<div dir="auto">Interesting. There's a concept of security by default. If sim swaps are happening and bring used to defraud people, can't operations disable remote sim swaps and put in place a proper 2FA model that is secure?<div dir="auto"><br></div><div dir="auto">Also, these reports show that perhaps little or no action is taken after these reports are made. I would be interested to hear whether the telcos, CA and DCI can regularly publish statistics on these crimes. I think everyone on this platform has heard of someone whose lost money from mpesa/phone/bank fraud. But to what extent are these being addressed?</div><div dir="auto"><br></div><div dir="auto">I am aware of a Cybersecurity strategy being developed? Are these issues that it should address in a muktistakeholder approach?</div><div dir="auto"><br></div><div dir="auto">Victor </div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, 30 May 2022, 12:38 James Mbugua via KICTANet, <<a href="mailto:kictanet@lists.kictanet.or.ke">kictanet@lists.kictanet.or.ke</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto">Listers,<div dir="auto"><br></div><div dir="auto">While education will be important, we can't run away from.the elephant in the room; Safaricom's liability.</div><div dir="auto"><br></div><div dir="auto">It strikes me that most of these stories involve Safaricom. </div><div dir="auto"><br></div><div dir="auto">It is also true, that most people are mot sophisticated enough to even understand how these fintech products work. </div><div dir="auto"><br></div><div dir="auto">They therefore are entering into contacts of utmost good faith withthe provider trusting that the provider will uphold their fiduciary duty.</div><div dir="auto"><br></div><div dir="auto">To me this is a case of negligence on many levels and while contributory negligence can be found on the subscriber for inadvertently providing their details or being gullible, the responsibility to ensure the integrity of the product is the privders'.</div><div dir="auto"><br></div><div dir="auto">It is a pattern it seems that these heists are carried out immediately after a SIM swap. What genius does it take to design the product that no immediate financial transactions take place on the line after a SIM swap? Or require personal visit to a shop to reactivate?</div><div dir="auto"><br></div><div dir="auto">It is also not clear how these crooks are able to tell who has money or has recently had money.</div><div dir="auto"><br></div><div dir="auto">It is also not clear how and where they cash these embezzled funds that the provider has not been able to identify.</div><div dir="auto"><br></div><div dir="auto">To me the provider should be held culpable and should refund all those who have lost money through these scams.</div><div dir="auto"><br></div><div dir="auto">Regards,</div><div dir="auto"><br></div><div dir="auto">JG</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, 30 May 2022, 11:59 Adam Lane via KICTANet, <<a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank" rel="noreferrer">kictanet@lists.kictanet.or.ke</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="ZH-CN" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:#1f497d">I have reported several of the spam callers to Safaricom; I don’t know if they just block the numbers, or if they actually report to DCI and allow
investigation and prosecution. <u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:#1f497d">If no-one gets prosecuted then this is a no-risk business model. If people get prosecuted then at least there is some risk/cost that must be considered
compared to the potential revenue the scammers get…<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> KICTANet [mailto:<a href="mailto:kictanet-bounces%2Badam.lane" rel="noreferrer noreferrer" target="_blank">kictanet-bounces+adam.lane</a>=<a href="mailto:huawei.com@lists.kictanet.or.ke" rel="noreferrer noreferrer" target="_blank">huawei.com@lists.kictanet.or.ke</a>]
<b>On Behalf Of </b>Barrack Otieno via KICTANet<br>
<b>Sent:</b> Monday, May 30, 2022 11:30 AM<br>
<b>To:</b> Adam Lane <<a href="mailto:adam.lane@huawei.com" rel="noreferrer noreferrer" target="_blank">adam.lane@huawei.com</a>><br>
<b>Cc:</b> Barrack Otieno <<a href="mailto:otieno.barrack@gmail.com" rel="noreferrer noreferrer" target="_blank">otieno.barrack@gmail.com</a>><br>
