The banking industry has, over the years—particularly in the past 10 to 15 years, undergone significant transitions. This period has been marked by an aggressive shift from traditional methods to digitization. I would describe it as “a change from bricks to clicks.” As one would expect, this drastic shift (because I wouldn’t call it gradual) brought with it significant and inherent risks that required agility and swift responses as the risk landscape quickly evolved.
Risk professionals, especially fraud managers, were suddenly faced with new fraud risks. The challenge was that we had to learn quickly as we went along because, unlike traditional banking, there were no reference points or case studies to guide us.
Similarly, organizations and customers also experienced challenges during this shift. Organizations were exposed to new risks driven by both external and internal fraud. The responsibility to protect these two stakeholders from financial and social harm rested on risk professionals. The industry responded by intensifying regulations to shield clients from exposure.
Banks reworked their strategies to adopt a more customer-centric focus. This meant services had to be delivered swiftly and securely. Processes needed to be optimized and rationalized to align with this goal. This posed serious challenges for risk professionals in ensuring processes were mapped, controls embedded, and risks assessed for efficiency.
As I have already alluded above, criminals began exploiting these changes. For example, cheque processing and payouts although now decommissioned, were required within 24 hours. While this improved customer experience, it also exposed banks to serious risks as criminals identified loopholes and exploited them. Regulations required banks to exercise a Duty of Care, shifting much of the liability from customers to banks.
Increasing regulation was not the only pressure, competition also played a role. Quick turnaround times became a selling point, particularly for loan processing. This pushed banks to automate loan processing from origination and assessment to fulfillment and payout. This transition introduced new risks.
Increasing regulation was not the only pressure, competition also played a role. Quick turnaround times became a selling point, particularly for loan processing. This pushed banks to automate loan processing from origination and assessment to fulfillment and payout. This transition introduced new risks.
In a nutshell, there has been a rapid shift from manual processes to automation, significantly changing the risk landscape and profile of many organizations. Intensifying regulation also affects risk ratings and outlooks. From an external fraud perspective, cyber-enabled fraud has become a serious problem, impacting customers. Criminals often use deceptive tactics on social media to lure gullible individuals into disclosing sensitive personal information.
Data Protection Act and Private Security Concerns
The Data Protection Act (DPA), introduced in 2022, was intended to ensure that customers’ personal data is protected throughout its lifecycle i.e, collection, processing, storage, transmission, and disposal. But here’s some food for thought: how is this law enforced within the private security fraternity? Have they embedded the required controls to secure customer information? What measures have been introduced to prevent collusion between security guards and criminals?
In this age, information, regardless of size or form, has become a valuable currency for criminals, and they will explore every opportunity to get their hands on it. My take? Not enough has been done from a regulatory perspective. We need pragmatic steps to enforce the DPA in these spaces. Many of us who have visited service points, whether private or government, can attest to being handed a register “gotwe, ikwale hoo.” It’s redundant to claim you have laws when you maintain an unending supply of valuable customer details in unsecured registers. The same applies to agents at retail shops handling mobile money withdrawals. There must be a shift in these spaces. Security awareness needs to be heightened and matured to align with the rapidly changing risk landscape. Kana o kgona go tsaya buka yone e, senepe with customer information and sell it to.criminals. kamoso o lelediwa ke batho out of the blue gotwe o winner prize. Wabaitse bo “halala choppies halala!? Then people would be wondering, batho ba, batsere nambarayame kae leya omang tota.
There is a corresponding responsibility for us as users of these services to claim and exercise our rights buy insisting on discretion from these Agents.
Public Responsibility and Behavioral Risks
The public also needs to take its fair share of responsibility and blame. We are often too lax and casual with sensitive data: trusting strangers, giving away information without scrutiny, holding sensitive conversations in public places, or talking loudly on the phone where eavesdropping is easy. Some people linger in these spaces specifically to harvest information you’ve carelessly exposed.
If you doubt this, take a ride in a combi and listen, you’ll know what the entire country is up to within 30 minutes, including sensitive government matters. Another overlooked risk? Cleaners and tea staff often have unrestricted access to offices and sensitive data. Not to downplay their importance, but these roles can present significant compromise points if controls are weak.
Kana tsena ha bareng wena and sit quietly by the counter there ote o bone. Before you know it, you will be approached by a complete stranger, usually in formal attire kana these branded shirt or tshirts who would immediately want to strike a conversation with you. Ere ota utwa gore Di xadile, ota utwa gotwe “ eish ska nkgolega” then know that the heavens are about to open. Back in my security intelligence days I used to argue with people and rightfully so, that our nature as Batswana does not require any sophisticated eavesdropping equipment to listen to a conversation. You just have to position yourself well and information will follow you with littleeffort required from you. Sadly, that’s how casual we are with sensitive information. Kamosomotho taabo are, there is nowhere batho ba baka itseng information e, because I only spoke with one person. Ka nako eo, ga itse gore ene “one person” yoo, ke mang. Motswana o rile “motho gaitsiwe ese naga”.
