Most cyber attacks on organisations in East Africa do not start with advanced hacking. They start with a message: an email that looks like it comes from the bank, a supplier, a donor or the director, a WhatsApp message asking for an urgent payment, or a link to a fake Microsoft 365 login page. One click or one reply can give an attacker passwords, money or access to your systems. Technology helps, but well-trained staff are your strongest defence against phishing.
Common Phishing Tricks in the Region
- Fake payment requests: a message that appears to come from a manager or supplier asking finance to pay a new account urgently.
- Fake login pages: an email saying your mailbox is full or a document is shared, with a link to a page that steals your password.
- Invoice and tender fraud: fake invoices or tender documents with harmful attachments.
- Messages on WhatsApp and SMS: the same tricks sent to personal phones, often in a mix of English, Swahili, Kinyarwanda or Arabic.
- Impersonation of donors, banks and government offices: using real logos and names to seem trustworthy.
Warning Signs Every Staff Member Should Know
Urgency and pressure
“Pay today”, “your account will be closed”, “do not tell anyone”. Pressure is designed to stop you thinking.
Sender address that does not match
The display name may say your director, but the address is a free email account or a domain with a small spelling change.
Links that go somewhere else
Hover over links before clicking. If a “Microsoft” login link goes to an unfamiliar website, close it.
Changed bank details
Any request to change a supplier’s or employee’s bank account must be confirmed by phone using a number you already have, never the number in the message.
Unexpected attachments and sign-in prompts
Be careful with unexpected files, especially those asking you to enable macros or sign in. Never approve a multi-factor sign-in request you did not start.
Steps to Build an Effective Training Programme
Step 1: Keep training short and regular
Ten to fifteen minutes every month or quarter works better than one long annual session. Include new staff in their first week.
Step 2: Use local, realistic examples
Show examples that look like the messages your staff actually receive, in the languages they use. Remove any real personal data from examples.
Step 3: Run safe phishing simulations
Send test phishing emails to staff with management approval, then give instant, friendly guidance to anyone who clicks. Measure improvement over time rather than blaming individuals.
Step 4: Focus on high-risk roles
Finance, procurement, HR, executives and IT administrators receive more targeted attacks. Give them extra sessions and clear payment verification rules.
Step 5: Make reporting easy
Give staff a simple way to report suspicious messages, such as a Report button in Outlook or a dedicated email address, and thank them for reporting. Fast reports help IT block an attack before others click.
Step 6: Back training with technology
Turn on multi-factor authentication, email filtering such as Microsoft Defender for Office 365, and web filtering on your firewall. These reduce how many phishing messages reach staff and limit damage if someone clicks.
Quick Anti-Phishing Checklist
- Short, regular training for all staff, including new joiners
- Realistic local examples and phishing simulations
- Extra training for finance, HR, procurement and executives
- Phone verification for every bank detail change
- One-click reporting of suspicious messages
- MFA, email filtering and web filtering switched on
- Clear steps if someone clicks or enters a password
How Junubia Host Can Help
Junubia Host helps organisations in South Sudan, Tanzania and Rwanda run staff awareness sessions, set up email protection and MFA through our Microsoft partnership, and block malicious websites with Fortinet and Sangfor firewalls. See all our IT services.
Strengthen Your Human Firewall
Book a free IT assessment to review your email security and staff awareness, or reach us on WhatsApp: +255 768 404 666 (Tanzania and Rwanda) or +211 924 786 666 (South Sudan).
Written by Dut Majak, CEO and Founder of Junubia Host Co Ltd. Dut leads Junubia’s work with banks, government institutions, NGOs and businesses across South Sudan, Tanzania and Rwanda.
