Threat taxonomy
critical activityMobile Money FraudFirst seen 2024
AgentDrain
Aliases: Agent channel abuse cluster
A fraud pattern combining compromised or complicit mobile money agents with SIM replacement to drain high-value wallets and launder proceeds through merchant float.
Attribution
Organised fraud networks with insider access
Primary targets
- — Mobile money wallets
- — Agent networks
- — Merchant float accounts
Observed tactics
- Agent credential theft via infostealers
- SIM swap through social engineering of carrier staff
- Rapid layering across merchant and agent accounts
Regional relevance
Highest-impact consumer fraud category across East Africa given wallet penetration and agent-led cash-in/cash-out.
Detection guidance
- Block transfers for a cooling-off window after SIM change
- Score agents on reversal and dispute rates
- Graph-analyse rapid multi-hop transfers to cash-out points
Related feed reporting
- critical13 Sept 2026
SIM swap surge against high-value mobile wallet accounts in Ethiopia and Kenya
- high05 Sept 2026
Android overlay malware rebuilt for East African wallet applications