From SMS OTP to Network APIs: How SIM Swap Fraud is Forcing African Operators to Rethink Authentication

The one-time password remains the default defence for most African banks and mobile-money platforms. It travels by SMS, and anyone who intercepts it can impersonate the user. SIM swap fraud works exactly this way: an attacker takes over a phone number, receives the verification code meant for the real owner, and drains the account behind it.

The scale is growing. SIM swap fraud surged 327% in Kenya in 2025, with more than 123,000 fraudulent SIMs issued and an estimated $3.8 million drained from mobile wallets, according to INTERPOL’s African Cyberthreat Assessment Report 2026 .

This #TechTalkThursday examines how operators are weighing SMS cash flows against CAMARA-compliant security APIs, where the SIM swap use case is already commercially proven, and what the path from one to the other looks like for African networks.

Why SMS OTP Is Becoming a Liability

Enterprise SMS has been a dependable revenue line for African operators. A2P SMS prices have nearly doubled since mid-2021, with 90% of operators raising fees, according to analysis presented at MEF’s Leadership Forum Africa. Banks and enterprises rely on SMS for alerts and authentication, and switching costs are real.

That same channel, however, is the attack surface. Once a number is compromised, the OTP becomes the key. In South Africa, nearly 60% of mobile banking fraud cases are linked to SIM-swap attacks, according to the Communication Risk Information Centre. In Kenya, a High Court ruling  held both Diamond Trust Bank and Safaricom jointly liable for a SIM-swap fraud that drained Sh4.4 million from a customer’s account, apportioning 60% of the liability to the telco and 40% to the bank. The court found concurrent duties of care.

When operators share liability for fraud that travels over their networks, the cost of maintaining SMS OTP channels is no longer zero. It includes potential litigation, reputational damage, and the erosion of enterprise trust.

What Network APIs Change

CAMARA-compliant network APIs let banks and fintechs query mobile networks directly for real-time SIM swap detection and number verification. Instead of waiting for an SMS that can be intercepted, a bank can ask the network whether the SIM attached to a number has recently changed. The GSMA’s Open Gateway initiative  has standardised these interfaces, and the SIM Swap API is one of the more mature offerings in the catalogue.

This is not a full replacement for every SMS use case. It is a targeted tool for the highest-risk authentication flows. Operators and vendors have begun exposing these APIs, and early deployments in markets such as South Africa (including MTN’s Chenosis platform working with banks) are focused on verifying live SIM status during transactions.

The Commercial Tension

The technical case is clearer than the commercial one. Enterprise A2P SMS remains a high-margin, visible revenue stream. Network API revenue is still early. Analysys Mason estimates enterprise and consumer spending on CAMARA-based APIs worldwide will grow from $550 million in 2024 to $7.6 billion in 2030 — still a small share of overall mobile service revenue. Authentication and fraud-prevention APIs are expected to form the largest category.

The structural problem is attribution. A bank paying for SMS OTPs sees a clear line item. A bank consuming API calls for background fraud checks sees a diffuse cost that is harder to price and harder for operators to monetise at premium rates. Per-call pricing inherited from the SMS model often treats every verification the same, whether it is protecting a high-value transfer or a low-risk login.

“It’s difficult to monetize 5G at a consumer level, I’ve always said this, and I still stand by it. So imagine putting billions into a network, just to do exactly what you did before.”

— Jorge Mendes, CEO, Cell C

 

Who Captures the Value

No single African operator can serve a bank that operates across multiple countries through one integration. Aggregators have stepped into that gap. Global platforms and regional players such as NetAPI Telecom and COURE are packaging CAMARA-compliant APIs and exposing them through a single interface. Some of these aggregators already compete with operators for enterprise messaging revenue.

Operators that build their own developer and enterprise channels (MTN’s Chenosis and Zain’s Dizlee being the clearest African examples) can retain more of the relationship. Most others risk supplying the underlying network capability while software layers capture the enterprise margin.

The Strategic Choice

Banks are increasingly unwilling to absorb the fraud losses that SMS OTP channels enable, and courts are beginning to hold networks liable. Operators that offer robust API verification can keep the enterprise relationship. Those that hesitate risk watching clients migrate to a competitor or an aggregator.

The shift will not be a clean, one-for-one replacement of SMS revenue. The operators that capture value will be those that move beyond pure per-call pricing, package capabilities around specific problems such as fraud prevention, and act before liability costs force their clients to switch first.

If they do not, the API economy risks repeating the SMS pattern: operators provide the network, while software companies capture the enterprise value. The difference this time is that the operators can see it coming.