Research ReportMobile Money Fraud: Control Patterns That Hold
How fraud actually enters mobile money and agent-banking platforms — social engineering, SIM swap, agent collusion, API abuse — and the control patterns that stand up to each.
Cybersecurity for
FinTech and Payments
Security that keeps pace with a weekly release cycle — API and mobile testing in your pipeline, fraud-path review on your rails, and the control evidence your licensing and partner due diligence demand.
FinTech
What Security Means
In FinTech
Security that moves at product speed.
FinTech security fails in a distinctive way. The cryptography is usually sound, the infrastructure is usually modern, and the losses still happen — through business logic, through the human edges of the product, and through partner integrations that inherited trust nobody re-examined.
That shapes how we test. Assessments that stop at the mobile application and the public API surface return a short list of low-severity findings and miss the money. The tests that find real exposure target transaction state machines under concurrent requests, authorisation checks on every step rather than the first, reversal and refund flows, agent and support tooling, and each partner credential as its own tenant.
We also work at your cadence. A security assessment delivered as a PDF six weeks after a release is archaeology. Automated checks in the pipeline, a short feedback loop on design decisions, and a standing channel for the questions that come up mid-sprint are worth more than an annual engagement.
Threat Picture
Where FinTech
Actually Gets Hit
Business-logic and authorisation flaws
The highest-impact findings in our FinTech work are almost never injection or misconfiguration. They are step-skipping in multi-stage flows, authorisation checked once at the start, race conditions on balance operations, and refund or reversal paths that can be driven backwards.
SIM swap defeating SMS authentication
Where a one-time passcode arrives by SMS, control of the number is control of the account — and SIM re-issue sits with the mobile operator, not with you. Device binding changes the economics; better prompt wording does not.
Partner and third-party API abuse
Every integration extends your trust boundary. Credentials scoped far wider than the partner’s use case, no per-partner rate limit or anomaly baseline, and no way to revoke one partner without an outage for all is the recurring configuration.
Agent network and support-tool fraud
Agent fraud is invisible transaction by transaction and obvious in the pattern — reversal rates outside the peer distribution, float movements that do not match customer activity, registration clusters sharing a device.
Secrets in source control and build systems
Keys committed to repositories, embedded in mobile binaries, or left in build logs remain one of the fastest routes into a FinTech environment, and one of the easiest to close with pipeline scanning and a broker pattern.
Cloud misconfiguration at speed
Fast-moving infrastructure produces publicly readable object storage, over-broad roles and forgotten proof-of-concept accounts. Continuous configuration monitoring with alerting on change catches these; an annual review does not.
How We Engage
Built Around
Your Constraints
The sequence below is what a fintech engagement looks like in practice — shaped by what your environment can and cannot tolerate.
Talk to our FinTech team01
Testing inside the release cycle
We integrate dependency, secret and infrastructure-as-code scanning into your pipeline so the cheap findings are caught at pull-request time, and reserve manual testing for the business logic no scanner understands.
02
Fraud-path review alongside technical testing
We walk your product’s money paths looking for how value leaves without authorisation — including the customer-service, agent and partner processes that sit outside the codebase entirely.
03
Design review while it is still cheap
A thirty-minute conversation about an authentication design before it ships prevents a finding that would otherwise take a sprint to unpick. Retainer clients use us this way more than for formal testing.
04
Evidence for licensing and due diligence
Bank partners, card schemes and regulators all ask for control evidence. We produce it in the form each actually accepts, and sit in the follow-up calls where the questions get specific.
Obligations
What You Are
Held To
Each of these is a published instrument you can read. We map findings to them directly, so an assessment feeds your audit and supervisory cycle instead of sitting beside it.
- National Payment System Act, 2011 and its Regulations
- Governs payment service providers in Kenya under Central Bank of Kenya authorisation, including risk management and operational requirements that bear directly on security design.
- Data Protection Act, 2019
- Applies to every customer record you hold, with breach notification to the Data Commissioner within seventy-two hours of awareness — a detection requirement as much as a reporting one.
- PCI DSS v4.0
- Required wherever card data is in scope. Note the requirements covering payment-page script integrity, which became effective in March 2025 and catch many e-commerce and checkout implementations.
- CBK Digital Credit Providers Regulations, 2022
- Relevant to digital lenders, with conditions on customer data handling and conduct that intersect directly with privacy and access-control design.
- OWASP Application Security Verification Standard
- Not a regulation, but the most useful public yardstick for stating how deeply an application has been assessed — and for defining what "tested" should mean in a partner contract.
Services
Where We Start
In FinTech
Research
Reading For
FinTech Teams
Research Report
Research ReportThreat Modelling Autonomous AI Agents
A practical threat model for systems where a language model can take actions — tool access, prompt injection, credential scope, and the audit trail you will wish you had.
Threat AdvisoryThreat Advisory: Public Cloud Storage Exposure
Object storage left world-readable remains one of the most common causes of data exposure we find. The detection and prevention controls are inexpensive and rarely switched on.
Questions
What FinTech Clients
Ask First
Yes — that is the usual arrangement. Pipeline automation plus a standing retainer for design review and targeted testing fits weekly or daily releases far better than a scheduled annual assessment.
Both, and the interesting findings are usually at the boundary: controls enforced in the app but not in the API, secrets extractable from the binary, or certificate pinning that can be bypassed to reveal an unauthenticated internal endpoint.
It is the cheapest point to engage. Control decisions made before launch cost a fraction of the same decisions retrofitted, and a licensing application supported by real assessment evidence moves faster.
Other Sectors