<b>Subject:</b> Re: [kictanet] Sim card swap: How Farah Bashir lost Sh2.6m to fraudsters in hours<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">Goodmorning Daktari,<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">I am in agreement. Most of these attacks are purely Social Engineering moves and indeed they are on the rise and very persistent. We need to step up Consumer awareness and digital literacy, the fraudsters are evolving
daily and becoming too sophisticated. Consumers should be encouraged to tighten their security. Two Factor Authentication is a good start. There is need for an evaluation on whether it is adequate, but Consumer Awareness which is believe is in CA's purview
and Digital Literacy are key.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Regards<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">On Mon, May 30, 2022 at 11:20 AM Bitange Ndemo via KICTANet <<a href="mailto:kictanet@lists.kictanet.or.ke" rel="noreferrer noreferrer" target="_blank">kictanet@lists.kictanet.or.ke</a>> wrote:<u></u><u></u></span></p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<p class="MsoNormal"><span lang="EN-US">Before we all panic, it is important to dissect the problem here from all sides. My cousin, a teacher lost Ksh. 57,000 from his bank account. When he called me for help, I asked him many questions. It occurred to me
that he had inadvertently given out his data to some unknown people disguising themselves as sales reps marketing a new offer from a competing telecommunications operator. In my view, we need to do the following: take the digital literacy program very seriously,
sensitize citizens around data protection laws and leverage artificial intelligence (voice recognition for security purposes) for any withdrawal, especially among the very vulnerable in society. Institutions like Kenya Power and Lighting Company (virtually
every week I receive a fake call from "KPLC") should devise more secure ways of dealing with customers in the digital era. Since most of the fraud is largely an inside job, much of the backend work should be automated.<u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Ndemo<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">On Mon, May 30, 2022 at 10:42 AM Deborah Wanjugu via KICTANet <<a href="mailto:kictanet@lists.kictanet.or.ke" rel="noreferrer noreferrer" target="_blank">kictanet@lists.kictanet.or.ke</a>> wrote:<u></u><u></u></span></p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<p class="MsoNormal"><span lang="EN-US">Thank you for this article, Victor. <u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">This is quite frightening because prepaid customers on Safaricom cannot call 100 and get served by an agent (that was my experience which made me migrate back to postpaid). <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">If the gentleman in this article acted as quickly as he possibly could and reached out to Safaricom on Twitter yet did not get the help he needed then something is terribly wrong with that online reporting system. <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">I've noticed that when customer service agents respond on social media they respond based on their own perceptions and not what the client tells them. This isn't always the case and I'm not referring to Safaricom alone.
As a random example I reported not having received my electricity bill to Kanya Power on Twitter. Instead of sending me my estimate, one of the agents asked for the nearest marker to my place so they could send technical support.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Another problem is when you call to report fraud with your bank then they start asking you questions which feel irrelevant at the time. I once thought my card had been hacked so when I called to report it they asked me
some silly questions. I don't remember what they were but I do remember being pissed and having to contain myself under the pressure.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">There needs to be a tightening of customer service particularly with respect to online fraud reporting.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">I don't know what other pieces need to be fixed. This is where my personal beef is. <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Deborah<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">On Mon, May 30, 2022, 10:14 Victor Kapiyo via KICTANet <<a href="mailto:kictanet@lists.kictanet.or.ke" rel="noreferrer noreferrer" target="_blank">kictanet@lists.kictanet.or.ke</a>> wrote:<u></u><u></u></span></p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<p class="MsoNormal"><span lang="EN-US">Morning Listers,<u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">In the news today:<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Farah Bashir is yet to come to terms with how his bank accounts were wiped clean by fraudsters, barely two days after he had landed in Johannesburg for a two-week assignment in February.