Phishing is the use of fake messages, calls or websites to trick people into giving away money, passwords, PINs or one-time codes. In Africa, phishing often arrives by SMS, WhatsApp or a phone call rather than email, and frequently targets mobile money and bank accounts. Recognising the patterns is the best protection.
Common scams to know
The “wrong transfer” scam
You receive an SMS that looks like a mobile money confirmation saying someone sent you money. Then a caller begs you to send it back. The original SMS was fake, sent from an ordinary number. Always check your actual balance in the app or official menu before sending anything.
Fake customer care
Someone calls claiming to be from your bank, telecom operator or mobile money provider. They say your account will be blocked, or that you have won a prize, and ask for your PIN or the code just sent to your phone. Genuine staff will never ask for your PIN or one-time code.
Prize, promotion and giveaway messages
Messages announce you have won a promotion and must pay a “processing fee” or share details to claim it. If you did not enter, you did not win.
Fake job and recruitment offers
Fraudsters advertise jobs, often abroad or remote, then charge fees for applications, training, visas or equipment. Legitimate employers do not charge candidates to be hired. Learn safe ways to find remote work in Remote Work from Africa and remote jobs that pay in dollars.
WhatsApp account hijacking
A contact’s hijacked account messages you asking for a six-digit code “sent by mistake”. That code is your WhatsApp verification code; sharing it hands over your account. Turn on WhatsApp two-step verification.
Fake bank alerts and payment screenshots
Buyers send forged SMS alerts or screenshots claiming they have paid. Sellers should confirm payment in their own banking app or payment dashboard before releasing goods.
Investment and crypto scams
Schemes promise guaranteed high daily or monthly returns, often using referral bonuses and testimonials. They pay early investors from new deposits until they collapse.
Phishing links
Messages link to websites that copy your bank’s login page. Anything you type goes to the criminal.
Red flags
- Urgency: “Your account will be closed in 30 minutes”
- Requests for PINs, passwords or one-time codes
- Payment to claim a prize, loan or job
- Messages from personal numbers claiming to be an organisation
- Links with misspelled or unusual web addresses
- Returns or deals that are too good to be true
- Pressure to keep it secret or not tell family
How to protect yourself
- Never share your PIN, password or one-time codes with anyone
- Contact organisations using numbers from their official website or the back of your card, not numbers in messages
- Type website addresses yourself instead of clicking links
- Turn on two-factor authentication; see 2FA explained
- Set a SIM PIN and learn about SIM swap fraud
- Talk to older relatives about these scams; they are frequent targets
If you have been scammed
- Call your bank or mobile money provider immediately to block and try to reverse the transaction
- Change any passwords or PINs you shared
- Report to the police and your operator, and keep evidence
- Report scam numbers to your operator; many have short codes for this
For the full picture, read our Cybersecurity in Africa guide.
