DEV Community: Michael Asante

How AI Is Being Used to Scam People in West Africa Right Now

Michael Asante — Mon, 28 Sep 2026 09:42:43 +0000

⚠️ CyberSense Ghana | Awareness Series — This article is for educational
purposes. Recognising these tactics is your first line of defence.

Artificial intelligence is no longer just a tool for developers and researchers.
In 2024–2026, it has become a weapon — and nowhere is that more evident than
across West Africa, where a new wave of AI-powered scams is targeting millions
of everyday people through their phones, social media feeds, and mobile money
wallets.

Here is what is happening right now, and how to protect yourself.

1. AI-Generated Voice Cloning ("The Family Emergency" Scam)

Scammers are now using AI tools that can clone a person's voice from as little
as three seconds of audio. They scrape voice samples from TikTok videos,
WhatsApp voice notes, or Facebook reels, then use that clone to call relatives.

How it works:

You get a call. It sounds exactly like your sister or son. They say they are
in trouble — arrested, hospitalised, or stranded — and beg you to send Mobile
Money immediately. By the time you verify with a second call, the money is gone.

This is happening in Ghana, Nigeria, and Côte d'Ivoire. AI voice tools
like ElevenLabs (misused outside its intended purpose) have made this alarmingly
easy to deploy at scale.

What to do: Agree on a secret family code word that no scammer could know.
Always call back on a number you saved yourself before sending any money.

2. Deepfake Video Scams on Social Media

AI deepfake technology can now place a real politician's or celebrity's face
onto a fabricated video body in minutes. Scammers use footage of well-known
figures — pastors, MPs, musicians — to promote fake investment schemes,
giveaways, or loan programmes.

The typical script:

"I invested GHS 500 and received GHS 4,000 in three days." The video looks
authentic. The voice sounds genuine. The subtitles match. But every second of
it is AI-generated.

Victims in Ghana, Senegal, and Togo have reported losing savings after trusting
what they saw in these videos on Facebook and TikTok.

What to do: Reverse-image-search any thumbnail. Real giveaways from
credible sources are always announced on verified accounts with a long post
history. If a face looks slightly blurry around the edges or the mouth movement
feels slightly off — trust that instinct.

3. AI-Powered Phishing Texts and Emails

Previously, scam messages were easy to spot because of poor spelling and
awkward phrasing. AI has erased that advantage. Tools like ChatGPT can now
generate flawless, contextually accurate phishing messages in Twi, Hausa,
Pidgin, Yoruba, and French.

Scammers are sending messages that perfectly impersonate:

GRA (Ghana Revenue Authority) tax refund notices
MTN MoMo security alerts
Airtel Money transaction confirmations
NHIS insurance renewal reminders

The messages include correct logos, real-sounding reference numbers, and
urgency — "Your account will be suspended in 24 hours." They link to near-perfect
clone websites that harvest your PIN or ID details.

What to do: Never click links in SMS or email messages. Always go directly
to the official app or website yourself. Organisations like GRA and MoMo will
never ask for your PIN via SMS.

4. Romance Scams Supercharged by AI Chatbots

Traditional romance scams required a human operator available 24/7 to maintain
conversation. Now, AI chatbots handle hundreds of victims simultaneously — day
and night, in multiple languages.

The bot builds trust over weeks through WhatsApp or Instagram. It learns your
patterns. It sends good-morning messages. It asks about your family. Eventually,
it introduces a "business opportunity" or a fake emergency requiring money.

AI detection studies show that many victims cannot distinguish a chatbot from
a human after two weeks of interaction, especially when the scammer supplements
with an occasional real voice call to reinforce the illusion.

What to do: Be alert if someone you met online is always "too busy" for a
live video call, never available in real-time, or quickly steers conversations
toward financial matters. Ask unexpected questions — AI chatbots struggle with
deeply personal, spontaneous responses.

5. AI Business Impersonation (The "Vendor" Scam)

Fraudsters are using AI to create convincing fake businesses — complete with
a generated logo, a professional-looking website, realistic product photos
(AI-generated), and even fake customer testimonials written by an AI.

They then approach SME owners on WhatsApp or by phone, posing as suppliers of
goods — electronics, cocoa processing equipment, construction materials — offering
a "limited-time" deal. Payment is requested upfront. The supplier disappears.

