DR Congo

The people in reach of a scam are the people with a mobile money account on their phone. At the end of 2025 the telecoms regulator counted 34.3 million such subscriptions, including accounts inactive for up to 90 days. That is 30.6 percent of the population, and nearly 46 percent of mobile lines. Vodacom held 15.4 million, Airtel 11.1 million and Orange 7.7 million. Kinshasa had 7.46 million mobile money subscriptions, a penetration rate of 53.6 percent, in a city that already has 135 mobile lines for every 100 people, because many people carry more than one SIM.

The accounts follow the money. In the mining provinces, Haut-Katanga has a mobile money penetration rate of 85.3 percent and Lualaba 77.2 percent. In Bas-Uele the rate is 4.7 percent and in Tshuapa 5.8 percent. The Digital Code calls phishing the trick of persuading a person, or a system, to give up personal data, and then using that data, or a pretence of being a trusted institution, to take money. In the files CENAREF analysed for 2021 to 2023, the people named were mostly Congolese, and the firms sat mainly in mineral trading and general commerce.

The published files show two ways in. One is a false identity document: a customer opened two accounts at the same bank with two different identity cards, and a transfer of US$1.2 million followed. The other is a payment that arrives already stolen. On 10 August 2023 a fraudulent SWIFT transfer of US$35,000 was paid into an account and then taken out in cash.

The money moves as mobile money. In the last quarter of 2025 the four services took US$147.0 million in fees on transactions, 21.9 percent more than the US$120.6 million of the quarter before, and above the US$99.0 million of the last quarter of 2024. M-Pesa accounted for US$64.3 million of the latest quarter, Airtel Money US$60.7 million, Orange Money US$21.2 million and Afrimoney US$0.7 million. The average fee revenue per subscription that quarter was US$1.43 a month. Fee income shows the size of the rail, not the sum customers sent.

A balance leaves when someone else can act on the account. The Digital Code makes it an offence to phish for personal data, to take another person's identity on a computer system, and to use personal or confidential information to divert public or private funds. In the August 2023 file, the US$35,000 was withdrawn in more than 26 visits to the bank's own cash machines between 10 and 15 August.

What can stop a payment is the bank's own alert, and the central bank's rules. In that file the foreign correspondent asked for the money back, the Congolese bank's system flagged the transfer as fraudulent, and the bank stopped further movements and reported the case to CENAREF. The central bank defines minimum security for payment instruments, watches that the rules are applied, and collects a fraud report from payment operators. Firms covered by the anti-money-laundering law must report a suspicious transaction to CENAREF without delay.

The sum CENAREF attaches to the files it sent the prosecutor from 2021 to 2023 is about US$1.51 billion of funds involved. That is the money inside suspicious transactions. Fraud was the underlying offence in 49.4 percent of the 87 files analysed, described as tax fraud, customs fraud, bank fraud and the use of false papers. In 2024 the unit classed 281 reports and sent 41 to the prosecutor. In 2023 it classed 303 and sent 44.

What comes back is what is still in the account when someone acts. In one published file a customer who had opened two accounts with two identity cards received US$1.2 million. Several transfers had already gone out. The account was then seized and part of the money was confiscated. In the August 2023 SWIFT file the US$35,000 had already been taken out in cash, in more than 26 withdrawals, by the time the correspondent bank asked for it back. The Congolese bank stopped what was left and reported the case.

The Digital Code punishes the person who takes the money. Computer fraud, done to cause a loss and to gain an illegal advantage, carries five to ten years and a fine of 50 million to 100 million francs. Using personal data to divert funds carries the same prison term and the same fine. Pretending to be a trusted institution in order to obtain personal data carries five to ten years and a fine of 100 million to 200 million francs. Those are criminal penalties. The files show confiscation of what remains.

US$2m (CDF 5.38b) of it was returned to victims, 2.1% of the money lost.

Banks file almost all of the suspicious transaction reports. In 2024 CENAREF received 815, up from 714 in 2023. Banks filed 712, electronic money firms 57, property firms 15, other reporters 28, other financial firms 2 and insurers 1. The unit passed 41 of the 2024 reports to the public prosecutor and 44 of the 2023 reports, and it classed 281 and 303 without sending them on. Over the two years that is 1,529 reports received, 85 sent to the prosecutor and 584 classed.

