WhatsApp, Mobile Money and AI scams: how to protect yourself

An AI-powered scam is an old fraud — the relative in trouble, the fake agent, the fake bank adviser — made convincing by artificial intelligence: a message with no mistakes, a voice that sounds exactly like your brother, a video in which a public figure “guarantees” an investment. The script has not changed. The quality has.

In July 2026, Le360 reported the story of a student in Yaoundé. Her parents had just put 500,000 FCFA into her Orange Money account. In a WhatsApp group she saw a scholarship offer for Canada and entered her details on the site it pointed to. Minutes later her WhatsApp and her Orange Money were hijacked. The account was empty.

She is not alone. In 2025 Cameroon’s ICT agency, ANTIC, handled 32,500 judicial requisitions, 30% more than in 2024. And according to INTERPOL, artificial intelligence now plays a part in 55% of reported cybercrime in Africa.

This guide walks through the seven scams to know — a cloned voice, a hijacked WhatsApp account, a fake Orange Money or MTN MoMo agent, a fake bank call and more — and gives, for each, the reflex that beats it. Then come the settings to change today, the rules a business should write down, and what to do within the hour if it is already too late. Whether you live in Douala or in Houston, London or Montreal, the reflexes are the same.

What does AI actually change in a scam?

Three things, and together they make the old warning signs useless.

The message has no mistakes. The FBI notes that criminals use generative AI to limit the grammar and spelling errors that used to give them away. According to the EU’s cybersecurity agency, over 80% of phishing emails identified between September 2024 and February 2025 reportedly used AI to some extent (ENISA, 2025). Perfect English or French proves nothing any more.

Voices and faces can be imitated. AI can reproduce a voice from recordings posted online. In the United States, victims reported more than $5 million lost in 2025 to “distress” scams in which a family member’s voice was cloned (FBI IC3 2025 report).

Volume and personalisation explode. Data stolen in breaches is used to write messages that name you, your bank, your last order. In France, phishing became the number one threat in 2025, up 70%, according to the government’s victim-support service, Cybermalveillance.gouv.fr.

What does not change: a scam still needs you to do something. Give a code, approve a transaction, send money, install an app. That is exactly the moment to stop it.

Only ANTIC’s figure is about Cameroon itself. The others describe African, American and European trends: the same tools are used everywhere. They can work for your business too: to use them without exposing your data, see our LLM guide.

Which seven scams should you know about in 2026?

1. A loved one’s voice calling for help

A call, often late at night. Your son, your mother, a cousin abroad: an accident, an arrest, a hospital. You must pay right now, and above all tell nobody. The voice really does sound like theirs: it may have been built from their videos and voice notes.

The reflex: hang up and call the person back on the number you already have. Agree on a family code word, as the FBI recommends, and ask for it whenever someone wants money urgently.

2. The hijacked WhatsApp account asking your contacts for money

The scammer needs the six-digit code WhatsApp sends by SMS to register your number on another phone. They ask you for it on some pretext: “I sent you a code by mistake”, a competition, a check. Once inside, they message all your contacts with your photo and your way of writing: “send me 50,000, I’ll pay you back tonight”. The same Le360 article describes a hijacked Facebook account asking a friend of the victim for exactly that sum.

WhatsApp is clear: never share your registration code with anyone, not even friends or family.

The reflex: that code goes to nobody. And if a relative asks you for money by message, call them before you pay.

3. The fake Mobile Money agent

A call or a text: your account is about to be blocked, a transfer arrived by mistake, an “update” is needed. You are asked for your PIN, or to approve a transaction you did not start.

MTN says it in black and white on its site: never share your password with anybody, not even an MTN agent. Orange publishes on its OM Anti-scam page the list of the only numbers allowed to call Orange Money customers.

The reflex: your PIN stays yours. Hang up, then call customer service yourself: 8787 at MTN, 8900 at Orange from an Orange line.