This scam is particularly devastating for traders and small business owners
in markets across Accra, Lagos, Abidjan, and Kumasi.

What to do: Always verify a supplier physically or through a known third
party before making payments. Check whether their website domain is new (use
whois lookup tools). Be extremely cautious of any vendor who only communicates
via WhatsApp with no physical address.

The Bottom Line: Think. Check. Consider.

AI has lowered the cost and raised the quality of deception. Scammers no longer
need technical skill — they need a phone and a free AI account.

Your defence is not technology. It is habit:

Think before you act on any urgent request
Check by verifying through a second, independent channel
Consider whether this situation makes sense

Share this article with family members — especially older relatives and traders
who may not be aware of these new tactics. The more people who understand how
AI is being weaponised, the harder it becomes for scammers to succeed.

Written by @cybersense101 | CyberSense Ghana — Cybersecurity Awareness for
West Africa. Follow us on TikTok, LinkedIn, and dev.to for more.

cybersecurity #AI #Ghana #WestAfrica #ScamAlert #CyberSenseGhana

What I Learned Building a Multi-Tenant SaaS as a Final Year Student

Michael Asante — Thu, 17 Sep 2026 13:57:11 +0000

By Bigwig |

Most final year CS students build a project that lives on a USB drive, gets presented to a panel, and is never opened again.

Mine is live. It has real businesses on it. Real transactions. Real data.

I'm a final year Networking and Software Systems student at Presbyterian University Ghana (PUG), based in the Kwahu area of the Eastern Region. While preparing for my academic defense, I independently built and deployed StockMaster Ghana — a multi-tenant SaaS POS and business management system serving small and medium businesses in my community.

This is what I learned. Not from a tutorial. From actually doing it.

First, What Is Multi-Tenancy?

Before I get into the lessons, let me explain what I mean by multi-tenant — because it took me a while to really get it.

A single-tenant app is like a house. One family lives there. Everything is built for them.

A multi-tenant app is like an apartment building. Many tenants share the same infrastructure — same roof, same plumbing, same electricity grid — but each tenant has their own private space and can't access anyone else's.

In SaaS terms: one codebase, one database, many businesses — each seeing only their own data.

Single-tenant:    App A → Database A
                  App B → Database B  (separate deployments)

Multi-tenant:     App → Database
                          ├── Tenant A's data
                          ├── Tenant B's data
                          └── Tenant C's data  (one deployment)

Getting this architecture right is where most beginners (myself included, at first) trip up.

The Stack I Chose and Why

Frontend: React + Vite
Backend/Database: Supabase (PostgreSQL)
Auth: Supabase Auth
Deployment: Vercel
Payments: MTN MoMo API integration (for the Ghanaian market)

I chose this stack for one reason: I could move fast without a dedicated backend server. Supabase gave me a full PostgreSQL database, authentication, Row-Level Security, and real-time subscriptions — all without spinning up a separate API server. For a solo student developer, that's a superpower.

Lesson 1: Row-Level Security Is Not Optional

This was my biggest early mistake.

I launched the first version of StockMaster Ghana without properly enabling Row-Level Security (RLS) on all my Supabase tables. Technically, each business had a tenant_id column — but without RLS enforced at the database level, the only thing keeping Business A from seeing Business B's data was my frontend logic.

Frontend logic can be bypassed. A database policy cannot.

Here's the kind of RLS policy I ended up implementing:

-- Enable RLS on the sales table
ALTER TABLE sales ENABLE ROW LEVEL SECURITY;

-- Each tenant can only see their own sales
CREATE POLICY "Tenants see own sales"
ON sales
FOR ALL
USING (tenant_id = auth.uid());

After I enabled RLS across all 12 tables, I could sleep at night knowing that even if someone manipulated a request, the database itself would reject unauthorised access.

Lesson: Never trust the frontend to enforce data isolation. Do it at the database level.

Lesson 2: The Duplicate INSERT Bug That Almost Broke Everything

At one point, I had a live business — MMAT Plus Hub, a coated peanuts production company — actively using the system. When they recorded a sale, it was occasionally being inserted into the database twice.

Two records. One transaction. Double the stock deduction. Chaos.

