: that whoever holds a phone number is its rightful owner. SIM-swap fraud breaks that assumption.
How a SIM-swap attack works
- Research. The fraudster gathers personal details about the victim from social media, data leaks or a phishing call.
- The swap. Posing as the victim, or with help from a corrupt insider, they persuade a mobile operator to move the victim's number to a new SIM card.
- Takeover. The victim's phone suddenly loses signal. The fraudster now receives their calls and SMS messages, including one-time codes.
- Theft. Within minutes they reset passwords and PINs, then drain mobile money wallets, bank accounts or credit lines.
By the time the victim realizes what happened, the money has often moved through several accounts.
Why it matters to your organization
If your bank, SACCO, fintech or government service relies on SMS codes to approve logins, password resets or transactions, SIM-swap fraud is a direct risk to your customers, your losses and your reputation. Customers rarely blame the mobile operator. They blame the institution whose account was emptied. Regulators and the Data Protection Commissioner increasingly expect organizations to protect customers from foreseeable fraud.
Practical controls
- Don't rely on SMS alone. Use app-based authentication, device binding or biometrics for high-risk actions such as password resets and large transfers.
- Check for recent SIM changes. Where mobile operators offer it, check whether a customer's SIM was recently changed before approving sensitive actions, and apply extra verification if it was.
- Add cooling-off limits. Restrict high-value transactions for a period after a SIM change or new device login.
- Monitor behavior. Flag unusual patterns such as a new device, new location and a large transfer together.
- Control insiders. Vet and monitor staff and agents who can change customer details, and require dual approval for sensitive changes.
- Educate customers. Remind them never to share PINs or codes, and to report sudden loss of signal immediately.
- Respond fast. Have a clear process with mobile operators and other institutions to freeze and trace funds.
Questions for leaders
- Which of our customer journeys depend only on SMS codes?
- Can we detect and respond to a recent SIM change before approving a transaction?
- Do we limit high-value activity after a SIM or device change?
- Who in our organization can change customer contact details, and how is that controlled?
- How quickly can we freeze funds when a customer reports fraud?