GiveDirectly loses $900,000 in DRC mobile cash fraud

This article is from June but I didn't see it then:

GiveDirectly, a leading distributor of cash aid, has suspended all its active operations in the Democratic Republic of the Congo, where at least $900,000 was allegedly stolen by staff or former workers in a large-scale fraud that penetrated every department of the country office.

The fraud involved GiveDirectly staff stealing SIM cards that impoverished households were meant to use to receive mobile money transfers from the nonprofit organisation.

More than 1,700 families in DRC’s South Kivu province were impacted by the fraud scheme, which started in late August 2022 when the group began cash transfers there. GiveDirectly told The New Humanitarian it was the largest sum of money it has ever lost to fraud, representing nearly a third of the $2.8 million it distributed in South Kivu last year.

How it worked:

Typically, GiveDirectly gives a recipient a SIM card and they register it with an independent mobile money agent. Once the process is complete, funds go directly to the recipient’s mobile account and they then withdraw the cash at a mobile money station.

The organisation said it sees this method as reducing risk as it cuts out middlemen who would otherwise be involved in delivering money or food aid. However, GiveDirectly made an exception for the South Kivu programme.

“Normally, recipients register their SIMs with independent mobile money agents, not with our staff, but in this remote region, the closest agent is often a long distance away. We therefore allowed GiveDirectly’s enrollment team to register these new SIMs for recipients instead of sending them to agents,” GiveDirectly said in its public release.

The exception, the NGO said, was meant to spare recipients long trips to the nearest mobile money agent, which may have required them to travel through insecure areas.

The result, however, was that when GiveDirectly began sending money to the SIMs meant for poor households in South Kivu, staff who had stolen the SIM cards received the funds instead – all with the help of outside mobile money agents and former staff.

How it was found:

The scheme was, the organisation said, detected after a routine audit of GiveDirectly’s enrollment procedures for a separate operation in DRC’s northeastern Ituri province, where the same exception was also in place. Although the same type of SIM swap fraud was underway in the Ituri programme, payments had not yet started, so no money was actually lost there, the organisation said.

“That kicked off a broader investigation, which eventually led us to cooperate with a telecom company, who provided snippets of transaction data that let us identify specific phone numbers and shops [in South Kivu] that had been compromised,” Huston said.

GiveDirectly's blog post explains more:

Why did you not spot this fraud sooner?

We identified this fraud 5 months after the first payments were diverted. The primary reason we did not identify it sooner is that there was an unprecedented amount of collusion between firewalled departments, including the very audit teams tasked with identifying such cases.

How are you sure that lots more money hasn’t been lost to unknown fraud in other programs?

While this case shows that our D.R.C. system had vulnerabilities, it also shows that our audit system does work in identifying fraud. While we caught this too late to prevent the money from being lost, we did catch it.

This D.R.C. program is not the only time we’ve allowed GiveDirectly staff to register SIMs for recipients, but we’ve since scrutinized those other programs and not found signs of fraud. It is, of course, impossible to know perfectly how much is lost each year, but we have no reason to believe there is significant fraud not yet uncovered.

...

GiveDirectly will restart giving away money in South Kivu next year with anti-fraud improvements.