Phishing in Africa — How Cybercrime Is Targeting African Businesses and Mobile Money Users in 2026

Africa’s digital economy is growing faster than almost anywhere else on earth. Mobile money has brought millions of people into formal finance for the first time. Online banking, e-commerce and social commerce are expanding in every major market. That growth is a genuine success story. It has also created a very large and fast-growing attack surface for fraudsters.

INTERPOL’s African Cyberthreat Assessment Report 2026 puts numbers on the problem. According to coverage of the report, cybercrime-related losses in Africa rose from $192 million in 2024 to $484 million in 2025. Phishing and online scams sit at the centre of that picture, feeding mobile money fraud, business email compromise, identity theft and ransomware.

This article looks at what the latest data says about phishing and related fraud across Africa, how the main attack types work, and what businesses and individuals can do to reduce their exposure.

A note on sources: the figures below come from INTERPOL’s 2026 assessment as reported by African and international news outlets, plus Nigerian banking-sector data and Deloitte’s Nigeria outlook. Where reporting differs between outlets, we say so. If you are citing these numbers formally, check them against the original INTERPOL report.

The Big Picture

A few headline findings from the INTERPOL assessment and related reporting:

• Online scams, including phishing, make up the bulk of frequently reported cybercrime in Africa, with suspected scam notifications rising by as much as 3,000% in some countries between 2023 and 2024.
• Phishing alone accounts for over a third of all reported cyber incidents across the continent, according to reporting on the earlier assessment.
• Cybercrime makes up over 30% of reported crime in West and East Africa.
• Mobile money fraud is the continent’s most common online scam, with 97% of responding countries identifying it as a major threat.
• African-origin data appearing on dark web marketplaces increased by 62%, with stolen personal information reused in identity theft, phishing, financial fraud and ransomware.
• More than 90% of African countries need significant improvements in law enforcement and prosecution capacity to combat cybercrime effectively.

INTERPOL also describes fraud as a chain rather than a single attack: a data breach fuels phishing, phishing fuels the creation of synthetic identities, and those identities become money mule accounts. Phishing is the link that connects the stolen data to the cash-out.

Mobile Money: The Primary Target

Mobile money is the defining feature of Africa’s financial landscape, and it is the defining target for fraudsters. For many users, a mobile wallet is their only financial account, which means a compromised wallet can be a household’s entire savings.

How mobile money phishing works

Most mobile money attacks combine phishing with social engineering rather than technical hacking:

• Fake prize and promotion messages. An SMS or WhatsApp message says you have won a prize or qualified for a bonus, and asks you to “confirm” your PIN or a one-time code to claim it.
• Fake agent or operator calls. A caller claims to be from the mobile operator or the money transfer service, says there is a problem with your account, and asks for your PIN or an OTP to “fix” it.
• Reversal scams. You receive a genuine-looking message saying money was sent to you by mistake, followed by a call asking you to send it back, often to a different number.
• Phishing links in SMS. A link leads to a fake login or verification page that captures your credentials.

The common thread is that the victim is persuaded to hand over the secret that protects the account. No technical weakness is exploited. The wallet’s own security is simply bypassed by asking.

SIM swap fraud

SIM swap fraud is the other major threat. The attacker convinces a mobile operator, or a corrupt insider, to move the victim’s number to a SIM the attacker controls. From that point, every SMS, including OTP codes, goes to the attacker.

Kenya shows how fast this can grow. INTERPOL reports that SIM swap fraud in Kenya increased by 327% during 2025, with more than 123,000 fraudulent SIM cards issued and an estimated $3.8 million stolen from mobile wallets. INTERPOL also notes that Kenya has proposed amendments to its Computer Misuse and Cybercrimes Act specifically targeting SIM swap fraud and scam calls.

Ghana has seen similar problems. Reporting on INTERPOL’s findings cited $1.3 million lost to mobile money fraud in Ghana in the first quarter of 2025 alone.

Phishing and SIM swapping work together. Phishing harvests the personal details an attacker needs to impersonate the victim to the operator. The swap then removes the SMS-based protection the victim was relying on.

Business Email Compromise Across the Continent

BEC is the highest-value category for African businesses, and it follows the same pattern seen globally: an attacker impersonates an executive, supplier or partner, and persuades an employee to change payment details or send a transfer.

INTERPOL’s reporting on BEC includes some points that look contradictory at first. One account of the 2026 assessment says 70% of detected BEC incidents originated from South Africa and a further 29% from Nigeria. Another summary says West Africa is a major centre for BEC, with Nigeria and Cabo Verde among the hardest hit. These are different measures, one describing where detected attacks came from and the other describing where victims are concentrated, so both can be true. INTERPOL’s private sector partners report that 11 African countries account for most BEC activity, with Nigeria, Ghana, Côte d’Ivoire and South Africa among the main hubs.

INTERPOL also highlights the role of organised networks, including Black Axe, in BEC fraud across the continent. A related point from the 2026 assessment is that proceeds do not stay where they start. Laundering routes run through crypto exchanges, shell companies and money mule accounts into international networks.

For an African SME, the practical risk looks like this:

• A supplier invoice arrives with new bank details, apparently from a regular supplier whose email account has been compromised.
• A message appears to come from the managing director asking finance to make an urgent transfer.
• A client receives your genuine-looking invoice, but with the account number changed by an attacker who has been reading your email.

