A customer’s phone loses signal on a weekday morning. At her mobile operator, a request to move her number to a new SIM has just gone through. The person asking passed the operator’s checks, and the request looks like every other one processed that day. Within the hour, a one-time PIN reaches the new SIM, her banking app is set up on a device she has never owned, and her savings move to an account at another bank.

When she reaches her bank on a borrowed phone, it finds a login that passed every check and a payment approved with her own credentials. Each institution did what its process asked of it. The operator knew about the SIM swap, the bank knew about the payment, and neither knew about the other.

If each institution did its job, why did no one stop it?

Who sees it first, and who confirms it

In 2022, the Financial Action Task Force described a single financial institution as seeing “one small piece of what is often a large, complex puzzle”. The order in which the pieces arrive decides whether anyone can act on them. A 2026 survey by RUSI’s Future of Financial Intelligence Sharing programme found that telecoms matter most at the start of a fraud and banks at the end, where it is usually confirmed because the bank is who the victim calls. At the operator, a SIM change is routine. It only becomes evidence once a payment follows it at the bank, and by then the case reaches a Head of Fraud as a claim, after the money has moved.

South Africa shares by sector

South Africa already shares a great deal, one sector at a time. SABRIC pools crime data from participating banks, and through it the banks run an industry anti-scam centre that its 2025 report credits with a better chance of tracing funds before they disperse. COMRiC does the same for mobile operators, and its 2026 report opens by noting that no single operator can see the whole risk picture alone.

The two bodies collaborate, but each keeps its pooled intelligence within its own sector, and each measures the same fraud in its own books. COMRiC counted 383 SIM swap cases on the operators’ side for the year to April 2026. SABRIC, counting on the banks’ side, found that mobile banking carried the most SIM swap-related indicators. Where operator signals reach banks today, they come through commercial interfaces that answer a question about one number at a time. SAMLIT, the partnership that does cross institutional lines, has helped freeze accounts in live cases, but every party at its table is a bank or a public body.

Where other markets have gone further

Nigeria is the closest example, and it is a central bank and a telecoms regulator agreeing between themselves. In April 2026, the Central Bank of Nigeria and the Nigerian Communications Commission created a system through which financial institutions can check whether a number is active, swapped, recycled or flagged for fraud. It came seven years after the first multi-sectoral committee, and there are no results yet.

In India, bank data feeds a telecoms tool. The Financial Fraud Risk Indicator rates mobile numbers partly on their links to mule accounts reported by banks, and shares those ratings with banks and payment providers. Information moves in both directions.

Kenya shows where liability is already heading. In June, its High Court upheld a ruling that split a KES 4.4 million SIM swap loss 60:40 between a mobile operator and a bank, reading the SIM change and the transfers as one fraud enabled by failures at two organisations.

Singapore’s Project FRONTIER brings banks, telecoms firms and online marketplaces into one anti-scam network of more than 180 members, and FATF reports that it has shortened the time taken to freeze accounts. Singapore’s regulators have also bound banks and telcos to a shared responsibility framework that splits a scam loss according to which party’s duties were breached, which is what the Kenyan court did after the fact.

What stands in the way

POPIA and competition law are the familiar objections. FATF’s 2026 report names legal uncertainty as the most common barrier across jurisdictions, and finds that roughly three quarters of them have safeguards that let sensitive information flow lawfully. COMRiC’s members already share within both laws. The legal question has been answered inside each sector. Extending it across sectors needs agreement between them, and POPIA already provides the route through prior authorisation from the Information Regulator, which is required before identifiers held by one organisation are linked to another’s.

Speed is the harder problem. Intelligence that reaches a bank after the cash-out is a record of what happened. Once a fraudulent payment lands, the window is short. Across the fraud we detect, six in ten fraudulent deposits start moving out of the receiving account within ten minutes. The operator’s signal has to reach the bank before the money leaves.

What should be shared

When an operator processes a SIM swap or a number change, the banks holding accounts on that number should know as it happens, not when the customer calls. When a bank confirms a mule account, the number tied to it should go back to the operators, as it already does in India. Both flows are narrow, and both are about numbers rather than customer records.

What each desk can see

Sharing across sectors starts with knowing what each desk can see. We’re asking that of fraud, AML and compliance teams across Africa for State of the Fraud Desk, our inaugural report on what these teams are exposed to and how they work. If you investigate cases, review alerts or file reports, we’d like to hear from you. Every desk that answers adds a piece of the picture none of us can see alone.

Register your interest here.

‍