Mobile money fraudsters in Ghana are increasingly exploiting human behaviour rather than relying on sophisticated hacking techniques to steal customers’ money, according to MobileMoney Fintech Limited’s Senior Manager for Financial Crimes, Moses Tetteh.
He said fraudsters were using social engineering tactics to manipulate unsuspecting users into disclosing sensitive information, which they then use to access mobile money wallets and banking applications.
Mr Tetteh made the remarks in an interview with MyJoyOnline on the sidelines of the 15th Absa-UPSA Law School Quarterly Banking Roundtable at the Absa Head Office in Accra.
The forum brought together banking, legal and fintech experts to discuss emerging financial crimes and challenges facing the financial services sector.
“Here, what the fraudsters may do is call the customer. And when they call the customer, they use either trust, fear, or a story to bring out greed. And then, once the customer falls for it, they’re able to take the customer’s credentials,” he said.
He explained that once fraudsters obtain a victim’s login details, PIN or other authentication information, they can use them to access digital platforms and transfer funds.
Mr Tetteh said the growing threat required greater vigilance from both customers and mobile money agents, who play a frontline role in facilitating transactions.
“We are warning our customers to be more vigilant, and the same warning goes to our agents,” he cautioned.
He said the fight against fraud should not be left to telecommunications companies and service providers alone, but should involve every participant in the digital financial ecosystem.
“For us, we see the fight against fraud as a shared responsibility. Shared responsibility means that you do not just leave it to the service provider, the telcos alone, but collectively, we, as operators, and the customer, as the user, come together to fight against fraud,” he said.
According to him, protecting access credentials is one of the most effective ways customers can reduce their exposure to fraud.
“The first line of defence when it comes to any security system is access control, which is in the hands of the customer. So, as much as possible, if we limit the breach of credentials, then we would be able to mitigate some of these kinds of cases that we continue to record,” he added.
The discussion at the roundtable also examined whether warnings about one-time passwords (OTPs) were sufficient to protect customers from fraud.
Mr Tetteh said OTPs were only one of several sensitive credentials users needed to keep confidential.
“So, OTP is one of the many credentials that, as a customer, you would have to keep secret. And if we say OTP, that’s the one-time password. You may have your PIN as well, which we expect you not to share either,” he said.
He further warned customers against sharing private links used to facilitate the download of the MoMo application, stressing that such information should not be disclosed to third parties, including people claiming to be company staff.
“That link is supposed to be kept private. He advised customers not to share that with any third party, not even MTN workers, because it is personal to you,” he said.
Mr Tetteh said MobileMoney Fintech Limited continued to invest in customer education to remind users of the need to protect their credentials.
The company also conducts periodic training for mobile money agents to improve their security awareness and professionalism in handling transactions.
He said agents were taught to remain alert to their surroundings and ensure that sensitive customer information disclosed during transactions was not exposed to bystanders.
The training, he explained, was intended to make agents more conscious of their environment and the risks associated with handling customers’ confidential information.
Mr Tetteh urged customers who suspect that their information may have been compromised during a transaction to report the matter promptly, particularly if they begin receiving suspicious calls shortly afterwards.
He said early reporting could help operators investigate suspected breaches and take steps to limit further exposure.