Malebogo Hirschfeld
Manager: Forensic Services
Risk & Compliance, Bank Gaborone
As Botswana embraces digital banking and online services, financial fraud and cybercrime are becoming an increasing concern. In response, Government, regulators and financial institutions have made cybersecurity awareness a national priority, encouraging Batswana to remain vigilant against evolving scams.
The urgency is clear. The Bank of Botswana has warned of a rise in financial scams targeting banking and mobile money users, with the Botswana Police Service recording 175 cases of fraudulent transactions in 2024, resulting in losses exceeding P8 million. Investigations indicate that many of these incidents began with customers being tricked into sharing confidential banking information.
Fraudsters are increasingly disguising themselves as trusted institutions, and one of the fastest growing scams today involves criminals posing as bank employees and using Know Your Customer (KYC) updates as a cover to gain access to customers’ accounts. Picture this: your phone rings and the caller introduces themselves as a bank employee. Their tone is professional, they seem knowledgeable, and they explain that your account urgently requires a Know Your Customer (KYC) update. To add pressure, they warn that failure to act immediately could result in your account being frozen or restricted.
For many customers, this sounds entirely believable. After all, banks do request customers to update their information from time to time. KYC is a legitimate and important part of banking. It helps financial institutions verify customer identities, prevent fraud, combat money laundering and comply with regulatory requirements. Keeping customer information up to date is one of the ways banks protect both their customers and the integrity of the financial system.
Unfortunately, fraudsters know this too. Rather than avoiding the subject, criminals are increasingly using KYC as a tool to gain customers’ trust. They have realised that because customers understand the importance of KYC, they are less likely to question requests that appear to be linked to the process. The scam typically begins with a convincing conversation. The caller claims that urgent action is required and creates a sense of fear by warning that the account may soon be blocked, suspended or frozen. To sound credible, they may already possess some basic information about the customer obtained from social media, previous data breaches or other sources.
Once trust has been established, the real objective emerges. The fraudster starts requesting information that no legitimate bank employee would ever require. They may ask for a PIN, online banking password, One-Time Password (OTP) sent to the customer’s mobile phone, or other security credentials. In some cases, they may even instruct customers to authorise transactions or transfer funds to another account for so-called verification purposes. At that point, the conversation is no longer about KYC. It is about gaining access to your money. One of the most important distinctions customers need to understand is that there is a significant difference between submitting KYC documents and revealing security credentials.
Bank Gaborone may legitimately contact customers regarding the submission of documents such as identification, proof of address or employment information. However, the bank will never ask for your PIN, password, OTP or any confidential authentication information. Those details belong to you and should remain known only to you. A genuine bank employee will never ask you to transfer money to another account for verification purposes. They will never request security codes sent to your mobile device. They will never ask you to authorise transactions you did not initiate or disclose confidential credentials over the phone.
Any request of this nature should immediately raise suspicion. Criminals understand human behaviour remarkably well. Their most effective weapon is often not sophisticated technology, but urgency. They want people to feel rushed, anxious and fearful. When individuals believe their account may be frozen or that they could lose access to their money, they are more likely to act without stopping to verify the request. This is why one of the most effective fraud prevention tools available to every customer is simply taking a moment to pause. If you receive an unexpected call, email or message requesting sensitive banking information, stop and think before responding. Verify the request independently through official bank channels. End the call and contact your branch directly. A few minutes spent confirming the legitimacy of a request can prevent the loss of savings accumulated over many years.
The importance of vigilance extends beyond Botswana. Across Africa, online scams continue to be among the most reported forms of cybercrime, with fraudsters increasingly relying on social engineering techniques to manipulate victims into voluntarily surrendering personal information and banking credentials. INTERPOL has warned that cybercrime losses across the continent continue to rise as criminals become more organised, sophisticated and technologically advanced. This highlights an important reality: fraud is no longer just a banking challenge. It is a societal challenge.
Protecting citizens from financial crime requires a collective effort involving government, regulators, financial institutions, telecommunications providers, law enforcement agencies and individual customers. Botswana’s continued focus on cybersecurity awareness and digital safety reflects the country’s commitment to safeguarding its citizens and financial system from emerging threats. At Bank Gaborone, protecting customers remains a top priority. While the bank continues to strengthen its security controls and monitoring capabilities, the strongest defence against fraud remains an informed and vigilant customer.
The message is simple but crucial: submit your KYC documents when requested, but never share your PIN, password, OTP or any other confidential banking credentials. A legitimate bank employee may ask for documents that confirm who you are. A fraudster will ask for information that gives them access to your money. Knowing the difference could protect not only your bank account, but also your peace of mind.
