By R. Kafui Amanfu
When a Ghanaian loses money to cyber fraud, the damage goes past the money. Confidence in the digital economy takes the hit. Cyber Security Authority Director-General Mr. Divine Selase Agbeti put it plainly: every financial transaction needs technical resilience, legal compliance, and public vigilance behind it.
That is the logic behind National Cyber Security Awareness Month (NCSAM) 2026, themed “Securing Ghana’s Digital Finance Ecosystem: Building Trust Through Collaboration and Cyber Resilience.” It aligns with the national goal of leading Africa in cybersecurity excellence. It also changes how Ghana should think about the subject. Cybersecurity is no longer an IT compliance item. It is a duty of boards and a condition for economic stability.
The scale of what needs protecting
Ghana is one of Africa’s leading digital finance markets. Registered mobile money accounts exceed 85 million, and the agent network now approaches one million, according to the latest Bank of Ghana data. Every new account, agent and payment screen adds a point an attacker can target.
The Bank of Ghana’s 2025 Fraud Report recorded 24,778 cases across banks, specialised deposit-taking institutions, and payment service providers. That is 48% above the 16,733 cases of 2024, with value at risk above GH¢100 million Fraud cases involving payment service providers increased by 54%, while bank fraud fell by 34%. Criminals have moved to wallets, agent cash-out points and the people who use them. Between January and July 2026, the national Computer Emergency Response Team (CERT) logged 3,876 verified incidents, and online fraud and social engineering accounting for about 47% of them.
Five pillars for Securing Ghana’s Digital Financial Ecosystem
Securing the digital finance ecosystem. Cybersecurity should move from a cost to be managed to a board-level responsibility. Under Act 1038, financial institutions, telecoms, and fintech merchants must use only licensed cybersecurity service providers, accredited establishments, and certified professionals. Non-compliance attracts penalties.
Cybercrime prevention and joint response. Regulators, police, mobile network operators, and banks must stop working in silos. The Police CID Cybercrime Unit, the Bank of Ghana, Interpol, and bank security teams are synchronising threat intelligence so that fraud proceeds can be blocked before withdrawal.
Resilience of critical infrastructure. Payment gateways, the national clearinghouse Ghana Interbank Payment and Settlement Systems Limited (GhIPSS), core banking servers and telecom backbones must undergo mandatory vulnerability assessments, penetration tests, and continuous audit.
A culture of cyber hygiene. The newly inaugurated Cybersecurity Press Corps will teach the public to recognise social engineering, protect SIM registration details, switch on multi-factor authentication and report suspicious activity promptly.
Capacity building, research, and collaboration. Government, civil society organisations, professional bodies, and universities should work together on local research into AI-driven fraud detection and digital forensics and on developing the skilled workforce the country currently lacks.
Rules and tools now in place
The Bank of Ghana updated its Cyber and Information Security Directive in April 2026. It requires governance of artificial intelligence and machine learning in transaction monitoring, baseline security for cloud data, local data storage, and quarterly risk reports to boards.
The Bank has also set up the Financial Industry Command Security Operations Centre (FICSOC), which receives threat intelligence from all regulated institutions in real time, and a Digital Forensic Laboratory that preserves electronic evidence to improve successful prosecutions. The Cyber Security Authority operates a free 24-hour reporting line on 292 and a WhatsApp hotline on 050 160 3111, both linked to national CERT to enable prompt freezing of accounts and takedown of scam websites.
Who does what: 2026 Priority Actions
Securing digital finance is not one institution’s job. Each player has a clear mandate under Act 1038 and the Bank of Ghana’s April 2026 Directive:
| Group | Priority for 2026 – Why it matters |
| Banks & Payment Providers | End SMS OTPs. Replace text-message codes with app-based approval or hardware security keys — SIM-swap fraud makes SMS unsafe. Ensure all technical staff are certified and establishments licensed under Act 1038. |
| Telecom operators | Stop the hijack before it happens. Run automatic SIM-swap checks, track devices in real time, and share fraud blacklists instantly through the Bank of Ghana’s Financial Industry Command Centre (FICSOC). |
| Regulators (BoG & CSA) | Enforce and test. Enforce mandatory licensing of cybersecurity providers under Act 1038 and run live, cross-sector resilience exercises, not just paper audits. |
| The public | Your PIN is your vault. Always confirm who is calling before approving any MoMo prompt, never share PINs or OTPs, and report suspicious calls immediately to 292 or WhatsApp 050 160 3111. |
Where professional bodies such as IIPGH come in
The Institute of ICT Professionals Ghana (IIPGH) is a partner of the Cyber Security Authority, and the fit is practical. Act 1038 sets the standard for who may practise cybersecurity in Ghana. A professional body is the natural place to carry that standard to practitioners and to link the people who build and run financial systems with the regulators who oversee them.
IIPGH already does this work. With Academic City University and the Authority, it convenes an annual National Cybersecurity Roundtable during National Cyber Security Awareness Month. The 2025 roundtable produced a white paper, “Securing Trust in Ghana’s Digital Future: Accountability, Awareness, and Action.” It was presented to the Minister for Communication, Digital Technology and Innovations on 9 September 2025 and to the Office of the Chief of Defence Staff on 10 September 2025. Engagements with other stakeholders on its recommendations are ongoing.
IIPGH’s work also speaks to the fourth pillar; a culture of cyber hygiene. It has joined the Authority and the Ghana Association of Banks in calling for awareness to go beyond the cities, into peri-urban markets, farming cooperatives, and village savings groups, where the 8% scam victim rate is hardest to reduce.
Where institutions such as Academic City University come in
Rules need people who can implement them. Academic City University supplies part of that talent pipeline. Its two-year MSc in Cyber Security, introduced in September 2024, covers cryptography, network security, cyber law, digital forensics and information security assurance and management. Students work in labs on ethical hacking, vulnerability assessment, and threat modelling.
These subjects match what the national framework demands. Mandatory vulnerability assessments and penetration tests under Pillar 3 require trained testers. The Bank of Ghana’s forensic laboratory needs investigators who can preserve and present digital evidence. The April 2026 Directive on AI governance needs people who understand how monitoring models fail. Academic City’s role in the 2026 roundtable shows the university treats this as a national assignment, not just a classroom exercise.
The Authority’s research agenda on AI fraud detection and digital forensics gives universities a second mandate beyond teaching. Local data and local cases should shape local solutions, and the partnership between IIPGH, Academic City and the Authority provides a ready channel for that work.
From awareness to resilience
Awareness alone does not stop a fraudster on the phone. Awareness plus enforcement, trained professionals and fast reporting does. Ghana has the law, the regulators, and a growing set of technical tools. The work in the months ahead is to put them to use in banks, wallets, public offices, and homes: verify before you approve, guard your codes and report to 292. Each person who does so makes the entire system safer.
R. Kafui Amanfu is Executive Director of the Institute of ICT Professionals Ghana (IIPGH, www.iipgh.org).