Your PIN Is Your Shop Key. Don’t Leave It on the Counter.
Your PIN Is Your Shop Key. Don’t Leave It on the Counter.
by Vien Trevor
A Cybersecurity Awareness Month message from ChapChap
It’s a busy Saturday in Owino. Mama Sarah’s stall is packed, a boda rider is shouting outside, and a customer needs mobile money right now. She types her PIN with the phone held out in front of her. She never notices the young man who has been watching her fingers for ten minutes. By evening, her float is gone.
Stories like hers happen in markets, taxi parks, and trading centres across Uganda every week. So this October, we want to talk honestly about how fraudsters work, how their tricks are changing, and what we can all do about it.
How the tricks work
Most fraud isn’t clever hacking. It works on trust, hurry, and distraction. One common trick is the “wrong number” SMS asking you to send back money that was never sent. Check your real balance, because a fake message isn’t money. Another is the caller who says he’s from ChapChap and needs your PIN to “fix” your account. We will never ask for your PIN, OTP, or password. Watch out, too, for people looking over your shoulder, strangers who want to “borrow” your phone, and panicked calls saying the boss needs the float immediately. When someone rushes you, slow down.
“But I haven’t received the money!”
Every agent has heard this. Usually it’s an honest delay or one wrong digit, but sometimes it’s a trick to make you pay twice. Before you press confirm, read the name on the Confirm Transaction screen out loud and ask, “Is this you?” If it doesn’t match, stop. If a customer says nothing arrived, check the transaction status in your app. Ask them to check their actual balance, not just their SMS inbox. If you’re still unsure, call us on 0326 809 600. Never repeat a deposit or airtime sale just because someone is shouting.
Fraudsters now have AI
AI can now copy a voice from a few seconds of a WhatsApp note or TikTok video. That means a call that sounds exactly like your brother asking for 500,000 might not be him at all. Scam messages no longer give themselves away with bad spelling. AI writes clean, convincing text in English, Luganda, Runyankole and more. It also makes fake videos and fake websites and helps hackers find weak spots in systems faster.
The old basics still work, though. Hang up and call back on the number you already have saved. Ask something only the real person would know. Don’t pick something from Facebook. Pick a shared memory, like what you ate together at Christmas. AI can copy a voice, but it can’t copy a memory. Judge a message by what it asks you to do, not by how polished it sounds. A genuine ChapChap invite link starts with chapchap.co and goes straight to the Google Play Store or Apple App Store. If a link goes anywhere else or asks for your PIN, call us. And remember: urgency plus money plus secrecy means stop.
Everyday habits
Treat your PIN like your shop key. Don’t write it down, don’t share it with your attendant, and don’t use 1234 or your birth year. Cover your screen when typing, lock your phone, and never leave it alone on the counter. Skip strange links, install app updates, and report anything suspicious quickly.
What we’re doing on our side
We regularly invite trusted security experts to try to break into our systems, and we fix whatever they find. You can now use your fingerprint or Face ID instead of typing your PIN in a crowd. Turn it on in your Profile settings. The app also logs you out after 15 minutes of inactivity and keeps your balance hidden until you choose to show it. It blocks logins from unfamiliar phones until they’re verified. And whenever you’re in doubt, a real person is just one call away.
Security is a partnership
This month, turn on fingerprint or Face ID and save 0326 809 600 in your phone. Always confirm the customer’s name before you press confirm. Test urgent callers with a question only the real person could answer. And share this message with a fellow agent. ChapChap will never ask for your PIN, and a familiar voice is not proof.
Weekuume. Protect yourself, protect your business.
ChapChap: Fast. Simple. Secure.