Key Findings
- 1Mobile money transaction value in Sub-Saharan Africa reached US$1.1 trillion in 2024 across 1.1 billion registered accounts (GSMA State of the Industry Report on Mobile Money 2025).
- 2Industry fraud losses on mobile money and wallet rails are directionally estimated at 0.15%–0.35% of transaction value — i.e. roughly US$1.6B–US$3.8B annually in SSA (IdeaToola directional estimate, triangulated from operator disclosures and GSMA Mobile Money Fraud Typologies 2024; not a published GSMA figure).
- 3Social engineering — SIM-swap, impersonation of agents/operators and phishing — is the dominant attack vector on African wallets, consistent with the typologies catalogued by GSMA's Mobile Money Fraud Typologies & Mitigation guide (2024) and SABRIC's 2024 digital-banking fraud disclosures (Sept 2025).
- 4Social-engineering-driven digital banking fraud is the #1 reported channel in South Africa — 65.3% of digital fraud incidents in 2024 (SABRIC Annual Crime Stats, published Sept 2025) — with comparable patterns flagged by the Central Bank of Kenya (2024 Bank Supervision Report) and the Central Bank of Nigeria's 2025 draft rules on push-payment fraud.
- 5Operators that combine real-time ML scoring, device intelligence, dynamic transaction limits and confirmation-of-payee report material reductions in fraud loss rate within 12 months — vendor case studies cluster in the 30–60% range, though no audited industry benchmark exists (IdeaToola synthesis of vendor case studies; treat as directional).
- 6Four markets — Kenya, Nigeria, Ghana and Côte d'Ivoire — concentrate the bulk of SSA mobile-money flow; Kenya alone settles >US$300B/yr via M-PESA (Safaricom M-PESA Integrated Report 2025), making it the single largest fraud-target rail on the continent.
- 7Liability is moving from the consumer to the operator: UK PSR (Oct 2024), EU IPR Verification-of-Payee (Oct 2025) and Singapore SRF (Dec 2024) are all live, and Kenya's CBK Consumer Protection Guidelines (2025 draft) and the CBN's draft push-payment fraud rules signal the same direction for Africa.
Why This Matters Now — The Scale of the Rails
Mobile money is no longer a niche financial-inclusion product. 's State of the Industry Report on Mobile Money 2025 puts Sub-Saharan Africa at 1.1 billion registered accounts and US$1.1 trillion of transaction value in 2024 (≈+15% YoY). When a rail moves that much money — and increasingly carries merchant payments, salaries, government disbursements and cross-border remittances — it becomes a primary target for organised fraud. Fraud loss rates that look small in percentage terms (15–35 basis points) translate into billions of dollars of consumer and operator losses, and into a measurable erosion of trust at exactly the moment regulators want wallets to substitute for cash.
Annual processed value across registered mobile-money accounts
Start
0.49
2020
Peak
1.1
2024
Trough
0.49
2020
Net change
+124.5%
2020 → 2024
| Series | 2020 | 2021 | 2022 | 2023 | 2024 |
|---|---|---|---|---|---|
| US$ Trillions | 0.49 | 0.7 | 0.83 | 0.91 | 1.1 |
Source: GSMA State of the Industry Report on Mobile Money 2021–2025.
VerifiedTop
Global registered accounts · 2,100
56.5% of total
Bottom
Global 30-day active · 514
13.8% of total
Average
1,238
3 categories
Total
3,714
Sum of series
| Series | Global registered accounts | Global 30-day active | SSA registered accounts |
|---|---|---|---|
| Value | 2,100 | 514 | 1,100 |
Source: GSMA State of the Industry Report on Mobile Money 2025 (global registered 2.1B, global 30-day active >500M, SSA registered 1.1B). SSA-specific 30/90-day active splits not separately disclosed in the public GSMA summary.
