Ethiopia’s Online Boom Meets a Cybercrime Wave

When a WhatsApp call came in with a Kenyan country code, Aman Abraham didn’t hesitate to answer. As an engineer and businessman active in Addis Ababa’s Rotary community, an international voluntary group, he often coordinated with colleagues across the border for organizing online meetings. The man on the line spoke politely, his tone professional, asking Aman to read out a short verification code. It seemed like a minor request. Believing it was related to joining a meeting, Aman complied.

Within minutes, his WhatsApp account was no longer his. The intruder swiftly combed through recent messages and began reaching out to Aman’s contacts.

“Could you please help me send 30,000 Birr for someone? I will refund once my network is okay,” reads the message. A follow-up message asked for a bank receipt to confirm that the deposit was made.

Three of Aman’s friends responded, transferring a total of 130,000 Birr. By the time they realized what had happened, the money was gone. “When I got the message, I tried to call him, but the line didn’t go through. I thought something was wrong, so I sent the money,” said Khalid Yosuf, a Ph.D. student, one of Aman’s friends who ended up being duped. He would end up sending around 50,000 Birr.

The scam was simple, almost banal in its mechanics. Aman’s account had been hijacked not by sophisticated hackers breaching firewalls or writing complex code, but by a voice on the phone, exploiting his familiarity and goodwill.

Across Ethiopia, such incidents are becoming increasingly common. Since the launch of the first Digital Ethiopia strategy, aided by the entrance of a second telecom operator, which ended a 126-year monopoly, 3G coverage has expanded by 50 percent, while 4G access has grown eightfold. Around 47 million data and internet users were reported in 2025 by Ethio Telecom, up from 26 million five years back. While Safaricom's network amassed 7.1 million active mobile data users by July of this year

While this surge in internet connectivity has created new opportunities in commerce, education, finance, and governance, it has also expanded the attack surface for criminals. Low- to medium-sophistication cyberattacks are exploiting unsuspecting users, often with costly consequences.

The INTERPOL Africa Cyberthreat Assessment Report 2025 notes that digital expansion is outpacing cybersecurity readiness in Ethiopia. According to the report, ransomware, phishing, digital sextortion, account hijacking, and online scams remain the leading threats across Africa.

"East African countries, Kenya, Uganda, Tanzania, Rwanda, and Ethiopia, are rapidly emerging as technological and financial hubs, significantly advancing digital transformation. However, this progress makes them increasingly attractive targets for cyberthreats, highlighting the urgent need for robust cybersecurity frameworks," reads the report.

A separate 2024 analysis by Check Point Research found that Ethiopia ranked highest in Africa for malware attacks. In the first half of 2024, INSA reported 4,623 attempted cyberattacks against government and private organizations in Ethiopia, marking a 115 percent increase compared to the same period in 2023.

Most Ethiopian scammer’s ingenuity lies not in code but in psychology. By merely pretending to be their victim, the attacker borrows credibility that took years to build. The fraudsters also time their messages, often late at night or during work hours, to minimize scrutiny and maximize urgency.

Pastor Berhanu Tegegne is another victim of such scams. Last week, while returning home after a long day of service, he received a call from an unknown number.

“An unfamiliar voice greeted me by name, saying, ‘Pastor Berhanu.’ He told me there was a religious online conference about to start and that I was invited,” Berhanu recalled.

The caller then asked him to share a code that had been sent to his WhatsApp, claiming it was the meeting entry code . “I was tired and on the road, so I wasn’t thinking clearly. I gave him the number,” he said. Moments later, the call ended abruptly.

Berhanu only realized his WhatsApp account had been hacked when he arrived home. The scammers quickly began messaging his contacts, asking them to urgently send 50,000 birr. Fortunately, no one fell for the scam, and Berhanu was able to regain access to his account the next day.

Screenshot of messages sent from hacked accounts attempting to scam money by impersonating the account owners. Such stories are becoming increasingly common in Ethiopia’s growing digital ecosystem, where millions of first-time users are coming online with little understanding of cybersecurity risks. When one account is hacked, victims often rush to their other social media platforms to alert their social circle and avoid negative financial or social repercussions.

