MTN: AI-enabled smishing and vishing detection

At MTN Group Fintech, social engineering fraud had emerged as one of the most damaging typologies across the network, with criminals impersonating MTN representatives through voice calls and SMS messages to deceive customers into authorising fraudulent Mobile Money (MoMo) transactions or tricking them in sending e-money transfers through various fraudulent narratives and psychological manipulation. This typology evolved continuously in response to traditional controls, and the volume and variety of impersonation methods made static rule-based detection insufficient. MTN Group Fraud and Forensics, operating as a second line of assurance within Group Risk and Compliance, initiated a programme to deploy a Machine Learning (ML) model capable of detecting social engineering fraud dynamically, with a proof of concept (POC) deployment in a West African market in February 2026.

Solution

MTN Group Fraud and Forensics developed a supervised ML model trained to identify the behavioural signatures characteristic of voice (vishing) and SMS-based impersonation fraud (smishing). The model analysed transaction and communication patterns associated with social engineering activity, enabling detection of suspicious behaviour prior to or concurrent with a fraudulent transaction. The model was developed internally and deployed as a POC in a West African market in February 2026. The model was subsequently evolved from a supervised to an unsupervised ML architecture, extending detection capability to emerging fraud patterns beyond the boundaries of previously labelled data. Following validation in the pilot market, the model was deployed across two further markets, with investigation outcomes fed back into the model to support ongoing calibration against evolving fraud tactics.

Impact

Over a six-month period, the model detected and referred approximately 91,000 suspicious transactions and attempts for investigation, giving the fraud operations team visibility into impersonation and voice-based scam activity that had previously gone undetected. Investigation feedback from the pilot market has since indicated that the underlying fraud typology is evolving, which has led to a decline in the model’s true positive rate; this is being addressed through the transition to the unsupervised architecture and through continued model retraining. The model has since been deployed across two further markets, and comprehensive performance data covering all three markets is expected within two to three months. Once fully integrated with downstream systems, the model is expected to reduce the time between alert generation and customer protection, moving from a human-mediated response towards automated intervention.

Additional information

Cost: Medium. The model was developed internally, leveraging existing data infrastructure, with the primary cost drivers being data engineering, model development, and the ongoing requirement required to retrain and recalibrate the model as fraud typologies evolve across Operating Companies (OPCOs). Extending the model to two further markets added incremental deployment and localisation costs while reusing the core modelling framework.

Participating organisations: MTN Group Fintech – Group Fraud and Forensics

Location: Sub-Saharan Africa