devto 2026-09-17 원문 보기 ↗
By CyberSense Ghana |
Someone in Ghana woke up one morning, checked their phone, and had no network signal.
They assumed it was MTN acting up. By the time they figured out what had actually happened, their MoMo wallet was empty, their email had been accessed, and their bank account had been drained.
That's a SIM swap attack. And it's happening right here in West Africa — more than most people realise.
A SIM swap (also called SIM hijacking or SIM porting) is when a scammer convinces your mobile network to transfer your phone number to a SIM card they control.
Once they have your number, every SMS-based OTP (One-Time Password) that your bank, MoMo wallet, email, or social media sends — goes to them, not you.
With that one move, they can:
It sounds like something from a hacking movie. It's actually shockingly simple to pull off.
Here's the typical attack chain in the West African context:
Scammers collect your name, phone number, date of birth, and sometimes your Ghana Card or NIA details. This comes from:
The attacker calls MTN, Telecel, or AirtelTigo customer care pretending to be you. They say something like:
"I lost my SIM card, I need a replacement on a new SIM."
They answer security questions using the info they already gathered. If the agent isn't careful, your number is ported to their SIM within minutes.
You notice your phone has no service. You assume it's a network issue. Meanwhile, the attacker is already receiving your OTPs.
In the time it takes you to visit a service centre and figure out what happened, they've already:
Call your network provider and ask them to add extra protection to your account — some providers allow you to set a PIN or password that must be provided before any SIM replacement is done.
Wherever possible, switch from SMS OTP to an authenticator app:
These generate codes locally on your phone — even if someone steals your number, they can't get these codes.
❌ Less secure: SMS OTP → your phone number
✅ More secure: Authenticator app → your physical device
Consider having a dedicated SIM that you use only for banking and MoMo — one you never share publicly, never post online, and never use for regular calls or social media sign-ups.
If your email recovery method is your phone number, you've created a single point of failure. Add a recovery email address instead, and store your backup codes somewhere safe offline.
If your phone suddenly loses signal and you haven't changed anything:
Speed is everything. The faster you act, the less damage is done.
If you're building apps that serve Ghanaian or West African users, SMS OTP should not be your only authentication option.
Consider implementing:
// Instead of relying solely on SMS OTP
// Offer TOTP (Time-based One-Time Password) support
const speakeasy = require('speakeasy');
// Generate a secret for the user
const secret = speakeasy.generateSecret({ length: 20 });
// Verify the token the user enters
const verified = speakeasy.totp.verify({
secret: secret.base32,
encoding: 'base32',
token: userInputToken,
window: 1
});
Libraries like speakeasy (Node.js) or pyotp (Python) make TOTP implementation straightforward. Pair it with a QR code so users can scan it into their authenticator app.
Your users deserve more than a one-point-of-failure SMS system.
SIM swap attacks aren't a distant, foreign threat. They're happening right now in Accra, Kumasi, Lagos, and Abidjan. And because mobile money is the financial backbone of millions of West Africans, the stakes are incredibly high.
The good news: awareness is your first line of defence. Share this with someone who uses MoMo. It might save them from a very bad morning.
This article is part of the CyberSense Ghana series — cybersecurity education built for Ghanaians and West Africans. Follow @cybersense101 on TikTok, Instagram, and Facebook for more.