Festive scams and SIM-swap fraud threaten Africa’s $81 billion mobile-money industry

Mobile-money platforms across Africa processed roughly $81 billion in transactions last year, and December’s festive transfers could push that figure even higher.

• A new report projects a rise in cyberattacks across Africa as mobile money transfers hit their annual peak in December.
• Holiday-themed phishing scams, SIM-swap fraud, and social-engineering tactics are targeting users sending money home.
• Kenya alone has recorded an estimated $230 million in cyber-related losses this year, with continent-wide losses nearing $5 billion.
• Experts say stronger authentication, AI-driven defence tools, and better consumer awareness are now critical.

That is a fresh warning from cybersecurity firm ESET Africa, which cautions that phishing, SIM-swap fraud, and social-engineering attacks are poised to rise alongside the year-end surge.

The new report highlights the seasonal risks as families increasingly send money home for Christmas.

Fraudsters are exploiting the goodwill and urgency of the period, deploying holiday-themed phishing promotions, hijacking SIM cards of high-balance accounts, and using impersonation or social pressure to trick users into divulging confidential data.

“Trust in mobile money doesn’t happen instantly – it’s built one safe transaction at a time,” said cybersecurity engineer Allan Juma.

He warned that just one successful scam can erode confidence not only for the victim, but for their wider social circle: “When someone gets scammed, they often stop using mobile money altogether, and warn friends and family to do the same, creating a ripple effect that stalls progress for everyone.”

According to Juma, a major contributing factor is that many mobile-money services have failed to keep pace with the growing confidence users place in them.

“Unlike traditional banking apps, many services still lack advanced encryption and rely on simple four-to-six-digit PINs instead of stronger, multi-layered authentication.”

He added that these shortcomings make it easier for criminals to intercept data, hijack accounts, and undermine the adoption of digital finance across the continent.

The warning coincides with a sobering report from Kenyan cybersecurity firm Serianu, which estimates that Kenya alone has suffered cyber-related losses of roughly $230 million this year.

Their 2025 Africa-wide study, based on responses from 280 organisations, estimates total losses across the continent at $5 billion.

According to Serianu’s findings, payment fraud remained the most frequently reported security incident. Online and email fraud together accounted for 40 per cent of all reported incidents and around 32 per cent of total estimated losses.

The report notes a growing trend of AI-enabled blended attacks that combine phishing, credential theft, ransomware, and impersonation across financial and public-sector systems.

William Makatiani, Serianu’s CEO, said these findings underscore the urgent need for companies to shift from reactive security measures to resilience-oriented strategies.

While some organisations are accelerating investments in cyber-defence, attackers are evolving faster. Makatiani stressed that artificial intelligence, once heralded as a key safeguard, now requires defenders to rethink how they protect systems and data in its entirety.

Meanwhile, Juma emphasised that consumer vigilance remains an essential second line of defence. Basic actions such as enabling two-step verification and being alert to suspicious messages requesting PINs or personal information could make the difference between a secure festive season and severe financial loss.

As mobile money adoption continues to grow rapidly, the combination of high-volume festive transfers and pervasive security gaps threatens to undermine the trust that underpins Africa’s digital finance revolution.