<u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">He painfully recounted how he watched helplessly as Sh2.6 million was withdrawn by hackers in several transactions from his four different Absa Bank accounts between February 7 and February 9.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Read more: <a href="https://nation.africa/kenya/news/sim-card-swap-how-farah-bashir-lost-sh2-6m-to-fraudsters-in-hours-3831356" rel="noreferrer noreferrer" target="_blank">
https://nation.africa/kenya/news/sim-card-swap-how-farah-bashir-lost-sh2-6m-to-fraudsters-in-hours-3831356</a><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">SIM Card fraud has been in the bees lately. The sums lost are pretty high. I bet there are many sad tales from individuals who've lost collasal amounts due to sim swap fraud. <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">How come we're not able to contain this crimes? I wonder who's the weakest link here that needs to pull up their socks? It's really a big threat to our digital economy if we can't address this growing menace. <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Happy to hear your thoughts on this. <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Regards,<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Victor<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US">_______________________________________________<br>
KICTANet mailing list<br>
<a href="mailto:KICTANet@lists.kictanet.or.ke" rel="noreferrer noreferrer" target="_blank">KICTANet@lists.kictanet.or.ke</a><br>
<a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" rel="noreferrer noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br>
Twitter: <a href="http://twitter.com/kictanet" rel="noreferrer noreferrer" target="_blank">http://twitter.com/kictanet</a><br>
Facebook: <a href="https://www.facebook.com/KICTANet/" rel="noreferrer noreferrer" target="_blank">https://www.facebook.com/KICTANet/</a><br>
<br>
Unsubscribe or change your options at <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/deborah.wanjugu%40gmail.com" rel="noreferrer noreferrer" target="_blank">
https://lists.kictanet.or.ke/mailman/options/kictanet/deborah.wanjugu%40gmail.com</a><br>
<br>
<br>
KICTANet is a multi-stakeholder Think Tank for people and institutions interested and involved in ICT policy and regulation. KICTANet is a catalyst for reform in the Information and Communication Technology sector. Its work is guided by four pillars of Policy
Advocacy, Capacity Building, Research, and Stakeholder Engagement.<br>
<br>
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or
qualifications.<br>
<br>
KICTANet - The Power of Communities, is Kenya's premier ICT policy engagement platform.<u></u><u></u></span></p>
</blockquote>
</div>
<p class="MsoNormal"><span lang="EN-US">_______________________________________________<br>
KICTANet mailing list<br>
<a href="mailto:KICTANet@lists.kictanet.or.ke" rel="noreferrer noreferrer" target="_blank">KICTANet@lists.kictanet.or.ke</a><br>
<a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" rel="noreferrer noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br>
Twitter: <a href="http://twitter.com/kictanet" rel="noreferrer noreferrer" target="_blank">http://twitter.com/kictanet</a><br>
Facebook: <a href="https://www.facebook.com/KICTANet/" rel="noreferrer noreferrer" target="_blank">https://www.facebook.com/KICTANet/</a><br>
<br>
Unsubscribe or change your options at <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/bndemo%40bitangendemo.me" rel="noreferrer noreferrer" target="_blank">
https://lists.kictanet.or.ke/mailman/options/kictanet/bndemo%40bitangendemo.me</a><br>
<br>
<br>
KICTANet is a multi-stakeholder Think Tank for people and institutions interested and involved in ICT policy and regulation. KICTANet is a catalyst for reform in the Information and Communication Technology sector. Its work is guided by four pillars of Policy
Advocacy, Capacity Building, Research, and Stakeholder Engagement.<br>
<br>
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or
qualifications.<br>
<br>
KICTANet - The Power of Communities, is Kenya's premier ICT policy engagement platform.<u></u><u></u></span></p>
