Fraud in Uganda: How Millions Were Lost to Internal Collusion

Kampala’s Anti-Corruption Court is at the epicenter of a major mobile money fraud, as the case continues against six ex-employees of MTN charged with defrauding the company of 10 billion UGX ($3.4 million). Among those charged is MTN’s former Finance Manager, along with the Head of Public Access and mobile money, who is counter-suing MTN for wrongful dismissal. Charges laid against the six ex-employees include embezzlement, electronic fraud, a neglect of duties, and unauthorized disclosure.

Along with sensational daily headlines, this case is providing a detailed account of the impact of a particularly large and public internal fraud on the mobile money system. Testimonies revealed that a significant portion of the money stolen came from MTN’s suspense account, which temporarily holds unclassified or disputed transactions. This includes funds from customers who enter the wrong number for their intended recipient, a not uncommon occurrence and reported to be one of the drivers of relatively high agent-assisted over-the-counter transactions in Uganda. The account did not have appropriate reconciliation procedures in place, which allowed the fraudsters to steal billions of shillings in just a few months between May and December of 2011.

MTN Uganda is not the only company impacted by fraud. Late last year in neighboring Rwanda, Tigo lost over 495 million francs ($170,000) when staff colluded to manipulate the mobile money system. There are many more cases like this that go unreported, and are dealt with quietly by providers. CGAP partners globally are increasingly concerned about fraud – both fraud conducted by internal staff as well as fraud perpetrated externally against agents and customers.

One of the most worrying aspects of the MTN case was that fraudsters internally generated float, or created e-money, on the mobile money system. The float was then sent to colluding agents and customers who cashed out the value. This means that e-money was being generated that was not backed by physical cash in MTN’s bank account held at Stanbic. As one former MTN employee testified, the stolen money was essentially “printed by MTN itself”. This demonstrates how fraud of this nature can have financial stability implications.

The unauthorized internal generation of float led to massive discrepancies between the general ledger account (MTN’s e-money balance) and bank balance at Stanbic. At one point, audit reports revealed that the discrepancy totaled 146 billion UGX, roughly $50 million, in falsely created e-money. The audit reports, from as early as 2009, warned MTN of various weaknesses in the mobile money system that made it prone to fraud, such as the mismanagement of user rights administration. It was reported that terminated employees continued to have access to the system as their user rights remained active and their passwords unchanged.

Staff were also able to use multiple active user log-ins which made collusion easier and the system much more susceptible to fraud. While MTN reached out to Fundamo, the platform provider for the mobile money system at the time, to help the IT Team tackle specific risks, adequate solutions such as stricter controls and procedures were not implemented, the fraudsters prevailed and billions of shillings were lost.

Since the fraud case, MTN has taken significant action to strengthen their systems in Uganda. The company spent nearly 14 billion UGX ($4.7 million) on a financial migration project, and rolled over from the Fundamo platform to an Ericsson one which they expect to be more secure. One important feature on the platform is that it allows senders to see the recipient’s name before money is sent. This decreases the number of wrong number transactions and reversal requests, and lowers the balance on the suspense account. The company also implemented stronger internal controls and is working more closely with the central bank to ensure that adequate monitoring procedures are in place. MTN also covered the full cost of the losses incurred by the fraud to ensure that the money of both customers and agents was not affected.

The very public nature of this case and scale of the losses will hopefully lead to some positive outcomes in both Uganda and beyond. At the very least, we are anticipating that the MTN case will inspire more open and forthright conversation around fraud among industry actors in mobile money markets around the world.  More open dialogue can pave the way for the identification and adoption of practices that mitigate the risk of internal fraud.

Conversations with CGAP partners have revealed that some providers have already put such practices in place. This includes the clear separation of duties for staff (different members of staff initiate and approve transactions), better management of password access (2 or more passwords needed to access the system), having internal staff and departments dedicated to monitoring and addressing fraud (compliance departments within providers or having full-time resource to ensure that all issues raised by audits are addressed), implementing automated reconciliation systems for e-float accounts (performed daily by independent units), and automating transaction monitoring and revenue assurance systems to ensure that suspicious transactions are noticed immediately and addressed swiftly. 

Although mobile money providers need to take the lead in strengthening their platforms and risk mitigation processes, regulators need to adequately oversee that sufficient internal controls are in place. In Uganda, the MTN fraud case has led to an increased sense of urgency to strengthen regulation in this area. As we explained in a blog earlier this week, the central bank will not have the legal authority to regulate the payments sector until the BOU Act is amended and a payments law enacted. Against the backdrop of the fraud trial, the Governor of the BOU expressed concerns regarding the impact that ‘radical’ mobile money business will have on financial regulation.

The Governor also commented that the central bank’s ability to control interest rates could be undermined if action was not taken and that existing prudential regulation may no longer be sufficient to protect customers’ money and ensure the stability of the overall financial system. We are hoping that this new sense of urgency is translated into action. At the very least, the central bank can take a more active role in ensuring that mobile money providers have put in place adequate controls for risk management, instead of outsourcing the supervisory task to banks in Uganda as they do now. Such measures will increase the chance that discrepancies between e-money float and cash in bank are closely monitored and that any such discrepancies are swiftly addressed.

As the details of this case unfold, it is clear that failure to closely monitor and aggressively address fraud can result in significant losses to providers as well as undermining the confidence of customers and the regulators entrusted with protecting them and the integrity of the financial system.