Mobile money fraud at the counter: what a cashier should do

Mobile money fraud is not mainly a technology problem. At the counter it is a people problem: a fake confirmation screen, a convincing phone call, a reversal that the cashier does not understand. The operators publish safety rules for customers, and the same rules, turned around, protect a business. Here is a counter procedure built from what MTN, Airtel and the regulator have said.

Rule one: the money is yours when your line says so

The oldest trick is the payment that never happened. A customer shows an SMS or a screenshot that looks like a confirmation and walks out with the goods. MTN's MoMoPay page is clear that both the customer and the merchant are notified by SMS when a payment is made and that payments are received immediately. So the cashier's rule is simple: no confirmation on the merchant line or the till, no goods. A customer's screen is not evidence. If the network is slow, the customer waits with the goods on the counter, politely, until the merchant SMS arrives.

Rule two: nobody from the network needs your PIN

MTN's published safety rules for MoMo customers are three: never share the PIN, code or one-time password with anyone; do not use simple PIN combinations such as 0-0-0-0-0 or 1-2-3-4-5; and treat anyone calling on behalf of the company from a number other than 031 212 0000 as a fraudster, then call customer care on 100 to confirm. Print those three lines and tape them inside the till drawer. The business version adds a fourth: no member of staff ever reads a PIN, OTP or merchant code balance to a caller, whatever the caller claims to be.

Rule three: reversals are a management decision

Reversals are where shops lose real money. MTN's merchant menu has a reverse transaction option that needs the transaction ID, which is useful when a customer genuinely overpays and dangerous when a stranger phones to say they "sent money to your code by mistake" and asks you to send it back to a different number. Operators themselves have long required the receiving party's authentication before reversing a mistaken transfer, as MTN's public statements in the 2018 case reported by The Observer made clear. Your policy should be at least as careful:

• No reversal or refund without a recorded sale and a transaction ID that matches your merchant statement.
• Refunds go back to the number that paid, never to a third number.
• Only a manager or owner can authorise a reversal, and the authorisation is logged.

Rule four: protect the merchant SIM like a key

At the Uganda Communications Commission's national cybersecurity conference in August 2026, Airtel Money Commerce Uganda's managing director described how social engineering, SIM swaps and account takeovers are linked: criminals use personal information obtained from victims to take control of their mobile lines before reaching the money. Airtel has developed an interface that lets financial institutions check whether a SIM has recently been swapped, and the Bank of Uganda has required commercial banks to adopt an IMSI check to verify SIM changes in real time. For a shop, the lesson is that the merchant line's SIM is a key to the business. Register it in the business's name where the product allows, keep the registered phone in the shop and not in a pocket, and treat any unexpected loss of signal on that phone as an emergency to report to the operator immediately.

Rule five: know the complaint route

Since 2021 payment service providers in Uganda have been required to notify the Bank of Uganda within 24 hours of suspected or confirmed fraud, security breaches or material service interruptions, under the National Payment Systems framework. For customers and merchants, the National Payment Systems (Consumer Protection) Regulations, 2022 require licensees to run enquiry channels (telephone, help desk, email or web chat) on a 24-hour basis and to resolve enquiries about electronic money funds transfers and merchant payments within six hours of lodging. If the provider's decision does not satisfy you, you may complain to the Bank of Uganda in writing within thirty days, with your evidence; the regulations provide for the central bank to decide within twenty-one working days. Your evidence is the transaction ID, the time, the amount and the merchant statement, which is another reason to keep statements filed.

The counter card

Print this, and train every new cashier on it in their first hour:

1. Goods leave when the merchant line or the till confirms, not when the customer's phone does.
2. Nobody is told a PIN, OTP or balance over the phone. Callers claiming to be the network are checked on 100.
3. Refunds go to the paying number only, with a manager's approval and a transaction ID.
4. The merchant phone stays in the shop. Lost signal on it is reported at once.
5. Every incident, even a failed attempt, is written in the shift sheet with the time.

Fraud follows the shop with the least routine. Give yours a routine and the fraudsters will try next door.

Sources

1. https://www.mtn.co.ug/tag/mtn-momo-safety/
2. https://www.mtn.co.ug/helppersonal/momopay/
3. https://observer.ug/business/mtn-under-fire-over-mobile-money-reversal/
4. https://techtrendske.co.ke/2026/08/13/uganda-cybersecurity-conference-2026-fraud-defences/
5. https://www.telecompaper.com/news/ugandan-mobile-money-operators-told-to-report-fraud-within-24-hours--1385488
6. https://commons.laws.africa/akn/ug/act/si/2022/103/media/publication/ug-act-si-2022-103-publication-document.pdf