Safaricom fired 118 staff over fraud last year, and says it fought off 1.25 billion intrusion attempts
Safaricom's sustainability report for the year to March, covered this week, gives the most detailed picture yet of what it takes to protect M-PESA. The company says it detected about 1.25 billion attempts to break into its systems, investigated more than 130,000 security events and suffered no confirmed material breach, and that denial-of-service attacks were stopped without hurting customers. On fraud, the number of incidents fell 82%, short of its 90% target, and 46% of reported losses were recovered, including KES 953 million in agent commissions. The biggest single source of fraud is still old-fashioned: people talked into handing over details face to face. Some of it is inside the company: Safaricom dismissed 118 employees for fraud, up from 113 the year before and from 28 four years ago, and referred 14 cases to the police, up from seven. Fraud is the most common concern raised on its anonymous ethics hotline, and the grounds for dismissal include theft, falsifying records and looking up customers' call records without authority. The report does not say how much money the insider cases cost. At franchise shops, which handle about 140,000 SIM swaps a month, Safaricom now runs 18 automated fraud checks and biometric verification, and fraudulent swaps fell from about 20 a month to fewer than five. On privacy, Safaricom says it finished masking customer details in person-to-person M-PESA messages for more than 40 million subscribers in March, but its own surveys put trust in how it handles data at 70% for M-PESA and 61% for Safaricom, both up on last year. The scale behind those numbers: 46.4 billion M-PESA transactions worth KES 41.7 trillion, 41.7 million monthly active customers and 18.1 million people using Fuliza, up from 7 million. All the figures are Safaricom's own and the report gives no breakdown of the attacks; it also comes as the CA reports a national rise in attempted break-ins and while a case filed in April challenges Safaricom's use of automated decisions in M-PESA. For customers, the fraud figures say where the risk is: callers and visitors who talk you into sharing a PIN or approving a SIM swap.
Sources: Techweez · Tech-ish · Business Daily
