The Uganda Communications Commission (UCC) held its inaugural National Cybersecurity Conference under the theme “Securing Uganda’s Digital Future: Collaboration, Resilience and Trust,” bringing together telecom operators, financial institutions, and regulators to confront the growing threat of digital fraud within Uganda’s fast-expanding mobile money and banking ecosystem.
Speaking during a high-level panel on protecting digital financial services from social engineering, SIM swap fraud, and account takeover, Airtel Money Commerce Uganda Limited (AMCUL) Managing Director Japhet Aritho argued that the industry needs to move beyond consumer awareness campaigns and instead build fraud prevention directly into how digital financial products are designed.
He explained that the three threats are rarely standalone incidents, but stages of the same attack chain, since taking over a mobile account typically requires a SIM swap first, and a SIM swap in turn requires information gathered through social engineering.
Aritho noted that telecom operators had been grappling with these challenges long before they became a mainstream public concern. He pointed to an internally built API, developed without need for sophisticated external developers, that Airtel exposed to banks and subsequently pushed Bank of Uganda to mandate industry-wide. That innovation is now known as the IMSI check API, allowing banks to verify SIM swap activity in real time before authorising transactions.
He also cited Airtel’s recently deployed AI Spam Alert Service, which uses data analytics and artificial intelligence to detect patterns in fraudulent SMS messages and warn subscribers before they fall victim to scams.
Aritho described how fraudsters often exploit the very security warnings telecom companies issue, opening scam calls by repeating official messaging to build trust before manipulating victims into isolating themselves and disclosing sensitive information such as their PIN.
To illustrate practical security by design, he recommended device-binding technology, drawing on his own experience of being temporarily locked out of financial apps after switching phones until re-verified. He said Airtel Money now automatically detects when a registered device or SIM card changes and blocks transactions until the account holder is re-verified, even if a scammer has already obtained a customer’s credentials.
Aritho was careful to push back against victim-blaming, noting that sophisticated fraudsters tend to be fluent, confident communicators who put victims at ease, making scams genuinely difficult to spot. He argued the burden of protection should sit primarily with service providers at the design stage, not solely with consumers.
Responding to an audience question on how safe personal data is when shared with service providers, UCC’s Manager for Data Protection and Legal Advisory, Macgyver Mugamba, cited Uganda’s Data Protection Act, noting that individuals have a right to ask private entities how their personal data is handled, including whether proper policies and notices are in place. He said consumers with unresolved complaints can escalate them to the Personal Data Protection Office under the Ministry of ICT, while urging the public to remain cautious about how and with whom they share personal information.
Closing the panel, Aritho urged stakeholders to embed cybersecurity into product design from the outset, telling attendees, “We are as strong as an ecosystem as the weakest link within that ecosystem.” He called for continued collaboration between telcos, banks, and regulators, both in technology and in addressing human vulnerability, as the sector works to build a safer digital future for Ugandan consumers.