Shega found more than a dozen warning posts from different Facebook users, all posted within the span of a single week. Telegram and WhatsApp were among the platforms most frequently affected.

“Most breaches we see are not technical at all,” said Hundaol Nedesa, a cybersecurity expert at Menas Cyber Solutions . He indicated how most people get tricked into sharing verification codes or clicking links from questionable sources.

According to Hundaol, the most frequent methods include phishing links sent via SMS, fraudulent calls requesting one-time passwords, and automated bots that attempt logins. He says most victims realize what happened after the hackers have deleted messages, downloaded files, or used the account to scam others.

“Once an account is compromised, recovery is extremely difficult,” the expert cautioned.

The growing prevalence of such scams underscores a larger national challenge: Ethiopia’s rapid digital growth has not been matched by widespread digital literacy. Many users are unfamiliar with basic precautions like two-factor authentication or verifying requests through secondary channels.

“Connectivity has grown faster than awareness,” Hundaol said. “People think having internet access means being digitally ready, but that’s not true. Knowing how to use WhatsApp or Facebook isn’t the same as knowing how to protect yourself online.”

Some hackers even gain unauthorized access to the social media accounts of content creators, businesses, or individuals with large followings to capture their ad revenue. Last month, Zoe Enlightened Church lost access to its YouTube account after being hacked and was forced to create a new one. The new channel has already reached 29,612 total views and a little over 800 subscribers, putting it on track to regain monetization soon.

A video shared by Zoe Enlightened Church on social media announcing that their YouTube channel had been hacked

Even highly visible public institutions remain underprepared. The Ethiopian Football Federation’s YouTube channel was among the major accounts recently hacked

“We would like to inform you that the Ethiopian Football Federation’s YouTube channel is temporarily out of our control, and efforts are underway to restore it. We also wish to clarify that any messages currently being shared on the channel do not represent the federation,” the Federation wrote on its social media pages.

Aman had reported the incident to the police, hoping investigators could track the transfers. The bank account that received the funds was held at the Commercial Bank of Ethiopia, despite the caller using a Kenyan phone number. But when he approached the bank, officials refused to release information without a court order.

Pastor Berhanu, who also sought help from the bank, was told the same. A court order was required to identify the person behind the account. Both Aman and Berhanu eventually gave up on pursuing the investigation.

“I tried to get help, but there was no clarity,” Aman said. “Everything stopped there. I ended up repaying all my friends myself.”

When Aman managed to regain control of his WhatsApp account, what he found inside was revealing. “I realized the hacker had used a feature I didn’t even know existed,” he said. “They created a group but sent messages individually, so none of my contacts knew the others were being targeted.”

Messages like “I saw your picture on this website, you have been selected for a lottery draw and other solicitations all too familiar to the digitally savvy have become common on channels like Telegram. One click on an embedded link is usually all it takes to have one’s account compromised. Fraudulent transactions also often move through multiple accounts across banks, further complicating efforts to trace money.

Full-blown phishing and spoofing attacks on entire organizations have increased globally over the past decade. Crelan Bank, a Belgian financial institution, suffered damages of over $75 million after hackers ordered employees to transfer funds to a specific account by pretending to be the CEO. While email scams have been around since the late 1990s, they remain popular among scammers due to their continued efficacy. South Africa's railway agency lost some 30.6 million rand (US$1.6 million) after the transport network fell victim to a phishing scam in 2024.

In Ethiopia, throughout 2024, financial institutions in the country were defrauded of nearly $1.3 billion through a combination of scams. While banks have invested in fraud detection tools, customer-facing communication is limited. Few have accessible guidelines for what users should do when they suspect fraud, or how quickly a transaction can be reversed.

For now, prevention may be the only reliable defense for the majority of first-time users in Ethiopia. Experts urge users never to share one-time passwords or verification codes, to confirm any financial request through a phone call or face-to-face conversation, and to enable two-step verification on messaging apps. Yet even these measures rely on a level of awareness many users still lack.