Banking fraud in Mauritius

What is the current state of banking fraud in Mauritius, and where does it rank among the main operational risks facing the banking sector?

Banking fraud remains one of the main risks facing the financial sector. Like many jurisdictions around the world, Mauritius is experiencing a continuous evolution in the methods used by fraudsters. They are increasingly exploiting digital technologies, security vulnerabilities and human behaviour to achieve their objectives.

The most common threats currently include online and mobile banking account takeovers, card fraud, identity theft, investment scams, cryptocurrency scams and payment fraud.

One of the main trends we are observing is the increasing sophistication of attacks, combined with the growing use of social engineering techniques. These techniques are designed to manipulate victims into disclosing sensitive information or authorising fraudulent transactions themselves.

The increasing digitalisation of financial services has significantly transformed consumer behaviour. How has this development changed banks' exposure, particularly Absa Mauritius' exposure, to fraud risks?

Digitalisation has profoundly transformed customers' daily lives by enabling them to carry out banking transactions anytime and from anywhere. While this development has brought greater convenience and efficiency, it has also created new opportunities for cybercriminals.

We are now seeing more phishing attempts, SMS phishing or 'smishing', telephone-based fraud or 'vishing', QR code scams, and online and mobile banking account takeovers.

In many cases, fraudsters do not attempt to compromise banks' security systems directly, as these systems are generally protected by robust security measures. Instead, they focus on exploiting the human element by manipulating customers into disclosing confidential information, such as passwords, authentication codes or sensitive banking details. They may also attempt to persuade customers to authorise fraudulent transactions themselves.

With the emergence of generative artificial intelligence, deepfakes and increasingly sophisticated social engineering techniques, how does Absa assess and prepare for evolving threats?

Artificial intelligence represents a new stage in the evolution of fraud.

Fraudsters now have access to tools capable of replicating voices, generating highly convincing fake messages and even creating manipulated videos that impersonate business leaders, family members or representatives of financial institutions. These technologies significantly increase the effectiveness of impersonation attempts.

In response, Absa adopts a proactive approach based on continuously strengthening its monitoring, prevention and detection capabilities. We also invest in employee training and customer awareness to help people recognise these emerging forms of fraud and adopt the appropriate security practices.

In this environment, vigilance and awareness remain essential components of the fight against fraud.

What investments is Absa Mauritius currently making in cybersecurity, fraud detection and the protection of customer data?

In an environment where cyberthreats are becoming increasingly sophisticated, Absa Mauritius continues to invest in advanced cybersecurity and fraud-prevention solutions.

The bank uses enhanced authentication mechanisms, biometric solutions, behavioural analytics, artificial intelligence and real-time monitoring systems that can quickly identify suspicious activity. This multi-layered approach enables us to anticipate risks more effectively, strengthen the protection of customer data and block certain transactions before they cause harm.

Our objective is simple: to provide the highest possible level of security while delivering a seamless, modern and accessible banking experience.

In your view, is the Mauritian regulatory framework sufficiently equipped to address emerging forms of financial fraud? What additional measures could be considered?

Mauritius currently has a robust regulatory framework, and the authorities continue to adapt existing measures in response to evolving digital risks.

Nevertheless, the rapid pace of technological change requires constant vigilance. Strengthening information-sharing among banks, regulatory authorities and law-enforcement agencies could further improve our collective ability to detect and prevent emerging forms of fraud.

Beyond financial losses, what impact can banking fraud have on a financial institution's reputation and on the confidence of its customers, partners and investors?

Beyond the financial losses it may cause, fraud can have a significant impact on the reputation of a financial institution. It can undermine customer confidence, raise concerns among partners and investors, and have a lasting effect on public perception.

In an environment where expectations regarding security and data protection are high, a bank's ability to prevent, detect and manage incidents effectively is essential to maintaining trust.

This is why banks continuously invest in strengthening their security measures, developing cyberthreat intelligence, improving early threat detection, and raising awareness among customers and employees.