VerifiedFour markets concentrate the bulk of continental flow — and therefore the bulk of the fraud opportunity
Top
Kenya (M-PESA + others) · 314
35.9% of total
Bottom
Senegal · 41
4.7% of total
Average
124.9
7 categories
Total
874
Sum of series
| Series | Kenya (M-PESA + others) | Ghana | Côte d'Ivoire | Tanzania | Nigeria | Uganda | Senegal |
|---|---|---|---|---|---|---|---|
| Value | 314 | 212 | 96 | 82 | 71 | 58 | 41 |
Source: IdeaToola directional estimate, June 2026. Anchors: Safaricom M-PESA Integrated Report 2025 (Kenya US$314B FY2025); Bank of Ghana Summary of Economic & Financial Data 2025 (mobile money value); BCEAO WAEMU Digital Payments Bulletin 2024 (Côte d'Ivoire, Senegal); Bank of Tanzania National Payments Report 2024; NIBSS Instant Payments 2024 (Nigeria mobile-money slice; bulk of NG flow runs through bank-led NIP rails, not wallets). Values rounded.
VerifiedThe Threat Surface — How Wallet Fraud Actually Happens
Wallet fraud is dominated by social engineering, not by cryptographic attacks on the rails themselves. 's Mobile Money Fraud Typologies & Mitigation guide (2024) catalogues impersonation, SIM-swap, agent collusion and phishing as the persistent dominant categories across African networks. 's 2024 Annual Crime Stats reinforce the same picture for South Africa: digital banking fraud was the #1 channel at 65.3% of reported digital incidents, the bulk of it driven by social engineering rather than direct system compromise. Authorised push-payment (APP) scams — where the victim themselves initiates the transfer to a fraudster — are the fastest-growing variant of this on every major African wallet network and are explicitly named in the 's 2025 draft rules on push-payment fraud.
IdeaToola directional estimate — typology shares aligned to GSMA 2024 typology catalogue and SABRIC 2024 stats. Not a single-source survey.
- Social engineering / impersonation41.0%
- SIM-swap & account takeover21.0%
- Agent-led fraud (rogue agents)14.0%
- APP push-payment scams (romance, investment, business email)16.0%
- Malware / phishing / SMShing6.0%
- Internal / staff collusion2.0%
| Series | Social engineering / impersonation | SIM-swap & account takeover | Agent-led fraud (rogue agents) | APP push-payment scams (romance, investment, business email) | Malware / phishing / SMShing | Internal / staff collusion |
|---|---|---|---|---|---|---|
| Value | 41 | 21 | 14 | 16 | 6 | 2 |
| Share % | 41.0% | 21.0% | 14.0% | 16.0% | 6.0% | 2.0% |
Source: IdeaToola directional estimate, June 2026. Typology framework: GSMA Mobile Money Fraud Typologies & Mitigation (2024). Anchor data point: SABRIC Annual Crime Stats 2024 (Sept 2025) — digital banking fraud 65.3% of digital incidents in SA.
VerifiedIdeaToola directional index. Captures the broad up-trend in social-engineering and push-payment fraud reported by regulators and bank associations; not a published case-volume time series.
| Series | Push-payment / impersonation scams | SIM-swap takeover | Agent-led fraud | Card-on-file / 3DS bypass |
|---|---|---|---|---|
| South Africa (SABRIC) | 168 | 142 | 96 | 78 |
| Kenya (CBK) | 155 | 121 | 88 | 84 |
| Nigeria (CBN / NIBSS) | 191 | 134 | 109 | 71 |
Source: IdeaToola directional index, June 2026. Underlying narratives: SABRIC Annual Crime Stats 2024 (Sept 2025); CBK Bank Supervision Annual Report 2024; CBN draft rules on push-payment fraud (2025). Index values illustrative of disclosed direction of travel, not audited case counts.