Cyber-Enabled Fraud and the Role of Trust
Financial organizations have implemented protocols to safeguard customers, and regulators enforce strict compliance to ensure products and services undergo risk assessments before launch. Consumers are educated during onboarding, with terms and conditions clearly explained. This layered security gives customers a better chance to act decisively against financial crime.
However, this holds true only until a unique concept trust enters the picture. Trust, without due diligence, can dismantle any defense. Criminals exploit this by creating fake websites or social media pages mimicking reputable brands, using legitimate-looking logos and testimonials to lure victims. Pyramid schemes thrive on this tactic, remember Exoplexus lebo Berry jalo jalo?Promises of “high returns with little risk” are a glaring red flag. Or consider scams that prey on emotions, like fake prize notifications linked to personal beliefs. The key takeaway? Think before you click.
Financial organizations have implemented protocols to safeguard customers, and regulators enforce strict compliance to ensure products and services undergo risk assessments before launch. Consumers are educated during onboarding, with terms and conditions clearly explained. This layered security gives customers a better chance to act decisively against financial crime.
Being a prayer warrior is acceptable, but clicking on a link to win something just because you think it’s linked to your vicious prayer (miracle money) is inexcusable. Not to be religious, but even Men of God and takers and consumers of the gospel often asked for verification from God. You see, even Biblically , nothing was accepted on face value; verification was always required and religious people understood the need for due diligence to ensure that they are acting on a good order.
Kana, the human mind is configured to always act in defence and this is the default setting and criminals are aware of this. So, they would try all the tricks to weaken and overcome this defence. Fake testimonials are a typical example where mysterious people and in common instances some well known influencers would knowingly or otherwise be used to give false testimonials to validate and give credence to scams. Waitse kgang yabo, “golo mo, ke nnete. Kebone bo semangmang ba bua ka gone”. Iiiii! Obo o itse gore o ile, o kase thole omo kgona.
Fintech’s Dark Side: How Criminals Exploit Loopholes to Target Customers
Fintech has revolutionized financial services, offering convenience and speed. But alongside its benefits, a troubling trend is emerging: customers are increasingly bearing the burden of fraud. While these platforms operate legitimately and under regulatory oversight, criminals have discovered loopholes that allow them to launder money and bypass anti-money laundering controls. This makes tracing stolen funds and assisting victims with recovery an uphill battle.
Fraudsters are also preying on unsuspecting individuals through deceptive advertisements, promising lucrative forex trading on their behalf. In many cases, victims are tricked into sharing sensitive banking details, which criminals then exploit to drain accounts. Others transfer funds under false pretenses, only to be met with silence once the fraudsters vanish.Festive Season Risks and ATM Scams
As we approach the festive season, cybercriminals are waiting to strike. Travelers abroad are particularly vulnerable, struggling with unfamiliar ATMs and easily trusting strangers offering help. Never accept assistance from strangers at ATMs. Always ensure the card you leave with is yours. Scammers are swift and they can swap your card and capture your PIN within seconds.
Victim shame (batho ba taareng) often prevents full disclosure, hindering remediation and trend analysis. Financial institutions rely on accurate details to implement corrective, detective, and predictive controls. Kana bank employees for example, are experienced professionals who would never trivialise or make light of a customer’s plight or misfortune. There is simply no incentive in doing so and without any doubt , these professionals are committed to ensuring that clients or customer are treated diligently and derive the best experience ever when using their services.
In addition, regulators mandate that service providers ensure customers are treated fairly at all times. This principle underpins transparency, accountability, and equitable service delivery.
”Kana Masasasa bone ba inneela hela mogo rona. Gape Sepedi kana Sepitori dina le “that thing” so moguy kana mogirl ha kopa gogo thusa ha ATM a bua teme ya teng, you are gone. O thanyahela madi a setse a tswa mo accounting.
Recently, scammers have been creating fake sites and social media pages using bank logos to advertise quick loans or send SMS links that steal banking information, including card images and PINs. Sharing this information gives criminals unrestricted access to your account. Remember: never share OTPs or enter them on unverified sites, they are your last line of defense.
By Kagiso Patrick
Kagiso is a seasoned fraud risk practioner with extensive experience in managing bank fraud risk coupled with prior experience in law enforcement and security intelligence. He writes this article in his personal capacity but considers this as a kind gesture to the citizens and residents of Botswana and wishes that the message will be valuable to them.
Mambo Village, North East, Botswana