</blockquote>
</div>
<p class="MsoNormal"><span lang="EN-US">_______________________________________________<br>
KICTANet mailing list<br>
<a href="mailto:KICTANet@lists.kictanet.or.ke" rel="noreferrer noreferrer" target="_blank">KICTANet@lists.kictanet.or.ke</a><br>
<a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" rel="noreferrer noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br>
Twitter: <a href="http://twitter.com/kictanet" rel="noreferrer noreferrer" target="_blank">http://twitter.com/kictanet</a><br>
Facebook: <a href="https://www.facebook.com/KICTANet/" rel="noreferrer noreferrer" target="_blank">https://www.facebook.com/KICTANet/</a><br>
<br>
Unsubscribe or change your options at <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/otieno.barrack%40gmail.com" rel="noreferrer noreferrer" target="_blank">
https://lists.kictanet.or.ke/mailman/options/kictanet/otieno.barrack%40gmail.com</a><br>
<br>
<br>
KICTANet is a multi-stakeholder Think Tank for people and institutions interested and involved in ICT policy and regulation. KICTANet is a catalyst for reform in the Information and Communication Technology sector. Its work is guided by four pillars of Policy
Advocacy, Capacity Building, Research, and Stakeholder Engagement.<br>
<br>
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or
qualifications.<br>
<br>
KICTANet - The Power of Communities, is Kenya's premier ICT policy engagement platform.<u></u><u></u></span></p>
</blockquote>
</div>
<p class="MsoNormal"><span lang="EN-US"><br clear="all">
<br>
-- <u></u><u></u></span></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-US">Barrack O. Otieno<br>
+254721325277<br>
+254733206359<br>
Skype: barrack.otieno<br>
PGP ID: 0x2611D86A<br>
<br>
<br>
<br>
<u></u><u></u></span></p>
</div>
</div>
</div>
_______________________________________________<br>
KICTANet mailing list<br>
<a href="mailto:KICTANet@lists.kictanet.or.ke" rel="noreferrer noreferrer" target="_blank">KICTANet@lists.kictanet.or.ke</a><br>
<a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" rel="noreferrer noreferrer noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br>
Twitter: <a href="http://twitter.com/kictanet" rel="noreferrer noreferrer noreferrer" target="_blank">http://twitter.com/kictanet</a><br>
Facebook: <a href="https://www.facebook.com/KICTANet/" rel="noreferrer noreferrer noreferrer" target="_blank">https://www.facebook.com/KICTANet/</a><br>
<br>
Unsubscribe or change your options at <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/jgmbugua%40gmail.com" rel="noreferrer noreferrer noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/jgmbugua%40gmail.com</a><br>
<br>
<br>
KICTANet is a multi-stakeholder Think Tank for people and institutions interested and involved in ICT policy and regulation. KICTANet is a catalyst for reform in the Information and Communication Technology sector. Its work is guided by four pillars of Policy Advocacy, Capacity Building, Research, and Stakeholder Engagement.<br>
<br>
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.<br>
<br>
KICTANet - The Power of Communities, is Kenya's premier ICT policy engagement platform.<br>
</blockquote></div>
_______________________________________________<br>
KICTANet mailing list<br>
<a href="mailto:KICTANet@lists.kictanet.or.ke" target="_blank" rel="noreferrer">KICTANet@lists.kictanet.or.ke</a><br>
<a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" rel="noreferrer noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br>
Twitter: <a href="http://twitter.com/kictanet" rel="noreferrer noreferrer" target="_blank">http://twitter.com/kictanet</a><br>
Facebook: <a href="https://www.facebook.com/KICTANet/" rel="noreferrer noreferrer" target="_blank">https://www.facebook.com/KICTANet/</a><br>
<br>
Unsubscribe or change your options at <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/vkapiyo%40gmail.com" rel="noreferrer noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/vkapiyo%40gmail.com</a><br>
<br>
<br>
KICTANet is a multi-stakeholder Think Tank for people and institutions interested and involved in ICT policy and regulation. KICTANet is a catalyst for reform in the Information and Communication Technology sector. Its work is guided by four pillars of Policy Advocacy, Capacity Building, Research, and Stakeholder Engagement.<br>
<br>
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.<br>
<br>
KICTANet - The Power of Communities, is Kenya's premier ICT policy engagement platform.<br>
</blockquote></div>