A phone number held on a SIM card detached from a handset, with one-time-password envelopes rerouted into an attacker's phone while a bank account drains

The Number Is the Password: SIM Swaps, OTP Interception and Why Bank MFA Fails at Scale

The second factor is a third party Every mobile-banking MFA story ends the same way: the bank sends a one-time password to a phone number it does not control. On February 8, 2022, Mercy Wairimu K...

Sep 10, 2026 Cybersecurity, Fintech

A transaction network with a dense cluster of accounts linked by shared devices and phones highlighted as a ring, closed money loops arcing back on themselves, and a single weak shared-device link greyed out as a false positive

Fraud Rings Are a Graph Problem: Detecting Mule Networks in Transaction Graphs

The fraud is a network, not an account In June, October and November 2023, police in 26 countries arrested 1,013 people and identified 10,759 money mules, account-holders who lend their names to m...

Sep 9, 2026 Machine Learning, Fintech

Four exfiltration pipes (link, fetch, diagram, memory) carrying encoded data from an LLM assistant to an attacker's receiver dish

Follow the Leak: Four Channels a Prompt-Injected Agent Uses to Exfiltrate Data

Introduction On August 18, 2026 Microsoft patched CoSnitch, three Varonis Threat Labs findings in Copilot Personal that let a single click on a crafted link silently pull message bodies, calendar ...

Sep 8, 2026 AI Security, LLM

AI Crime Watch issue 1 cover — balanced scales of justice, a voice waveform on the crime pan and a gavel and shield on the justice pan

AI Crime Watch #1: The Voice-Clone Romance Ring That Fooled 20,000 People

Welcome to AI crime watch This is the first edition of AI Crime Watch, a bi-weekly look at what criminals are actually doing with AI, how investigators answer, and which research truly helps. Ever...

Sep 8, 2026 AI Security

Globe with glowing AI nodes across seven regions

Tuesday AI Update: Sep 8, 2026 — Mistral Raises €3B in Record European AI Round

The week in AI The week of September 1–7 opened with the densest burst of frontier-model activity this year: Anthropic, OpenAI and Google DeepMind all shipped flagship or specialist models within ...

Sep 7, 2026 AI Engineering, AI in Africa

A clock face near midnight above a draining mobile wallet, red channel-arrows converging on it, and a rising two-year bar that marks how fraud losses quadrupled in a single year

Fraud Went Mobile: Analytics Lessons from the CBK's 2024 Fraud Numbers

The regulator’s table is an analytics dataset Every year the Central Bank of Kenya publishes the Financial Sector Stability Report, and Table 14 (“Fraud cases and Exposure”) tells the sector’s fra...

Sep 6, 2026 Data Science, Fintech

Three-layer payment stack where the middle aggregator or BaaS layer is an opaque black box under red breach arrows, and the app above it can only verify the edges with HMAC webhook checks and daily ledger reconciliation

The Middleman Problem: A Security Playbook for Aggregator and BaaS Integrations

Your payment stack has a middleman Payment integrations come in two shapes. Direct: your server talks to the rail itself (Daraja, a card scheme, a bank API) and you hold every credential and callb...

Sep 5, 2026 Fintech, Cybersecurity

A red siphon leaving a bank building and splitting through a first-hop manifold into four mule accounts, with a targeting reticle over the split point

One Bank, Many Buckets: Anatomy of the Sidian Bank Sh7.88M Mule Heist

A Sh7.88 million heist with a student cast On Saturday, January 11, 2025, someone moved Sh7,882,845 out of customer accounts at Sidian Bank without the customers’ knowledge. By the time the courts...

Sep 4, 2026 Fintech, Cybersecurity

A merchant server and the Safaricom Daraja gateway joined by a dashed payment rail, with red attack arrows at the credential, callback and push-prompt joints of the integration

Mobile Money API Security: Daraja Integration Pitfalls That Lose Real Money

A payment rail with four open joints Every M-PESA business integration is a small payments company. Your server exchanges a consumer key and secret for a short-lived OAuth token, fires an STK Push...

Sep 3, 2026 Fintech, Cybersecurity

Two fraud-score population curves sliding apart on a PSI zone ruler, with a feature fill-rate gate flagging FAIL

Fraud Models Rot Quietly: PSI, Feature Drift and Data-Quality Gates in Production

The model is a photograph of a population A fraud model is a snapshot. It is trained on the transactions, accounts and devices of last quarter, then asked to score this quarter’s population. When ...

Sep 2, 2026 Machine Learning, Fintech