AI is making these messages harder to spot. INTERPOL warns that criminals are using AI to automate phishing campaigns, generate realistic deepfake content and create synthetic identities. The old advice to look for poor grammar is increasingly unreliable.

Nigeria: A Closer Look

Nigeria illustrates both the scale of the problem and the pace at which it is growing.

• According to INTERPOL data cited by Ecofin, Nigeria ranked third in Africa for identified phishing cases in 2024, with 3,459 incidents, behind Egypt and South Africa.
• A 2025 report from the Nigeria Inter-Bank Settlement System (NIBSS) found that fraud losses surged to ₦52.26 billion in 2024, up from ₦17.67 billion the previous year.
• Deloitte’s Nigeria Cybersecurity Outlook 2026 expects ransomware and phishing attacks to intensify as services, payments and data move online.
• Official sources estimate Nigeria loses about $500 million per year to cybercrime.

Reported incidents have also hit public institutions, with INTERPOL citing the Nigeria Customs Service among organisations affected by ransomware.

Ransomware and Critical Infrastructure

Ransomware is a separate category from phishing, but phishing is a common way in. INTERPOL reports that South Africa accounted for 92% of all ransomware detections in Africa in 2025. Incidents cited include attacks on the South African Weather Service, the Nigeria Customs Service, the Uganda Electricity Transmission Company and Namibia’s telecommunications sector.

Earlier reporting on the assessment also pointed to the South African Department of Defence losing 1.6TB of data and a Telecom Namibia breach that compromised over 492,000 sensitive files.

The pattern matters for small organisations too. Attackers increasingly focus on essential services, and the same phishing techniques that open the door at a national utility work equally well against a regional business.

Why Africa Is Being Targeted

The reasons are structural rather than anything specific to African users:

• Rapid digitisation. Mobile money, e-commerce and online banking have grown quickly, often faster than security awareness and controls.
• Mobile-first usage. Many users do everything on a phone, where it is harder to inspect links and sender details, and where SMS and WhatsApp are primary channels.
• SMS-reliant authentication. OTP codes sent by SMS are vulnerable to both phishing and SIM swapping.
• Limited enforcement capacity. INTERPOL notes that over 90% of African countries need significant improvements in law enforcement and prosecution capacity.
• Large volumes of exposed data. The 62% increase in African-origin data on dark web marketplaces gives attackers material to personalise their approach.
• Uneven protection. Security tooling and fraud controls vary widely between institutions, and attackers look for the weakest link in the chain.

It is also worth saying plainly that African consumers and businesses are overwhelmingly the victims in these statistics, not the perpetrators. Criminal networks operate in every region of the world, and global criminal groups target African victims just as they target victims elsewhere.

What Individuals Can Do

• Never share your mobile money PIN or any OTP with anyone. No genuine operator, bank or agent will ask for it, by phone, SMS or WhatsApp.
• Treat unexpected prize, bonus and refund messages as scams. If you did not enter a competition, you did not win it.
• Verify by going direct. If someone claims to be from your operator or bank, hang up and call the official number printed on your card, your statement or the operator’s official channels.
• Be suspicious of “sent in error” reversal requests. Check your own transaction history rather than trusting the caller’s explanation.
• Ask your operator about SIM swap protection. Many operators offer extra verification or SIM lock options. If your phone suddenly loses signal for no reason, contact your operator immediately, because it can be the first sign of a swap.
• Use app-based or hardware authentication where available instead of SMS codes.
• Report scams to your bank or mobile operator, and to your national cybercrime reporting channel or CERT where one exists.

What Businesses and SMEs Can Do

• Verify every change to payment details out of band. Phone the supplier on a number you already hold, never one from the email requesting the change.
• Require two people to approve transfers above a set limit. A request from the managing director should not bypass this.
• Introduce a delay for new payees. Urgency is the attacker’s main tool, and a mandatory waiting period removes it.
• Turn on multi-factor authentication for email, and prefer app-based or hardware methods to SMS. Business email accounts are the foundation of most BEC attacks.
• Secure your domain. Set up SPF, DKIM and DMARC so attackers cannot easily spoof your company email address to your customers and suppliers.
• Train staff on the real lures. Fake invoices, fake IT alerts, impersonated executives and mobile money prompts should all appear in your awareness training.
• Keep offline or immutable backups so a ransomware incident does not become a business-ending event.
• Make it safe to report mistakes quickly. The faster an employee reports that they clicked something, the less time an attacker has.

Conclusion

INTERPOL’s 2026 assessment shows a continent where digital opportunity and digital risk are growing together. Losses more than doubled in a year, mobile money fraud is the most widespread threat, and phishing is the thread that ties data theft, identity fraud and cash-out together.

The encouraging part is that most of the effective defences are simple and cheap. Never share a PIN or OTP. Verify any payment change through a second channel. Use stronger authentication than SMS where you can. Protect your email domain. None of this requires a large security budget, only consistent habits and clear internal rules.

As African digital services continue to grow, awareness and basic controls will matter more, not less. Sharing what we know about live threats is part of that, and community reporting helps everyone.

---

PhishScout tracks live phishing campaigns and publishes indicators of compromise at phishscout.net. If you receive a suspicious message, submit it at phishscout.net.

Sources: INTERPOL African Cyberthreat Assessment Report 2026 (as reported by Facephi Observatory, MyJoyOnline, Dawan Africa and Ecofin) · Techpoint Africa · BusinessDay Nigeria (NIBSS data) · Deloitte Nigeria Cybersecurity Outlook 2026