A customer searches for a business online, finds a phone number, discusses a booking and sends a deposit. Later, the business says it never received the money. The person who answered the call was pretending to work there. Ghana’s Cyber Security Authority (CSA) has warned that fraudsters are placing fake business listings on search engines and online maps.
In an alert issued in April, it said 54 such cases had been reported between January 1 and April 26, 2026, with losses totalling GH₵266,195. Cybersecurity governance and risk specialist Valerie Arko-Adjei says customers should verify who they are dealing with before sending money.
Finding a business online, she explains, does not mean the contact number beside its name belongs to it. The scam works because the first steps feel ordinary. Many people use a search result or a map listing to find a phone number without giving it much thought.
A fraudster can use the name and address of a real business, then substitute a number they control. Once a customer gets in touch, the conversation may sound much like a genuine booking or sale. Knowing the price of a service does not prove that the person answering is legitimate.
Prices, photographs and descriptions may already be public. Before agreeing to pay, customers should check whether the number they called appears on the business’s own website or on a social media account they know belongs to it. If the details do not match, they should contact the business through a different, independently verified channel. Arko-Adjei also urges customers to pay attention to sudden changes in payment instructions.
Someone might say the usual mobile money number is temporarily unavailable or ask for a deposit to be sent to a personal account. There may be innocent reasons for a change, but customers should confirm it with the business using contact details they found separately. Calling the number that sent the new instructions only takes them back to the person whose identity they are trying to establish.
The CSA says some people responding to fake listings have been directed to forms asking for their phone number, mobile network, transaction amount, and mobile money PIN. A request for a PIN, one-time code, or banking password should end the conversation. Customers should leave the form or chat and contact their payment provider or the business through a number they have verified themselves.
If a payment has already been made, acting quickly matters. Contact the payment provider, explain what happened, and ask what steps are available for that transaction. Keep screenshots of the listing and conversation, along with the phone number and payment reference. Anyone who shared a PIN or code should secure the affected account immediately and report the incident. These records may help the provider and authorities investigate.
Arko-Adjei says businesses must make it easier for customers to check they are dealing with the right people. Those that accept online bookings or deposits can make their official contact numbers and payment channels easy to find. A clear notice explaining how payments are requested, and stating that staff will never ask for a customer’s mobile money PIN or one-time code, gives people something to check against when a message feels wrong.
Business owners should also search for their own names and check the phone numbers shown in map results. If they find an impersonator, they can report the listing to the platform and warn customers using their genuine accounts. Staff should know how to handle a report from someone who may have paid a fake account, including gathering the listing details and directing the customer to their payment provider.
The warning comes ahead of Ghana’s National Cyber Security Awareness Month in October. At the campaign’s September launch, the CSA said it had recorded 3,876 cybersecurity incidents between January and July 2026, with online fraud making up about 47%.
That figure covers online fraud generally; it is not a count of fake business listings. Arko-Adjei says the answer is to pause when a search result turns into a request for money: check the contact number, confirm any change in payment details, and keep PINs and security codes private. A short check before paying could spare a customer a far more difficult conversation afterwards. Suspicious listings and cybercrime incidents in Ghana can be reported to the CSA by calling or texting 292, sending a WhatsApp message to 050 160 3111, or emailing report@csa.gov.gh.
Valerie Arko-Adjei is a cybersecurity GRC (Governance, Risk, and Compliance) Professional with a background in behavioural science, focused on helping businesses and individuals understand risk and build stronger security habits through human-centred cybersecurity. She can be reached via adjeiv2@yahoo.com.