Scam victims rarely speak up, so the payment system has to

On the Global Anti-Scam Alliance’s Africa Chapter panel on 1 October, I was asked for the one policy change that would do the most against scams. I gave three, because GASA’s own surveys show that few scams are reported to the authorities, so the payment system, which sees every transfer, has to do more of the catching.

On 1 October I joined the Africa Chapter of the Global Anti-Scam Alliance (GASA) to discuss its State of Scams in South Africa 2026 report, alongside Caroline Mampuru of SABRIC, Ursula Pearson-Williams of PayInc, Professor Julie Reid of UNISA, Poppy Kweyama of the National Consumer Commission and Patricia Eromosele of GASA. The brief for my slot asked for the single policy change that would make the biggest difference. I couldn’t pick just one, and GASA’s own surveys show why: very few people report a scam to the authorities.

GASA’s 2026 surveys of Nigeria, South Africa and Kenya asked 3,690 adults about scams. In every country, at least 84% had come across a scam in the past year and more than half had interacted with a scammer, yet only 4% to 7% reported a scam to the authorities. GASA’s pan-African survey of 4,830 adults puts reporting at 5%, while 21% lost money or data. When so few scams reach the authorities, any response that starts from a report sees only a small part of the problem, but the payment system that carried the money saw every transfer.

Confidence doesn’t stop scams, and victims rarely report them

GASA asked people whether they were confident they could recognize a scam. In South Africa, 85% said they were, yet 71% of the people who came across a scam went on to interact with the scammer. Interacting with a scammer isn’t the same as losing money, but feeling able to spot a scam didn’t stop people engaging with one. A good scam looks like a delivery notice, a job offer or a relative in trouble, and it can arrive at the exact moment you’re expecting the real thing. Awareness campaigns matter, but the numbers suggest people can’t avoid scams on their own, however well-informed they are.

Reporting a scam is harder than it should be, as my own household found. After we were scammed, we went to the police station straight after work to report it, and the officer told us his shift was ending and asked us to come back the next day. When we went to the bank, the bank wanted a police case number before it would investigate. The amount was fairly small, and after being sent back and forth between the police and the bank we gave up. We tried to do the right thing, but that scam never made it into anyone’s figures.

Beyond the financial loss, victims are dealing with emotional distress too: in South Africa, 77% reported effects on their mental wellbeing, and many feel too ashamed or disheartened to report.

“How do we even quantify scams if we’re not all comparing the same stolen apples to the same stolen apples?On the GASA panel

Three changes that would join up the response

My household’s experience shows a response split into silos: no single policy joins up the police, the bank and the regulator. So on the panel I proposed three changes, each of which is already working somewhere. The first is to make fraud detection a mandatory capability of the payment system, because few banks, mobile money operators or remittance agents are required to meet a standard for fraud detection as strict as the one they already meet for anti-money laundering. Singapore layers its response across banks, telecommunications companies, the police and digital platforms, and the Singapore Police Force reports that scam and cybercrime cases fell by almost a quarter in 2025. The second is a duty of care for scams across every sector a scam passes through: Singapore’s Shared Responsibility Framework gives banks, payment providers and telecommunications companies specific duties against phishing scams, and makes those companies pay the victim back when they breach their duties. The third is a national center for scam intelligence, where banks, regulators and law enforcement pool what each of them sees, as Australia’s National Anti-Scam Centre does, and the Global Signal Exchange does the same across borders.

Shared intelligence only works if everyone counts scams the same way. How do we even quantify scams if we’re not all comparing the same stolen apples to the same stolen apples? Until banks, switches and regulators count scams alike, a 5% reporting rate ends up standing in for the size of the problem.

What the payment system can see

A person sees one message, but the payment system sees the pattern behind it: a first transfer to a payee the account has never paid, an amount out of line with the account’s history, or a receiving account that collects from several unrelated senders and moves the money on within minutes. The last pattern is how mule accounts behave, and mule accounts are how scam proceeds leave the system.

A bank sees only its own customers. A switch sees both sides of a transfer between institutions, so the switch can notice an account at one bank collecting from customers of five others. But a switch can’t see transfers between two accounts at the same bank, so the complete picture needs the bank and the switch working together.

On the panel I also described the response to scams as a cliff edge. One version of “prevention is better than cure” says a sign at the top of a cliff, warning people about the drop, does far more good than an ambulance parked at the bottom. With scams, though, by the time someone stands at the edge, ready to make a payment they believe is legitimate, everything before that point has failed: the education, the warnings and the person’s own common sense. The person has already fallen for the scam. What waits at the bottom is recovery by the bank and the police. Once the money has left the first mule account, recovery is almost impossible, and the process too often leaves victims chasing the bank and the police in a way that victimizes them all over again. Many payment ecosystems offer victims nothing but that recovery. A check that runs while the payment is being made is the last line of defense against the loss: the check catches people halfway down, holding the payment for review and preventing the loss rather than chasing the money afterward. With instant payments, that check has to finish in a fraction of a second.

Even that check comes late, because the victim has already been taken in, but education at the top isn’t enough either, since people who feel sure they can spot a scam still engage with one. No single part of the response is enough on its own. Every part is essential, and all the parts have to work together.

Rules your own team can change as scams change

Tazama is open-source software that checks every transaction in real time, at a switch or a bank, or both, against rules the operator’s own team can read and change. In the Tazama Rule Studio, an analyst creates a rule for a new scam pattern, simulates the rule against past transactions to see what it would have flagged, and sends the rule for approval without a ticket to engineering. The Case & Investigation Management System turns each alert into a case with an owner and a deadline, and records whether the alert was right when the case closes. Those case outcomes, with the analytics in the Tazama Data Lakehouse, show which rules catch fraud and which only generate work, and train your detection models to get more accurate over time.

Reports from the victims who do speak up count for more too. A report that lands as a case is tied to the transaction, and the transaction to the pattern, so one report can improve the rules that watch everyone else’s payments.

Tazama is an open-source project hosted by the Linux Foundation, with support from the Gates Foundation.