The Uganda Communications Commission (UCC), in partnership with the Ministry of ICT and National Guidance, is holding its Inaugural National Cybersecurity Conference under the theme “Securing Uganda’s Digital Future: Collaboration, Resilience and Trust” at the Kampala Sheraton Hotel.
The two-day conference has gathered cybersecurity experts, telecom operators, financial institutions, IT Leaders, regulators, and innovators, to mention but a few, to confront the growing threat of digital fraud in Uganda’s fast-expanding mobile money and banking ecosystem.
Speaking during a high-level panel discussion on “Preparing for a More Secure Digital Future by Protecting Digital Financial Services: Addressing Social Engineering, SIM Swap, and Account Takeover,” Airtel Money Commerce Uganda Limited (AMCUL) Managing Director, Japhet Aritho, said the industry must move beyond consumer awareness campaigns and build fraud prevention directly into the design of digital financial products.
Social engineering, SIM swap fraud, and account takeover are rarely isolated incidents, but rather stages of the same attack chain. “For you to take over a mobile account, you have to do a SIM swap. For you to do a SIM swap, you have to start with social engineering, because there is some information that you have to pick,” Aritho said, describing the three threats as deeply intertwined.
He noted that telecom operators had been grappling with these challenges long before they became a mainstream public concern, pointing to an industry-led innovation that has since become standard practice across Uganda’s banking sector.
“We created APIs, very simple, done internally, not even by any sophisticated developer, which we exposed to all banks,” he said.
Airtel Money Uganda subsequently pushed the Bank of Uganda to mandate that every commercial bank implement an IMSI check API, allowing banks to verify SIM swap activity in real time before authorizing transactions.
Aritho also cited Airtel’s AI Spam Alert Service, which the telco launched in 2025, uses data analytics and artificial intelligence to detect patterns in fraudulent SMS messages and alert subscribers before they fall victim to scams.
He described how fraudsters exploit the very warnings telecom companies issue, often opening scam calls by repeating official security messaging to build trust before manipulating victims into isolating themselves and disclosing sensitive information. “They will tell you exactly what we are telling them… and then they will trick you into sharing your PIN,” he said.
To illustrate practical ‘security by design,’ Aritho recommended device-binding technology. Drawing on his own experience switching phones, he explained that being locked out of financial apps until re-verified with each provider, while inconvenient, is far preferable to fraud losses. Airtel Money now detects when a registered device or SIM card changes and automatically blocks transactions until the account holder is re-verified, even if a scammer has already obtained a customer’s credentials.
He was also careful to push back against victim-blaming, noting that sophisticated fraudsters are often fluent, confident communicators who put victims at ease. “It’s very difficult to spot a scammer. They speak good English, they make you comfortable,” he said, adding that the burden of protection should sit with service providers at the design stage, not solely with consumers.
Responding to an audience question on how safe personal data is when shared with service providers, Macgyver Mugamba, Manager for Data Protection and Legal Advisory at UCC, cited Uganda’s Data Protection Act. He noted that individuals have a right to ask private entities how their personal data is handled, including whether proper policies and notices are in place.
Consumers with unresolved complaints can escalate to the Personal Data Protection Office under the Ministry of ICT and National Guidance. However, the public is urged to remain vigilant about how and with whom they share personal information.
Closing the panel, Aritho urged stakeholders to embed cybersecurity into product design from the outset and to recognize that Uganda’s digital ecosystem is only as secure as its weakest participant. “We are as strong an ecosystem as the weakest link within that ecosystem,” he said, while calling for continued collaboration between telcos, banks, and regulators, both in technology and in addressing human vulnerability, as the sector works to build a safer digital future for Ugandan consumers.
