Issue 9 - Fraud as a Service: The Latest Initiative Championing Fraud Across Africa

Fraud has always been a menace to financial institutions, but a dangerous evolution has occurred in recent years—Fraud as a Service (FaaS). This new wave of organised digital crime is making it easier for bad actors to access sophisticated tools and techniques designed to bypass security measures. What’s most alarming is how accessible these tools have become across Africa.

FaaS: The New Business Model for Criminals

FaaS is essentially a criminal business model where hackers and fraudsters offer services and software designed to commit fraud against others. These services are often sold or rented out via online dark markets, making them accessible to anyone willing to pay. A quick search can uncover tools that enable phishing attacks, card fraud, identity theft, and more.

Across Africa, the rise of mobile transactions and digital financial services has opened new doors for these criminals.

Why FaaS is a Growing Concern for African Financial Institutions

• Low Barriers to Entry: FaaS allows individuals with little technical expertise to carry out complex fraud schemes, creating an ever-growing pool of fraudsters. 

• Targeting Mobile Money & Digital Wallets: Africa is the global leader in mobile money making the industry a prime target. Fraudsters can rent out or purchase malware and phishing kits to siphon money from unsuspecting users.

• Cross-Border Collaboration: Criminals are collaborating across borders, making it difficult for local law enforcement and financial institutions to keep up. Coordinated fraud attacks on financial services in one country can quickly spread across borders.

What Fraud Methods Are FaaS Providers Using?

FaaS services offer an alarming variety of tools to fraudsters, including:

1. Phishing-as-a-Service: Fraudsters can rent phishing kits that mimic legitimate platforms like banking apps, online stores, or payment processors. These kits are used to trick users into providing sensitive information like passwords or account details.

2. SIM Swap Fraud: FaaS providers make it easier for criminals to carry out SIM swap fraud, where they transfer a victim’s phone number to a new SIM card to access mobile banking and reset passwords.

3. Carding-as-a-Service: Criminals can use FaaS platforms to buy stolen credit card details and automated software for testing cards on e-commerce websites. 

4. Botnets for Account Takeover (ATO): Fraudsters can rent botnets to automate attempts at breaking into users’ accounts by trying multiple password combinations.

Protecting against FaaS

• AI-Powered Fraud Detection: African financial institutions must implement AI-driven tools that can detect suspicious behaviour in real-time. Machine learning models can help flag unusual patterns, such as rapid logins from different locations or sudden changes in spending behaviour.

• Collaboration with Regulators: financial institutions must work closely with local regulators and law enforcement agencies to stay ahead of the evolving fraud landscape. Governments, too, must improve the legal framework for dealing with cyber fraud across borders.

• Customer Awareness Campaigns: Educating users about the dangers of fraud, especially on how to avoid phishing scams and SIM swap fraud, is essential. Platforms should also encourage two-factor authentication (2FA) and other security practices to reduce risk.

• Compliance Automation: Ultimately, businesses can guard against FaaS criminals by using an end-to-end anti-fraud solution

Ultimately,

As Africa’s fintech ecosystem continues to thrive, the industry must tackle the challenge of money laundering head-on. By fortifying their defences, fintechs can protect not only their business but also contribute to a more secure and transparent financial environment across the continent.

Fraud Watch

• Crypto scammers now prefer Pig Butchering scams over Ponzi schemes

  In the past year, a fraud report revealed that Crypto scammers have pivoted away from running large and complex Ponzi schemes to favour more targeted pig butchering scams. Read more here

Country News Coverage

• Mastercard and Smile ID Collaborate to Accelerate Merchant Onboarding in Africa

  Mastercard has teamed up with Smile ID, a leading African digital Know Your Customer (KYC) provider, to streamline the merchant onboarding process for businesses in South Africa, Nigeria and across Africa. Read more here.

• South African Revenue Service (Sars) Turns Attention to Crypto traders, Sends Warning

  Recent developments have seen the South African Revenue Service (Sars) turn its attention toward crypto traders, who are now receiving notices based on information obtained from various crypto asset exchanges. Find out why here

• Money Laundering: EFCC warns Designated non-financial Business Operators

  The Economic and Financial Crimes Commission, EFCC, has called on Designated Non-Financial Businesses and Professions, DNFBPs, to conduct their dealings in line with the provisions of the  Money Laundering Prohibition and Prevention Act 2022. Read more here.

Ask the Experts

Let’s hear your thoughts or questions you may have. Hit reply and let's chat on anything identity verification or AML compliance related in Africa. 

Till next time,

The Smile ID Team.