Have you observed a change in the profile of fraud victims in Mauritius, particularly an increase in attempts targeting businesses and small and medium-sized enterprises?

Yes. While individuals remain a primary target, we are also seeing a significant increase in attempts targeting businesses and small and medium-sized enterprises.

Fraudsters may attempt to compromise supplier payments, impersonate business leaders or commercial partners, alter bank account details, or issue fraudulent payment confirmations to obtain goods or services without making an actual payment.

In this context, businesses must treat fraud as a major operational risk and implement appropriate controls. These should include enhanced approval procedures, a clear separation of responsibilities and regular employee awareness initiatives. Businesses should also invest in cybersecurity tools to protect their IT infrastructure.

What is Absa's policy regarding the support and reimbursement of customers who fall victim to fraud?

When a customer reports fraud or a suspicious transaction, our priority is to act swiftly to limit the consequences of the incident.

Our teams immediately take steps to secure the affected accounts, review the reported transactions and open an internal investigation. Where applicable, we also assist the customer with the necessary procedures involving the relevant authorities.

Every situation, including any request for reimbursement, is assessed individually and in accordance with regulatory obligations and the applicable terms and conditions. Our objective is to provide prompt, transparent and effective support throughout the process.

What key indicators does Absa use to measure the effectiveness of its fraud prevention, detection and management measures?

The effectiveness of an anti-fraud framework is measured through several key indicators that assess its ability to prevent, detect and respond to fraudulent activity.

We monitor the number of fraud attempts detected and stopped, the potential financial losses prevented, detection and response times, and trends in fraud-related losses. We also assess the relevance of the alerts generated, the effectiveness of the controls in place, and the impact of awareness initiatives conducted among our customers and employees.

These indicators enable us to continuously improve our security measures, adapt our detection mechanisms to emerging fraud trends and strengthen customer protection in a constantly evolving risk environment.

What initiatives is Absa implementing to raise awareness and protect the Mauritian public against evolving digital threats?

Awareness is one of the most effective tools in the fight against fraud.

Absa communicates regularly with customers through various channels, including SMS messages, emails, social media, screens in branches and at automated teller machines, as well as traditional media. We also organise outreach initiatives for groups that may be particularly exposed to fraud, including senior citizens.

Our objective is to help everyone recognise the warning signs and adopt the appropriate precautions when faced with a potential scam.

 How have Absa's employee training and awareness programmes evolved in response to increasingly sophisticated attacks?

Training is an essential component of our protection framework.

Threats evolve rapidly, and our employees regularly receive awareness training on the latest techniques used by fraudsters, including targeted phishing, impersonation, social engineering and deepfakes.

This culture of vigilance strengthens our collective ability to identify unusual behaviour quickly and protect both our customers and employees effectively.

What advice would you give to individuals and businesses in Mauritius to help them better protect themselves against banking fraud?

The first piece of advice is simple: always take the time to verify before taking action.

Fraudsters frequently exploit urgency, trust or curiosity to pressure their victims into making hasty decisions. Never disclose your passwords, PINs or one-time passwords, also known as OTPs, to anyone, even if the request appears to come from a bank, an official organisation or someone you trust.

It is also important to be cautious of investment opportunities promising exceptional returns, urgent payment requests, and links received through SMS, email or instant messaging platforms.

We have also observed a significant increase in vishing attacks, during which fraudsters contact their victims through online calls using applications such as WhatsApp or Google Meet. Customers should remain vigilant, avoid engaging with suspicious calls and never disclose personal or banking information during such conversations.

Customers should always contact their bank using its official contact details, including the telephone number or email address published through the bank's official channels.

For businesses, we recommend implementing dual approval for sensitive payments and independently verifying every request to change bank account details. Businesses should also invest in cybersecurity tools to protect their IT infrastructure.

When it comes to fraud, taking a few minutes to verify a request can prevent significant financial and operational consequences.