VerifiedAnatomy of an APP Scam — Funnel from Contact to Realised Loss (per 1,000 targeted users)
Directional funnel reconstructed from GSMA typology guide (2024) and UK PSR APP Fraud Performance Report 2025 — pattern observed on African wallets
Source: IdeaToola directional reconstruction, June 2026. Methodology aligned to UK PSR APP Fraud Performance Report 2025 funnel framework and GSMA Mobile Money Fraud Typologies (2024). Not a published African-market funnel; directional only.
Data Story — Where the Losses Actually Land
The fraud-loss conversation usually collapses to a single industry number. The more useful view is to decompose it: who bears the loss, on which leg of the journey, and at what stage of the customer lifecycle. The charts below reconstruct an IdeaToola directional estimate of an SSA wallet-fraud loss pool — anchored on the GSMA-confirmed US$1.1T 2024 processed value and a 0.15%–0.35% loss-rate range triangulated from operator disclosures and the Mobile Money Fraud Typologies (2024) guide. The figures are not a published GSMA or regulator number. The headline finding: consumers absorb the majority of losses today, but regulators in three of the largest markets (South Africa, Kenya, Nigeria) are actively shifting liability toward operators and receiving banks.
Estimated SSA Wallet-Fraud Loss Pool — Build-Up (US$ Millions, 2024)
Midpoint estimate of 0.22% loss rate on US$1.1T processed value
Source: IdeaToola directional estimate, June 2026. Loss-rate range 0.15%–0.35% triangulated from operator disclosures and the GSMA Mobile Money Fraud Typologies & Mitigation guide (2024); midpoint 0.22% applied to the GSMA-confirmed US$1.1T 2024 SSA processed value (GSMA SOTIR 2025). Not a published GSMA loss number.
VerifiedShare of net realised losses, 2024
- Consumers (uncovered APP scams, SIM-swap)58.0%
- Mobile money operators22.0%
- Partner / receiving banks12.0%
- Merchants & aggregators6.0%
- Insurers2.0%
| Series | Consumers (uncovered APP scams, SIM-swap) | Mobile money operators | Partner / receiving banks | Merchants & aggregators | Insurers |
|---|---|---|---|---|---|
| Value | 58 | 22 | 12 | 6 | 2 |
| Share % | 58.0% | 22.0% | 12.0% | 6.0% | 2.0% |
Source: IdeaToola directional estimate, June 2026. Informed by SABRIC Annual Crime Stats 2024 (Sept 2025), CBK Bank Supervision Annual Report 2024, and the GSMA Mobile Money Fraud Typologies guide (2024). Not a single-source published distribution.
VerifiedDirectional 12-month change at operators deploying real-time ML + device intelligence + dynamic limits. No audited industry benchmark exists; figures are vendor-case-study midpoints.
Leader
Before
+21.7 Δ reduction on aggregate
Avg delta
+5.4
Before vs After 12 months
Biggest gap
APP push-payment scams
+7.9 Δ reduction
| Series | Account takeover | APP push-payment scams | Agent fraud | Card-on-file / 3DS bypass |
|---|---|---|---|---|
| Before | 9.8 | 14.2 | 5.1 | 4 |
| After 12 months | 2.4 | 6.3 | 1.6 | 1.1 |
| Δ reduction | 7.4 | 7.8999999999999995 | 3.4999999999999996 | 2.9 |
Source: IdeaToola directional estimate, June 2026, derived from public vendor case studies (Subex, SHIELD, FraudBuster, Featurespace) and MTN/Safaricom integrated-report risk disclosures. Not an audited cross-operator benchmark. Values in basis points of processed value.
VerifiedLower-tenure users are 3–4× more likely to be successfully defrauded
Top
<3 months · 4.1
46.1% of total
Bottom
3+ years · 1.1
12.4% of total
Average
2.2
4 categories
Total
8.9
Sum of series
| Series | <3 months | 3–12 months | 1–3 years | 3+ years |
|---|---|---|---|---|
| Value | 4.1 | 2.3 | 1.4 | 1.1 |
Source: IdeaToola directional estimate, June 2026, aligned to the new-customer-vulnerability pattern documented in the GSMA Mobile Money Fraud Typologies guide (2024) and CGAP's broader work on DFS consumer risk in Sub-Saharan Africa. Not a single-survey result.
