SIM swap and mobile money fraud: protecting the counter
How SIM swap, smishing and fake payment confirmations work against shops, what the Uganda Communications Commission tells consumers, and the rules a cashier needs.
Mobile money is how most Ugandan shops get paid, and it is where most fraud against shops now happens. Two patterns matter at the counter: the fake confirmation, where a customer shows a doctored message and walks out with goods, and the SIM swap, where a criminal takes over the shop's or the owner's line and empties the wallet behind it. Both are avoidable with rules that cost nothing.
How a SIM swap works
The Uganda Communications Commission's fraud guidance explains that scammers who gather enough personal data can have a victim's number "ported to a device they possess", or simply steal the SIM. Either way "the scammer can gain control over the victim's private texts and calls" and "may then try to reset credentials for the victim's financial data and social media accounts". The business line that receives mobile money, and the owner's personal line that approves transfers, are both targets.
At the UCC's national cybersecurity conference in August 2026, an Airtel Money Uganda executive described social engineering, SIM swaps and account takeovers as linked: criminals use personal information obtained from victims to take control of a line before reaching the money. The same report noted that fraudsters sometimes repeat legitimate security advice during scam calls before persuading victims to reveal a PIN.
The UCC's rules for consumers
The commission's advice is written for individuals and applies word for word to a shop:
- "Do not share your PIN or personal information with anybody."
- "Do not accept to enter codes suggested by any caller, you could be granting access to your funds by a Fraudster."
- "Set up a PIN or password on your cellular account."
- Ignore calls, emails or texts requesting personal details, and protect your NIN.
- If someone claims to be from the UCC, verify through the toll-free line before acting.
The commission also warns that once a fraudster has withdrawn funds, the money "cannot be recovered". Prevention is the only remedy that works.
Fake confirmations at the counter
The second pattern needs no technology at all. A customer "pays", shows a message on their phone, and the cashier hands over the goods. The message is edited, or it is a real message from an earlier day. The rule is simple: the shop's own device confirms the payment, never the customer's. Either the confirmation arrives on the shop line, or the till that sent the payment request reports the status, before anything leaves the counter. Train every cashier that a screenshot is not a receipt.
Smishing and the office
The UCC's guidance also describes smishing, fake texts from apparently reputable companies designed "to induce individuals to reveal personal information, such as passwords or credit card numbers", and vishing, "a type of social engineering attack that happens over the phone". The UK National Cyber Security Centre's list of tell-tale signs is a useful card for the office wall: misspelled sender addresses, unexpected attachments, impersonal openers such as "Dear valued customer", links to unfamiliar websites, spelling errors and poor-quality logos. Its instruction when unsure is to "contact the organisation directly" and "don't use the numbers or links in the message".
If it happens
The UCC sets out the order: report to your service provider first by dialling 100 and ask for the SIM to be blocked if the device is lost; file a police report; then lodge a complaint with the UCC on 0800 222 777. The commission says the fraudster's SIM is blocked while the matter is investigated and that there is no charge for handling a case. Write these numbers on the same card as the phishing signs.
Counter rules to adopt this week
- The business mobile money line has a PIN on the account and is never used for personal calls.
- Nobody at the shop reads a code or PIN to a caller, whoever they claim to be.
- Payment is confirmed on the shop's device or till, not the customer's phone.
- Mobile money is reconciled against the day's sales every evening, by payment method.
- The owner's line, which approves transfers, has two-step verification on email and the operator app, and a different PIN from the business line.
Fraud at the counter succeeds in a hurry. A cashier who knows the rules does not have to think under pressure; the rule has already decided.
Sources
Run the whole business from one login.
Point of sale, stock, CRM, accounting free in every plan, payroll and Kit AI. Start on the web today and add the till, the phone app and the desktop app as you grow.
No card needed · 14-day trial