4. The fake adviser and the number that looks “official”

The call seems to come from your bank, your mobile operator or a government office. The caller knows your name and your branch and pushes you to “secure” your account. In France, fake bank adviser fraud grew 159% in 2025 and now also uses WhatsApp, while phone-number spoofing jumped 517%, according to Cybermalveillance.gouv.fr. The number on your screen can be faked.

The reflex: an incoming call proves nothing. Hang up, then call the number printed on your card, your contract or the official website.

5. The video of a public figure guaranteeing an investment

A minister, a musician, a famous business leader “recommends” a platform that doubles your money. The video is fake, and so is the account. Since January 2024, ANTIC has identified 8,499 fake accounts posing as senior public figures and had 6,416 of them closed. In France, fake investment fraud grew 277%, with recruiters inviting victims into WhatsApp “investor” groups.

The reflex: no genuine investment guarantees a return. A promise of safe, fast profit is, on its own, proof of a scam.

6. The fake boss and the fake supplier

A message from the “managing director”, travelling: an urgent, confidential transfer, to be made before tonight. Or a “supplier” announcing new bank details or a new Mobile Money number. This is business email compromise. INTERPOL describes it as prolific in Central and West Africa, and in 2025 the FBI’s IC3 recorded more than $30 million in business losses to cases involving AI: emails written in the director’s exact tone, a cloned voice to confirm.

The reflex: no payment and no change of details without a call-back on a number you already know, and a second person who approves.

7. The fake website, the fake scholarship, the fake app

A site copied from a well-known travel agency’s. After a first payment, the victim gets a call and is guided, step by step, into giving access to their money. In September 2026 the gendarmerie arrested two suspects in Yaoundé from a ring of this kind, accused of taking more than 50 million FCFA. Fake scholarships and fake jobs work the same way, and so do “enhanced” apps: WhatsApp warns that linking your account to an unofficial app can get it banned, or used to send scams to other users.

The reflex: type the official address yourself, install only official apps, and remember the rule reputable job sites repeat: you never pay to apply.

Which settings should you change today, in fifteen minutes?

Do them now, on your phone and on your family’s. The paths given are the ones in each service’s official help.

• ☐ WhatsApp: two-step verification is on, with a strong password (Settings > Account > Two-step verification)
• ☐ WhatsApp: an email address you can access is added to the account (Settings > Account > Email address)
• ☐ WhatsApp: your linked devices have been checked, and any device you do not recognise logged out
• ☐ WhatsApp: notifications are on, so you are told when a device is linked to your account
• ☐ Mobile Money: nobody but you knows your PIN, and you have changed it if you ever shared it
• ☐ Mobile Money: the official numbers are saved in your contacts — 8787 for MTN, 8900 for Orange (699 900 555 from another network)
• ☐ Mobile Money: you know where to report fraud — MTN’s fraud platform, or #150*60# at Orange
• ☐ Shop: payments arrive on a number in the business’s name, separate from any personal number
• ☐ Email and bank: multi-factor authentication is on
• ☐ Passwords: a different password for each important account, kept in a password manager
• ☐ Family: a code word is agreed, including with relatives who live abroad
• ☐ Social media: your profiles are private, and you post fewer public videos and voice notes

In a business: which five rules should you write down?

On the day the “director” calls in a hurry, a rule nobody wrote down does not exist. These five fit on one page:

1. Call back before you pay. Any request to pay, refund or change details — bank account, Mobile Money number, delivery address — is confirmed by calling back a number you already know, never the one in the message. Above a threshold set in advance, a second person approves.
2. One account per person, with multi-factor authentication. No shared passwords, and a departing employee’s access is cut the same day. Our guide to IT for a growing business sets out this foundation.
3. Published official channels. An email address on your own domain and a website listing your official numbers: an impostor writing from a free webmail address stands out at once. See Nematek One Domain & Email.
4. Mobile Money reconciled every evening. A fake payment SMS shown by a customer in a hurry is caught at the daily close. The method is in our guide to reconciling MTN MoMo and Orange Money.
5. Half an hour of awareness every quarter. Take one scam from this guide, act out the scene with the team, and check that everyone knows the right reflex.