A firm covered by the anti-money-laundering law of 27 December 2022 must report a suspicious transaction to CENAREF without delay. In 2024 the reports were mostly about tax fraud, customs fraud, mining fraud, the diversion of public funds, large cash withdrawals and transfers with no economic reason. The unit says the rise from 714 to 815 followed its own push to get firms to file. Electronic money firms filed 6.9 percent of the 2024 reports, beside 87.3 percent from banks.

Two other channels sit beside CENAREF. The central bank's supervision service takes notices of fraud, money laundering and irregularities in payments, and payment operators send the bank a fraud report as part of the surveillance of payment systems. Phone and internet companies must keep the data that identify who posted content, tell the authorities about illegal activity reported to them, and hand identity data to the prosecutor, the judicial police or the national cybersecurity agency when those authorities require it.

The figure shown here is an estimate of 124,580 scam cases recorded by the authorities in 2025, with 159.95 billion francs lost. It applies the cases India's national cyber crime portal recorded per adult to DR Congo's adults, and the money is India's recorded loss as a share of its economy applied to DR Congo's. It stands for what the police and prosecutors would record.

The files the public prosecutor receives from CENAREF are a different count. The unit sent 41 reports in 2024 and 44 in 2023, and 133 over 2021 to 2023, with about US$1.51 billion of funds in the three-year set. In the 87 files analysed, fraud was the leading underlying offence, at 49.4 percent. Cash withdrawals above US$10,000 were in 43.7 percent of the disseminated files. Transfers with no economic reason were in 49.4 percent, pass-through accounts in 21.8 percent and fraudulent transfers, including by SWIFT, in 15 percent.

The offence law for a scam by computer or phone is the Digital Code of 13 March 2023. Computer fraud carries five to ten years and a fine of 50 million to 100 million francs. Using personal data to divert funds carries the same term. Pretending to be a trusted institution to obtain personal data carries five to ten years and a fine of 100 million to 200 million francs. Counterfeit payment cards carry two to five years. The prosecutor and the judicial police can require a phone or internet company to produce the identity data it holds.

On the files CENAREF analysed for 2021 to 2023, fraud is the main underlying offence: 43 of 87 files, 49.4 percent. The unit describes it as tax fraud, customs fraud, bank fraud and the use of false papers. Its 2024 report says the reports received that year were mostly the same kinds, together with mining fraud and the diversion of public funds. False documents were a marker in 4.6 percent of the disseminated files, and the diversion of public money in 2.3 percent.

The path of the money is more repetitive than the legal label. Transfers with no economic reason were in 49.4 percent of the disseminated files. Cash taken out above the US$10,000 threshold, which the law says must not be settled in cash, was in 43.7 percent. Pass-through accounts, used to hold money briefly before it moves on, were in 21.8 percent. Fraudulent transfers, including through SWIFT, were in 15 percent.

For a person holding a mobile money account, the Digital Code's picture of the trick is phishing: a message or a page that gets someone to hand over personal data, then the use of that data to take the money, or a pretence of being a bank or another trusted body. A false identity card is enough to open the receiving account. One published file starts with two identity cards and two accounts, then a credit of US$1.2 million. Another starts with a SWIFT credit of US$35,000 on 10 August 2023 and ends, five days later, in more than 26 cash withdrawals.

DR Congo's response is a criminal code, a financial intelligence unit and the central bank, side by side rather than as one programme. The Digital Code of 13 March 2023 creates a national cybersecurity agency under the president. Phone and internet companies must keep identity data and tell the authorities about illegal activity reported to them. An order of 17 August 2024 gives the telecoms regulator the jobs of the digital regulator, the electronic certification authority and the data protection authority until those three bodies are in place.

CENAREF is where a bank report becomes a file for the prosecutor. Reports rose from 714 in 2023 to 815 in 2024, and 85 of the two years' reports were sent on, 44 then 41. Banks filed 712 of the 2024 reports and electronic money firms 57. In October 2022 the Financial Action Task Force placed the country on its increased-monitoring list, and in 2024 the government sent three progress reports on the action plan.

The central bank defines minimum security for payment instruments and collects a fraud report from the operators. Its supervision service also takes notices of fraud and of payment irregularities. In the published files the hold comes after the cash has moved: part of a US$1.2 million credit was confiscated only after several transfers, and a fraudulent payment of US$35,000 was in banknotes within five days.