The root cause? A React state update was triggering my form submission handler twice under certain conditions — a classic issue with useEffect dependencies and event handlers not being properly cleaned up.

The fix involved:

// Adding a submission lock to prevent duplicate inserts
const [isSubmitting, setIsSubmitting] = useState(false);

const handleSale = async (saleData) => {
  if (isSubmitting) return; // Guard against double submission
  setIsSubmitting(true);

  try {
    await supabase.from('sales').insert(saleData);
  } finally {
    setIsSubmitting(false);
  }
};

But the deeper fix was adding a Postgres trigger that automatically reconciled financial records on the production line — so even if a duplicate slipped through, the financial totals would self-correct.

Lesson: Optimistic UI is great. Idempotent database operations are essential.

Lesson 3: One 8,600-Line File Is a Time Bomb

Early in the project, I had one massive file that did everything. Components, API calls, state management, utility functions — all 8,600 lines of it.

It worked. Until it didn't.

Adding a new feature meant scrolling through thousands of lines trying to remember where something lived. Fixing one bug would break something three sections down. Code reviews (even solo ones) became painful.

I eventually did a full modular refactor — splitting the monolith into 13 named modules:

src/
├── components/
│   ├── Sales/
│   ├── Inventory/
│   ├── Reports/
│   └── Dashboard/
├── hooks/
│   ├── useSales.js
│   ├── useInventory.js
│   └── useTenantData.js
├── lib/
│   ├── supabase.js
│   └── helpers.js
└── pages/

The refactor took a painful weekend. But after it, adding new features became genuinely fun again.

Lesson: Start with structure. Refactoring a live production app is far more stressful than getting the architecture right early.

Lesson 4: Building for Your Own Community Is a Cheat Code

I'm from Kwahu. I built StockMaster Ghana for businesses in Kwahu. That context gave me advantages no amount of market research could replicate.

I knew that:

Many SMEs here deal in cash and MoMo, not card payments
Business owners often share devices with staff — so role-based access control mattered a lot
Debt tracking (customers buying on credit) is a core part of how local trade works
Seasonal patterns (Kwahu Easter festival, for example) cause major inventory spikes

These weren't features I found in a product requirements document. They came from conversations with actual users — people I knew.

When a business like MMAT Plus Hub (which processes coated peanuts for sale) needed a production line reconciliation feature, I could sit with the owner, understand the workflow, and build it in a week.

Lesson: Proximity to your users is a competitive advantage. Build for people you can actually talk to.

Lesson 5: Academic Projects and Real Products Need Different Hats

Here's something nobody tells you: building a live product while also writing an academic proposal about it creates a tension you have to manage carefully.

My department assigned me a different research topic for my final year project — a QR-Based Thesis Deposition System for PUG. That's a genuinely separate problem from StockMaster Ghana, and keeping them distinct matters for academic integrity.

The lesson I learned: your real-world experience makes you a better researcher, but your research topic needs to stand on its own merits — with its own problem statement, methodology, and contribution to knowledge.

Don't try to retroactively academise something you already built. Build something new, informed by what you've learned.

Lesson: Production experience sharpens your academic instincts. Keep the two outputs honest and distinct.

What I'd Tell My Past Self

If I could go back to when I started StockMaster Ghana, I'd say:

Enable RLS on day one. Not after you have real users.
Modularise early. One file feels fast until it doesn't.
Write down every bug you fix. Those are your best blog posts, conference talks, and interview stories.
Ship to real users as fast as possible. Feedback from a real business using your system daily is worth more than any tutorial.
Your geography is not a limitation. Building in Kwahu, Ghana gave me a unique product with a real user base. That's more than most CS graduates can say.

What's Next

StockMaster Ghana is live and growing. My final year project (the QR-Based Thesis Deposition System) is in proposal stage. And I'm documenting all of it here on dev.to and on CyberSense Ghana's platforms.

If you're a student developer — especially one building in Africa — I'd love to connect. The problems here are real, the users are real, and the opportunity to build something that matters is very real.

Drop a comment. Let's talk.

Follow CyberSense Ghana @cybersense101 on TikTok, Instagram, and Facebook for cybersecurity awareness content built for West Africa.