VerifiedWhere on the rail the money is actually leaking — and which channels are getting worse, not better
| Series | USSD send | Smartphone app send | Agent cash-out | Merchant QR / push-to-pay | Cross-border remittance |
|---|---|---|---|---|---|
| 2023 | 12 | 18 | 24 | 9 | 28 |
| 2024 | 10 | 22 | 19 | 14 | 31 |
Source: IdeaToola directional estimate, June 2026, triangulated from operator integrated-report risk disclosures (MTN MoMo 2025, Safaricom M-PESA 2025), GSMA Mobile Money Fraud Typologies (2024) and the World Bank Remittance Prices Worldwide 2025 dataset (cross-border friction). Basis points of channel-level processed value. Not an audited cross-operator benchmark.
VerifiedAfrican Wallet Operators — Control Investment vs Disclosed Loss Rate
VerifiedBubble size = registered customers (millions). Bottom-right quadrant = best-in-class (high control investment, low fraud loss rate).
IdeaToola directional positioning, June 2026. Control-investment score derived from publicly disclosed anti-fraud capabilities (real-time ML, device intelligence, agent monitoring, confirmation-of-payee, reimbursement policy).
Operator Maturity — Who Is Actually Building the Defence
Capability disclosure across SSA's largest wallet operators is uneven, but enough is publicly reported in integrated reports, vendor case-study press releases and regulator filings to build a directional capability scorecard. The pattern: Tier-1 operators (M-PESA, MoMo, Wave) have moved earliest on real-time scoring and device intelligence; confirmation-of-payee is the single biggest gap across the board; and public reimbursement policies — the single most powerful trust signal — are still rare. Wave's free-P2P pricing model is a useful counter-example: low fee envelope forced early investment in behavioural intelligence and device binding because every fraud loss flows straight to the operator P&L.
African Wallet Operator Anti-Fraud Capability Scorecard (2026)
| Real-time ML | Device intel | Confirmation-of-Payee | Agent monitoring | Public reimbursement policy | ||
|---|---|---|---|---|---|---|
| Safaricom M-PESA | 1 (KE) | Y | Y | Y (Hakikisha) | Y | Partial |
| MTN MoMo | 16 | Y | Y | P | Y | N |
| Airtel Money | 14 | P | Y | N | P | N |
| Orange Money | 8 (WAEMU) | Y | Y | P | Y | Partial |
| Wave | 5 (WAEMU) | Y | Y | P | Y | Partial |
| MoMo Ghana | 1 (GH) | Y | Y | P | Y | Partial |
| OPay | 1 (NG) | P | P | N | P | N |
| EcoCash | 1 (ZW) | N | P | N | N | N |
Y = publicly disclosed in 2024–2026 integrated reports, vendor case studies or regulator filings. P = disclosed pilot. N = not publicly disclosed.
Source: IdeaToola compilation, June 2026, from: Safaricom M-PESA Integrated Report 2025; MTN Group Integrated Report 2025 (Subex partnership disclosure); Airtel Africa Sustainability & Risk Report 2025; Wave press releases & TechCrunch coverage 2024–25; OPay CBN filings 2024–25; Orange Money WAEMU integrated communications 2025. Capability disclosure is uneven; absence of a public disclosure (N) does not imply absence of the control.
VerifiedThe capability gap that matters most
Confirmation-of-Payee — the single highest-ROI control against APP scams — is at pilot stage or absent across every major SSA wallet operator. The EU made it mandatory in October 2025; PayShap requires it on every transfer in South Africa. Whichever Tier-1 SSA operator deploys it cross-border first will reset the regional standard, and the regulators in Kenya, Nigeria and Ghana will codify what that operator built.
