Follow Us on Google Discover
He moved politely from one table to the next.
I was sitting in the lounge of a hotel recently when I noticed a gentleman approaching guests, one after another, with what appeared to be the same request. Each person declined.
It would be wrong to speculate on their reasons, but it was clear that they were uncomfortable about entering into a financial transaction with someone they did not know.
Eventually he approached another guest and explained his difficulty. He had forgotten his bank cards but had enough cash to settle his hotel accommodation. The hotel, according to him, would not accept cash. Would someone be willing to pay the bill by card and take the cash in exchange? He offered a little extra as a gesture of appreciation and produced his passport to reassure the guest that everything was legitimate.
Also Read
At first hearing, this was a small kindness being requested. The sum involved was modest. The explanation sounded reasonable. Identity documentation was offered without hesitation. There was no evidence of wrongdoing.
From a financial crime perspective, however, the request raises questions that deserve an answer before anyone agrees to it.
The Questions That Were Not Asked
If a man has mislaid his physical cards, has he also lost access to Apple Pay, Google Pay, Samsung Wallet, online banking and every other recognised digital payment method? Could a relative or trusted friend not transfer the money directly to the hotel? Could the hotel not issue a secure payment link or accept a bank transfer against the reservation?
Perhaps each of those options had already been explored. Perhaps his account was entirely truthful. I make no allegation against that gentleman and draw no conclusion about his intentions, because I have no basis on which to do so. The purpose of the example is different. It illustrates a principle that sits at the centre of financial crime risk management.
The decisive question is rarely whether a person is telling the truth. The more useful question is whether there is enough information to understand a transaction before becoming part of it.
Consider the position of the guest had he agreed. A payment leaves his card. Cash he cannot properly account for enters his possession, together with a premium for the service he has provided. If that transaction were later disputed, reversed or reviewed by his bank, how would he explain in writing, several weeks afterwards and without the benefit of context, why he settled a hotel bill for a man he had never met and accepted untraceable cash in return?
Consider also the shape of the transaction rather than the intention behind it. An ordinary person with a clean record. A plausible explanation. A modest reward. A payment instrument belonging to someone above suspicion, used to convert cash into a legitimate transaction on regulated payment rails. Whatever was in that gentleman’s mind, that is the structure of a placement transaction, and it is the same structure on which money mule recruitment depends in every market I have worked in.
In financial crime, uncertainty is itself a risk, and recognising it is very often the first line of defence.
Ordinary People, Ordinary Accounts
Institutions face this problem at scale every day. Customers present authentic identity documents. Accounts pass onboarding checks. Payments appear unremarkable. The pattern becomes visible only through behaviour observed over time.
The Financial Conduct Authority set out its expectations clearly in October 2023, when it published the findings of its review of payment account providers’ systems and controls against money mule activity. Firms were expected to strengthen controls at onboarding, improve transaction monitoring to detect suspicious mule activity, sharpen their reporting, and raise customer awareness of the risks of allowing an account to be used by others. The regulator also noted that some firms were not monitoring incoming payments with sufficient care, which is a significant weakness, because much mule behaviour cannot be identified by examining outgoing transactions alone.
A later review by the same regulator produced a figure that should concern every compliance function on any continent. Between January 2022 and September 2023, 25 firms offboarded 194,084 money mules. Only 37 per cent of those cases were reported to the National Fraud Database.
Almost two hundred thousand accounts were identified as complicit in moving criminal proceeds, yet nearly two thirds of that intelligence never reached the shared database that would have allowed other institutions to recognise the same individuals. A firm that detects and removes a mule account without reporting it has protected its own balance sheet and left the rest of the market exposed. Collective defence works only when firms contribute to it.
What the Latest Data Shows
UK Finance published its Annual Fraud Report 2026 in June. It records that criminals stole £1.28 billion through payment fraud in 2025, an increase of four per cent and the second consecutive year of growth. More than four million confirmed cases of fraud were recorded, and the industry prevented a further £1.68 billion of attempted fraud.
The total is important, but the movement within it matters more. Unauthorised fraud, the category in which criminals must defeat a bank’s systems, fell by 5 per cent to £703.4 million. Authorised Push Payment fraud, in which the customer is persuaded to make the payment personally, rose by 19 per cent to £576.4 million across 248,070 cases. Investment scams alone accounted for £221.5 million, a rise of 40 per cent in a single year. Some 66 per cent of Authorised Push Payment cases originated online, and a further 17 per cent began through telecommunications networks.
