MTN Ghana has urged small and medium-sized enterprises (SMEs) to strengthen their cybersecurity practices, warning that a fraudulent message or compromised account can disrupt operations, erode customer trust and threaten business survival.
The company hosted a webinar as part of its SME Accelerate Programme to help businesses identify digital threats, protect their operations, and prepare for cyber incidents.
The event was part of the activities marking Cybersecurity Awareness Month and was held under the theme “Secure to Thrive: Building Resilient Businesses in an Era of Digital Disruption.”
Discussions covered phishing, employee training, incident recovery, third-party risks, responsible use of artificial intelligence (AI) and affordable security measures.
MTN Ghana’s Senior Manager of Enterprise Information Security and Governance, Jacqueline Hanson-Kotei, identified phishing and social engineering as pressing threats to SMEs.
She said criminals use fraudulent emails, fake payment notifications and messages impersonating trusted organisations or familiar contacts to trick people into opening malicious attachments or disclosing sensitive business information.
“Be careful what you click. Be careful what you scan as QR codes,” she cautioned.
Ms Hanson-Kotei urged business owners and employees to scrutinise links, QR codes and financial requests before acting, and to keep software updated to address security vulnerabilities.
She stressed that security tools must be supported by regular employee training, as a single mistake could expose an entire business network.
“It’s not just an IT issue,” she said, calling for cybersecurity awareness at every level of an organisation, from frontline staff to chief executives.
Even businesses with as few as five employees, she added, should train their staff to recognise suspicious messages and handle company data securely.
Ms Hanson-Kotei also highlighted the risks facing micro-enterprises that depend on Instagram, WhatsApp and mobile money services for sales, payments and customer engagement.
She explained that losing access to a business account could interrupt transactions and communication with customers, while prolonged disruption could drive clients to competitors.
She advised SMEs to assign someone to oversee cybersecurity, introduce multi-factor authentication, back up data off-site regularly and assess the security practices of third-party service providers.
She also warned of fraudsters who contact customers and manipulate them into disclosing their PINs or authorising transfers.
Sharing a personal experience, Ms Hanson-Kotei recounted receiving an unexpected request for GH¢500 from the compromised WhatsApp account of a makeup artist she knew. She said she checked directly before acting.
“Trust but verify,” she advised, urging business owners to confirm any unusual financial requests by phone.
She said taking a minute to verify a message could prevent financial loss and help protect others within a business network.
Ms Hanson-Kotei further urged SMEs to prepare for recovery alongside efforts to prevent attacks.
“Don’t only think of prevention,” she said.
She advised businesses to identify who would lead their response to an incident, assign clear responsibilities and arrange access to technical support before an emergency.
Such preparation, she explained, would help businesses respond effectively to disruptions and restore operations quickly.
The Head of Cybersecurity Technology Standards at the Cyber Security Authority (CSA), Jake France, warned businesses against assuming they were too small to attract cybercriminals.
“Cybercriminals do not discriminate,” he said.
Mr France urged SMEs that accept digital payments or manage inventory online to secure their access channels, review third-party contracts and verify the credentials of cybersecurity service providers.
He also highlighted the importance of protecting physical devices, maintaining off-site cloud backups and establishing clear communication procedures for use during disruptions.
On AI, he cautioned businesses against entering sensitive corporate information into online tools and warned that criminals could use emerging technologies to clone voices and produce convincing fraudulent messages.
Innovare’s Chief Business Officer, Albert Turkson, said businesses must account for cybersecurity costs when investing in technology.
“If you’re going to budget for the technology, you should as well budget for how to keep that technology safe,” he said.
Mr Turkson recommended managed security services as an option for SMEs with limited resources, alongside regular website vulnerability assessments and penetration testing.
He stressed that businesses of all sizes needed continuity plans to help them withstand disruptions.
On responsible AI adoption, he recommended governance frameworks such as ISO 42001 and advised businesses to remove identifying details from corporate data before using it on AI platforms.