Account takeover and SIM swap

In short

In an account takeover, a criminal gains control of a genuine customer’s account and empties it. In mobile money, the most common route is a SIM swap: the fraudster persuades or bribes someone into moving the customer’s phone number onto a new SIM, then uses it to receive one-time codes and reset the PIN.

Unlike most AML alerts, these alerts are usually about protecting your customer, who is the victim. Speed matters more than anything else.

What it looks like

At 21:40 a wallet’s phone number moves to a new SIM. At 22:05 the PIN is reset from a device never seen before. At 22:11, 22:13 and 22:16 the balance of GHS 14,300 is sent to three wallets opened within the last fortnight, one of which cashes out at an agent in Accra at 22:40. The genuine customer, a trader in Techiman, reports the next morning that their phone “has no network”.

Typical sequence:

1. Change: new SIM, new device, changed email, phone or password, or a PIN reset.
2. Probe: a balance check or a small test transfer.
3. Drain: one or more large transfers, often to new payees, often at night.
4. Exit: the money moves through mule accounts and is cashed out.

Which rules surface it

Rule	Key	What it catches	Default answer
G3 SIM swap then payout	gh.sim_swap_payout	A payout within 48 hours of a SIM swap	Block
H5 Profile change then payout	fraud.profile_change_then_payout	Phone, email or password changed, a password reset or a new device, then money out within 24 hours	Hold for review
H3 Failed attempts then payout	fraud.failed_auth_then_payout	Three or more failed OTPs and PINs in the 30 minutes before a payout	Hold for review
H2 New device, new payee, high value	fraud.new_device_new_payee	A first payment from a device, to a first-time payee	Hold for review
C7 Burst of payouts	fraud.payout_burst	Five or more payouts in 10 minutes: the drain itself	Step-up
E3 Impossible travel	fraud.impossible_travel	Transactions from places too far apart in too short a time	Hold for review
C6 Unusual hour	fraud.unusual_hour	A payout at an hour of the day an established customer hasn’t transacted at in 90 days	Step-up

These are real-time rules: they run in the decision your system asks for before letting a payout through, so they can stop the drain before the money moves. Each block, hold or step-up also raises a fraud alert for your team, and every decision is on the Decisions page. They only work if your systems send the signals: sim_swap, profile-change and failed-OTP or PIN account events, and device_fingerprint, geo_lat and geo_lon on transactions.

Without real-time decisions, you find out afterwards

If your systems only send transactions after the fact, none of the rules above runs. You’ll see the drain through post-event rules such as C5 pass-through on the recipients, after the money has gone.

Red flags and innocent explanations

Red flag	Possible innocent explanation	How to tell them apart
SIM swap or new device	The customer lost or replaced their phone	Did the customer request it through a normal channel? Is there a large transfer straight after?
Changed contact details then payout	The customer genuinely changed number and paid a bill	Payout to a long-standing payee is less worrying than to a brand-new one
Transfers at an unusual hour	A one-off late-night emergency	Combined with a fresh SIM, new device and new payees, it is very unlikely to be innocent
Recipient wallets are brand new	—	New recipients that cash out quickly are a strong sign of mules

How to investigate

1. Act on the customer’s behalf first. If your institution’s procedure allows it, use the fastest available means to protect the account and any remaining funds. Follow your fraud procedure; this playbook does not replace it.
2. Build the timeline, minute by minute: the change event, logins, PIN resets, transfers, and where the money went. On the customer’s page, Digital footprint lists their account events from the last 90 days (SIM swaps, failed OTPs, phone changes) and up to 20 devices they’ve ever used, with when each was first seen; a device marked shared has been used by other customers too. See Customer profile. The alert’s explanation gives the changes and how long before the payout they happened, for example Payout of GHS 900 after phone change 20h ago, email change 3h ago (rule window: 24 hours) or SIM swapped 2.33 hours before this payout of GHS 900. In a workspace that installed the packs before gh-psp 1.1.1 and fraud 1.0.2, the explanation may be older wording (why).
3. Confirm the change was not the customer’s. Contact the customer through a channel the fraudster doesn’t control: a known alternative number, a branch visit or an agent visit. Not the newly swapped number.
4. Follow the money. Identify every recipient. If they are your customers, check them for mule patterns and open linked cases.
5. Check for a wider campaign. Are other customers showing SIM swaps or takeovers in the same period, with the same recipients or devices? A device marked shared on the customer’s page is a lead: the D5 shared-device rule flags devices used by many customers. That points to an organised group, or to an insider at a SIM-swap point.
6. Decide and document.

Tipping-off risk is different here

You may safely tell a victim that their account appears to have been used by someone else. What you must not do is tell the suspects (the recipients, or an insider) that they are being investigated or reported. See Tipping off.

What to record

• The minute-by-minute timeline.
• How you confirmed the customer did not make the change or the transfers.
• The recipients, their status, and any linked cases.
• Actions taken to protect funds, with times and who authorised them.

When to escalate or report

• Escalate immediately whenever funds may still be recoverable.
• Report the recipients where they appear to be mules or fraudsters. Fraud proceeds laundered through accounts are a classic reporting case.
• Pass recurring SIM-swap patterns to your fraud and risk teams. They may point to a weakness at a SIM replacement point that the telco needs to know about through proper channels.

Related

• G. Mobile money and agent rules
• H. Card and online fraud rules
• Mule accounts
• Account events
• Decision flow