Financial Scams
Senior 6 · General and Religious Studies
Financial Scams
Lesson 3 of 4
24 min
In November 2025, the Rwanda Investigation Bureau (RIB) arrested three people suspected of stealing more than Rwf 17 million from fuel stations across the country. According to press reports, they did not break any lock. They pretended to pay for fuel by mobile money, got hold of the station's phone, and on a laptop asked the mobile-money business portal to reset the station's password, claiming they had forgotten it. The system sent a one-time code to the station's phone, which was in their hands. With that code, they became the station, as far as the system knew.
This is identity fraud today: criminals no longer need your face or your signature. A phone number, a code or a password is enough for a computer to believe that they are you.
Definition
Personal data (Law N° 58 of 2021, Article 3): "any information relating to an identified or identifiable natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier" or other factors specific to that person.
Identity theft: stealing someone's personal data. Identity fraud: using stolen or false identity data to obtain money, goods, credit or services.
Phishing: tricking people into revealing confidential information through fake websites or messages; by SMS it is called smishing, by voice call vishing.
SIM swap: persuading or bribing a telecom agent to move a victim's phone number to a new SIM card held by the criminal, who then receives the victim's codes.
Account takeover: a criminal gaining control of someone's mobile-money, bank, email or social-media account.
Deepfake: a fake image, video or voice recording made with artificial intelligence to imitate a real person.
Look at the example above and find the red flags:
| Red flag | In the example |
|---|---|
| The sender's address is not the institution's real one | It comes from "trust.ameribank7.com", not the bank's own address |
| A frightening event you did not expect | A login from a new device in another city and "4 new transactions" |
| Urgency | "Reset your password immediately" |
| A link that leads to a look-alike website | The reset link goes to the same "ameribank7" address |
| A generic greeting and small mistakes | "Dear account holder"; "divice" for "device"; signed "Bank America" under a "Bank of America" logo |
The same flags appear in SMS and WhatsApp messages in Rwanda: a message "from your bank" or "from MoMo" with a link, a code or a number to call.
Important
Source A: Law N° 60 of 2018 on Prevention and Punishment of Cybercrimes
Article 36 (Phishing): "A person who establishes and uses a website or sends an electronic message using a computer or a computer system in order to have access to confidential information from a visitor of the website or recipient of the message with intent to use them for unlawful purposes, especially for the purpose of stealing money or obtaining access to a computer or a computer system, commits an offence." Penalty: one to two years' imprisonment and a fine of Frw 1,000,000 to Frw 3,000,000.
Article 40 (Impersonation): "Any person who intentionally uses somebody identity over the internet in bad faith to profit, mislead or destroy reputation or otherwise [...] commits an offence." Penalty: three to five years' imprisonment and a fine of Frw 1,000,000 to Frw 3,000,000.
Article 36 makes phishing a crime even before any money is stolen: sending the fake message "in order to have access to confidential information" is enough. Article 40 protects identity itself: using someone's name or a confusingly similar one online to mislead is punished more heavily than phishing. Rwanda's data-protection law, Law N° 58 of 2021, adds a duty on organisations that hold personal data to protect it, supervised by the National Cyber Security Authority (NCSA). Together, the laws protect three things: your information, your identity and the systems that hold them.
Warning
Your one-time code is your signature. Many people guard their PIN but read a one-time code (OTP) aloud to a caller "from the bank". No real bank, telecom company or RIB officer will ever ask you for your PIN or a one-time code.
Tip
Think like the thief. Before posting or sharing anything, ask: could this help someone pretend to be me, or answer my security questions? A photo of your ID card or of a boarding pass is a gift to an identity thief.
Important
Discuss. A classmate offers you Frw 10,000 to let "a friend" receive money through your mobile-money account for one day. What could happen to you, and why does Figure 3 explain the offer?
Practice
Sources and credits
Written by Ganzaa: Figure 3, the tables and the exercises.
This lesson adapts CC BY-SA material and is shared under CC BY-SA 4.0.