Why is the diaspora such a prime target?

Because it sends money, it cannot drop by to check, and the family back home trusts it.

The scripts are well known. A message from a “nephew” who has “changed numbers” and needs money for an exam. A fake bank adviser calling a Cameroonian in Paris or Montreal from what looks like the bank’s number. A WhatsApp group of “investors” promising to grow your savings back home. A fake scholarship or visa offered to a parent in Douala.

The rule, on both sides:

• a family code word, known to everyone and never written in a chat;
• a call to the old number before sending any money, even when the message comes from a “new” one;
• a check with a second relative when the request is urgent;
• no blind trust in a video: INTERPOL notes that AI-generated identities can get past even advanced biometric checks. A picture alone no longer proves who you are talking to.

Managing your business remotely? Our guide to running a business in Cameroon from abroad explains how to set a spending limit above which your approval is needed.

Account or money taken: what should you do within the hour?

These steps are for a hijacked account or stolen money. If it is your computers or your server that have been hit, follow the first 24 hours in our guide to ransomware protection instead.

1. Take your WhatsApp back. Re-register your number with the six-digit code you receive by SMS: according to WhatsApp, every linked device is then logged out, the scammer’s included. Try to recover the account before reporting it, or it may be banned.
2. Warn your contacts through another channel — a call, an SMS, a status: “my account was hacked, do not send anything”.
3. Call your Mobile Money operator: 8787 at MTN, 8900 at Orange. Report the fraud on MTN’s fraud platform or through OM Anti-scam.
4. Call your bank if a card or a bank account is involved.
5. Change your passwords from a clean device, then turn on two-step verification and multi-factor authentication wherever they were missing.
6. Keep the evidence: screenshots, numbers, transaction references, links. ANTIC’s CIRT asks victims not to delete anything (page in French).
7. Report it, according to where you are (table below). For a significant loss, file a police report.

Where do you report a scam, depending on the country?

ANTIC’s CIRT handles account hijacking, identity theft, Mobile Money fraud and online scams, among others. For an honest mistake — money sent to the wrong number — MTN describes a self-service reversal for transfers made through *126#.

What does the law say in Cameroon?

Two texts apply. Law No. 2010/012 of 21 December 2010 relating to cybersecurity and cybercriminality in Cameroon is the reference text on cybercrime. Law No. 2024/017 of 23 December 2024 relating to personal data protection in Cameroon governs how your data is used, including by the businesses that collect it.

This guide is not legal advice. For a significant loss, file a complaint and get advice on your rights.

How can Nematek help?

Our cybersecurity services start with an assessment of your real risks and a plan ranked by priority. They cover access management — one named account per person, multi-factor authentication, least privilege and protected admin accounts — without an oversized security stack.

Nematek One Secure brings together a security assessment, an inventory of accounts and devices, professional email with domain, DNS and multi-factor authentication, incident support and awareness. So that your customers recognise your real channels, Nematek One Domain & Email puts your email on your own domain, and Nematek One Web gives you a website to publish them on. And Nematek One Mobile Money brings payment exceptions to the surface, with approvals and an audit trail.

Our IT training includes cybersecurity, delivered at your premises in Douala, Yaoundé, Buea or another reachable city, in English or French.

One precaution applies to us too: Nematek never asks for money to join its ambassador programme. If anyone asks you to pay in Nematek’s name, it is not Nematek: report it on +237 695 809 376 or to ambassador@nemateksolutions.com.

To review your accounts and procedures, describe your situation in a free assessment request.

Which message should you forward to your family?

Copy these five lines and send them to your family WhatsApp groups:

1. I never give anyone a code I receive by SMS, or my Mobile Money PIN.
2. If a relative asks me for money by message, I call them on their usual number.
3. An “official” call gets checked: I hang up and call the official number back.
4. No genuine investment guarantees a profit, and a scholarship never costs money.
5. Before sending money in a hurry, I ask for our family code word.