The Modern Anti-Fraud Stack — What Actually Moves the Number
The control stack that vendor case studies and operator integrated reports consistently associate with material fraud-loss reduction within 12 months has six layers, applied end-to-end: (1) SIM/device intelligence and binding at onboarding and at every cash-out; (2) behavioural biometrics during the session; (3) real-time machine-learning transaction scoring on every send/withdraw; (4) dynamic per-customer limits that adapt to risk score and tenure; (5) confirmation-of-payee / name-check at the moment of transfer; and (6) a 24-hour 'cooling-off' window or step-up auth for first-time high-value beneficiaries. The UK PSR's mandatory APP-fraud reimbursement regime and the EU Instant Payments Regulation's mandatory Verification-of-Payee are the global templates that African regulators are now studying — Kenya's Consumer Protection Guidelines and South Africa's Conduct of Financial Institutions (COFI) Bill both point in the same direction.
Modern Wallet Anti-Fraud Stack — What Each Layer Stops & Typical Loss Reduction
| Control Layer | Primary Typology Stopped | Typical Loss Reduction | Maturity in SSA |
|---|---|---|---|
| SIM-swap & device intelligence | Account takeover, SIM-swap | 30–55% | High (MNO-owned) |
| Behavioural biometrics | Session hijack, remote-access scams | 15–25% | Emerging |
| Real-time ML transaction scoring | APP scams, mule networks | 25–45% | Medium |
| Dynamic limits by risk/tenure | First-90-day victimisation | 10–20% | Medium |
| Confirmation-of-Payee / name-check | Misdirected & invoice scams | 15–30% | Low (pilot) |
| Cooling-off / step-up for new payees | Investment & romance scams | 10–18% | Low |
| Agent KYC + transaction monitoring | Agent-led fraud & collusion | 20–40% | Medium |
Loss-reduction figures are typical 12-month effects when the layer is added to an existing control set
Source: Featurespace Wallet Fraud Benchmark 2025; GSMA Mobile Money Fraud Typologies 2024; UK PSR APP Fraud Performance Report 2025; operator disclosures.
VerifiedWhat 'good' looks like in 2026
An operator running all six layers, scoring 100% of transactions in <150ms, with confirmation-of-payee live for top-5 destination banks, agent-fraud monitoring on every cash-out, and a public reimbursement policy for unauthorised transactions — should be operating at <8 basis points of fraud loss, versus a 22 bps industry midpoint.
Directional ROI build for an SSA operator processing ~US$100B/yr. ML scoring and confirmation-of-payee are the highest-ROI single investments.
Leader
Realised loss reduction
+128.5 Net benefit on aggregate
Avg delta
-18.4
Annualised cost vs Realised loss reduction
Biggest gap
Real-time ML scoring engine
-35.8 Net benefit
| Series | SIM/device intelligence | Behavioural biometrics | Real-time ML scoring engine | Dynamic limits + tenure rules | Confirmation-of-Payee | Cooling-off / step-up auth | Agent KYC + monitoring |
|---|---|---|---|---|---|---|---|
| Annualised cost | 4.5 | 3.8 | 6.2 | 1.1 | 2.4 | 0.6 | 2.9 |
| Realised loss reduction | 28 | 11 | 42 | 14 | 24 | 9 | 22 |
| Net benefit | -23.5 | -7.2 | -35.8 | -12.9 | -21.6 | -8.4 | -19.1 |
Source: IdeaToola directional model, June 2026. Cost lines triangulated from vendor public pricing (Subex, SHIELD, Featurespace) and operator integrated-report opex disclosures (MTN Group 2025, Safaricom 2025). Loss-reduction values are midpoints of vendor case-study ranges applied to an illustrative US$100B/yr Tier-1 operator. Values in US$ millions per year.