The conclusion is difficult to avoid. Where criminals are required to break a control, they are losing ground. Where they can persuade a customer to authorise the payment on their behalf, they are gaining it. Sustained investment in technology has hardened the system and moved the point of attack onto the individual.
The Same Pattern in Nigeria
Nigerian data describes the same development.
The Nigeria Interbank Settlement System reported that digital payment fraud losses fell to ₦25.85 billion in 2025, a reduction of 51 per cent from ₦52.26 billion the previous year. That is a real achievement, earned through investment in behavioural analytics, biometric authentication and real time monitoring, and supported by regulatory intervention that included mandatory liveness verification, device binding and the direction that institutions receiving the proceeds of fraudulent transactions be debited.
The case numbers tell the other half of the story. Reported incidents fell by only about 4 per cent, from 70,111 to 67,518. Attempts have not reduced; they have become less profitable. NIBSS also identified social engineering as the most prominent fraud technique in the market, with Lagos accounting for roughly 63 per cent of recorded activity.
Two markets with different regulators, different currencies and different levels of maturity are therefore reporting the same underlying shift. Controls are improving. Criminals have responded by going around them, through the customer, the employee, the relationship manager and the obliging stranger in a hotel lounge.
Appearance Is Not Verification
The consequences of assuming rather than testing are well documented. In 2020 Wirecard, then regarded as one of Europe’s leading fintech companies, collapsed after €1.9 billion said to be held in escrow accounts could not be verified. The growth was real and the technology was real. Independent verification was not. No degree of technological sophistication can compensate for the absence of governance, transparency and internal controls that someone is prepared to test.
Questions Every Board Should Be Able to Answer
Fraud has outgrown its status as a compliance matter. It is a strategic business risk affecting customer confidence, institutional reputation, shareholder value and the stability of the wider financial system. Boards and executive management should be able to answer the following questions without hesitation.
Do we understand customer behaviour after onboarding, or only at the point of onboarding? Identity verification records who a customer was on a single day. Financial crime reveals itself over months.
Do we monitor incoming payments as carefully as outgoing payments? If we do not, mule activity within our own book remains invisible to us.
How quickly is unusual activity detected, and how quickly is it acted upon? An alert that no one investigates is not a control.
Are our people empowered to challenge a transaction that does not make sense? Where challenging a customer carries career risk and approving one does not, the outcome has already been decided.
Do we share what we find with the wider industry? Intelligence held privately protects one institution and weakens the market on which that institution depends.
Does customer education receive the same investment and board attention as product innovation? Where social engineering leads the typologies, an informed customer becomes a control in its own right.
The Real Measure of Success
Africa’s fintech industry stands at a defining moment. The continent is building one of the world’s fastest growing digital financial markets. African technology startups raised a record 4.1 billion US dollars in 2025, an increase of 25 per cent on the previous year, and fintech remained the largest recipient of equity investment. Digital payments, mobile money, embedded finance and cross border payment infrastructure are changing how hundreds of millions of people save, borrow, transact and build.
Sustaining that progress will require more than faster settlement and better customer experience. It will require institutions that place governance, financial crime prevention and customer trust at the centre of business strategy. Compliance should never be treated as a regulatory burden. It is an investment that protects customers, strengthens investor confidence, preserves institutional reputation and supports sustainable growth.
Artificial intelligence, behavioural analytics and advanced detection tools will continue to strengthen financial crime controls, and firms should keep investing in them. They cannot replace professional judgement. The strongest control I have seen applied in more than twenty years of practice was not a system. It was a person who paused, asked one further question and declined to take part in a transaction they did not fully understand.
As Africa continues to shape the future of digital finance, success will not be measured solely by how quickly money moves. It will be measured by how confidently customers, regulators, investors and society trust the systems that move it.
- Adedayo Folorunsho Aluko, MBA, MSc (Investment Management), ICA Advanced Certificate in Governance, Risk and Compliance (ICA Advanced GRC), ACIB, MCIPM, ACIPD Management Consultant | Financial Crime Compliance and AML Specialist | Governance, Risk and Compliance Professional | Author of Clean Hands, Bright Future: A Youth Guide to Avoiding Financial Crime in Africa
