THE CHANGING FACE OF FINANCIAL FRAUD AND HOW TO STAY SAFE: Fake Bank Calls, SMS Messages, WhatsApp Chats And Websites Are Increasingly Being Used To Harvest PINs, OTPs And Card Details From Unsuspecting Customers

Financial fraud is becoming harder to detect as more people use mobile phones, cards and digital platforms to access financial services. Fraudsters are also changing their methods, using fake websites, social media accounts, phone calls, SMS messages and WhatsApp to trick customers into revealing information that can be used to steal money.

In Uganda, the financial impact is already significant. According to the Uganda Police Annual Crime Report, more than Shs5.3 billion was lost to cybercrime in 2025. This underlines the need for stronger protection by banks, businesses and individuals.

Many fraud attempts begin with a simple message or phone call. Someone may pretend to be a bank employee and claim that a customer’s account needs to be updated, a PIN must be changed, a transaction reversed or an account urgently secured. The fraudster then asks for confidential information or sends a link to a fake website.

Centenary Bank has repeatedly reminded customers that it will never ask for a PIN, OTP, password or other confidential banking credentials through unsolicited calls, SMS, email or social media messages. Customers who need assistance should always use the Bank’s official communication channels.

The most important rule is simple: never share information that can be used to access your account. This includes your account PIN, ATM PIN, OTP, card details, CVV and password. Customers should also use strong and unique passwords and avoid clicking links sent through SMS, email or WhatsApp when those links ask them to log into their bank account or provide personal information.

Fraudsters often rely on fear and urgency. They may claim that an account will be blocked, a transaction will fail or a reward will expire unless the customer acts immediately. Whenever a banking request feels urgent or unusual, stop the conversation and contact the bank through an official channel before taking any action.

Customers should also pay close attention to SMS and email transaction alerts. Any transaction that is not recognised should be reported immediately, as early reporting gives the bank a better chance to investigate and reduce further loss.

As digital banking grows, banks must also continue strengthening their systems and controls. Centenary Bank has invested in technology, including its Oracle FLEXCUBE core banking platform, to support real-time transaction monitoring and fraud detection. Unusual activity, such as a transaction from an unfamiliar device, location or customer pattern, can be flagged for further review or stopped where necessary.

The Bank has also strengthened internal safeguards through a 24-hour fraud monitoring team and enhanced internal review and assurance activities. Data analytics and risk-based monitoring are used to review transactions, staff access and system activity to identify potential internal and external threats.

Customers also have an important role to play. Through CenteMobile, one can benefit from real-time transaction alerts, two-factor authentication and tools that support quick action where an account is suspected to have been compromised.

October, recognised as Cybersecurity Awareness Month, provides an important opportunity to reinforce these habits. Uganda’s National Cybersecurity Strategy 2022–2026 recognises awareness as an important part of strengthening national cybersecurity resilience and we have seen financial institutions use this period to help customers understand common fraud techniques and the steps they can take to avoid becoming victims.

Fraudsters will continue changing their tactics. The best defence is therefore a combination of strong banking controls, informed customers and constant vigilance. To the customers, protect your credentials, question unexpected requests, verify before acting and report suspicious activity immediately.

The writer is the Manager, Information Security Assurance at Centenary Bank.

By Elison Twinomugisha