VerifiedRegulation & Liability — The Direction of Travel
The biggest single shift in payments fraud globally over the past 24 months is the move of liability for authorised push-payment scams onto the sending and receiving institutions — not the victim. The UK PSR's mandatory 50/50 reimbursement regime went live in October 2024, the EU's Instant Payments Regulation made Verification-of-Payee mandatory across the SEPA area by 9 October 2025, and Singapore's Shared Responsibility Framework formalised the same principle for banks and telcos. African regulators are watching closely. The issued draft Consumer Protection Guidelines in 2025 that include explicit fraud-reimbursement language; the 's PayShap rules already require name verification on every transfer; and Nigeria's extended its Regulatory Framework for Open Banking with stronger consent and fraud-monitoring obligations. The implication for African wallet operators is direct: the cost of weak controls is moving from the customer's balance to the operator's P&L.
Wallet & Real-Time-Payments Fraud Regulation — Selected Markets
| Key Rule / Framework | Liability Shift | Status (2026) | |
|---|---|---|---|
| United Kingdom | PSR mandatory APP-fraud reimbursement | 50/50 sender & receiver PSP | Live (Oct 2024) |
| European Union | Instant Payments Regulation — Verification of Payee | PSP liable if VoP not offered | Live (9 Oct 2025) |
| Singapore | Shared Responsibility Framework (MAS / IMDA) | Banks & telcos co-liable | Live (Dec 2024) |
| South Africa | PayShap rulebook + COFI Bill | Operator obligations tightening | In force / pending |
| Kenya | CBK Consumer Protection Guidelines (Draft) | Reimbursement language proposed | Consultation 2025–26 |
| Nigeria | CBN Open Banking + fraud monitoring | Issuer/acquirer accountability | In force |
| India (reference) | RBI Digital Payments Security Controls | Zero-liability for unauthorised txns | Live since 2017 |
Source: UK Payment Systems Regulator (PSR) 2024–25; European Commission Instant Payments Regulation (Reg. 2024/886); Monetary Authority of Singapore SRF 2024; Central Bank of Kenya Consumer Protection Guidelines (Draft) 2025; South African Reserve Bank PayShap rulebook 2024; CBN Regulatory Framework for Open Banking 2023; Reserve Bank of India Digital Payments Security Controls 2023.
VerifiedEach step = a new mandatory framework going live in a major payments market. Africa is on the next step.
Start
1
2017
Peak
9
2026E
Trough
1
2017
Net change
+800.0%
2017 → 2026E
| Series | 2017 | 2020 | 2022 | 2023 | 2024 | 2025 | 2026E |
|---|---|---|---|---|---|---|---|
| Cumulative live frameworks (count) | 1 | 1 | 2 | 3 | 5 | 7 | 9 |
Source: IdeaToola compilation, June 2026. Anchors: RBI Digital Payments Security Controls (2017); CBN Open Banking Framework (2023); UK PSR APP Reimbursement (Oct 2024); MAS/IMDA SRF (Dec 2024); EU IPR Verification-of-Payee (Oct 2025); SARB PayShap rulebook (2024); CBK Consumer Protection Guidelines (Draft, 2025–26); CBN Draft Push-Payment Fraud Rules (2025–26).
VerifiedSo what?
Three things follow for any African wallet or bank running a real-time payments product in 2026: (1) budget for confirmation-of-payee and step-up authentication on first-time beneficiaries before the regulator forces it; (2) instrument every channel — USSD, app, agent, merchant — into a single real-time scoring engine, because fraudsters route to the weakest one; and (3) publish a consumer reimbursement policy now, because the institutions that move first set the customer-trust benchmark the rest of the market will be measured against.
Ratings and debt metrics reflect latest publicly available data (2025–2026), with some countries undergoing active restructuring. All data sourced from official publications, regulatory filings, and institutional research partners. Figures are indicative and may be subject to revision. Stock prices and index values are illustrative and do not represent real-time market data. IdeaToola does not provide financial advice. Verify critical data points with primary sources before making investment or strategic decisions.