Tags: #saas #webdev #beginners #programming #supabase #react #africa

SIM Swap Attacks: What They Are and How to Protect Your Number

Michael Asante — Wed, 16 Sep 2026 23:38:27 +0000

By CyberSense Ghana |

Someone in Ghana woke up one morning, checked their phone, and had no network signal.

They assumed it was MTN acting up. By the time they figured out what had actually happened, their MoMo wallet was empty, their email had been accessed, and their bank account had been drained.

That's a SIM swap attack. And it's happening right here in West Africa — more than most people realise.

What Is a SIM Swap Attack?

A SIM swap (also called SIM hijacking or SIM porting) is when a scammer convinces your mobile network to transfer your phone number to a SIM card they control.

Once they have your number, every SMS-based OTP (One-Time Password) that your bank, MoMo wallet, email, or social media sends — goes to them, not you.

With that one move, they can:

Reset your email password
Log into your mobile money account
Bypass two-factor authentication on your bank app
Take over your WhatsApp and scam your contacts

It sounds like something from a hacking movie. It's actually shockingly simple to pull off.

How Does It Actually Happen?

Here's the typical attack chain in the West African context:

Step 1: They gather your personal info

Scammers collect your name, phone number, date of birth, and sometimes your Ghana Card or NIA details. This comes from:

Data breaches (leaked databases sold online)
Social engineering (calling you pretending to be your network provider)
Your own social media posts (yes, that birthday post with your full name and photo helps them)

Step 2: They call your network provider

The attacker calls MTN, Telecel, or AirtelTigo customer care pretending to be you. They say something like:

"I lost my SIM card, I need a replacement on a new SIM."

They answer security questions using the info they already gathered. If the agent isn't careful, your number is ported to their SIM within minutes.

Step 3: Your phone loses signal

You notice your phone has no service. You assume it's a network issue. Meanwhile, the attacker is already receiving your OTPs.

Step 4: They clean you out

In the time it takes you to visit a service centre and figure out what happened, they've already:

Withdrawn everything from your MoMo
Transferred money from your linked bank accounts
Locked you out of your email

Real Talk: Why Ghana and West Africa Are High-Risk Targets

MoMo is everything. Mobile money is deeply embedded in daily transactions across Ghana, Nigeria, Senegal, and beyond. A compromised number = a compromised wallet.
SMS OTP is still the dominant 2FA method. Most banks and fintech apps in the region rely heavily on SMS for verification — making SIM swap attacks particularly devastating.
Customer service verification gaps. Not all telecom agents follow strict identity verification protocols consistently.
Low public awareness. Most victims don't know what hit them until it's too late.

How to Protect Yourself: Practical Steps

✅ 1. Add a SIM Lock / Port Lock to Your Number

Call your network provider and ask them to add extra protection to your account — some providers allow you to set a PIN or password that must be provided before any SIM replacement is done.

MTN Ghana: Visit a service centre and request a SIM swap lock
Telecel / AirtelTigo: Ask customer care about account-level PIN protection

✅ 2. Move Away from SMS-Based 2FA

Wherever possible, switch from SMS OTP to an authenticator app:

These generate codes locally on your phone — even if someone steals your number, they can't get these codes.

❌ Less secure:  SMS OTP → your phone number
✅ More secure:  Authenticator app → your physical device

✅ 3. Use a Separate "Silent" Number for Financial Accounts

Consider having a dedicated SIM that you use only for banking and MoMo — one you never share publicly, never post online, and never use for regular calls or social media sign-ups.

✅ 4. Set Up Email Recovery That Doesn't Depend on SMS

If your email recovery method is your phone number, you've created a single point of failure. Add a recovery email address instead, and store your backup codes somewhere safe offline.

✅ 5. Be Stingy With Your Personal Information Online

Don't post your full phone number on Facebook or TikTok
Be careful with "fun" quizzes that ask for your name, date of birth, hometown — these are data collection tools
Limit what's publicly visible on your social media profiles

✅ 6. Act Fast If You Lose Signal Unexpectedly

If your phone suddenly loses signal and you haven't changed anything:

Immediately call your network provider from another phone
Tell them you suspect a SIM swap
Ask them to freeze your account
Alert your bank and MoMo provider
Change your email passwords from a trusted device

Speed is everything. The faster you act, the less damage is done.

For Developers: What You Should Know

If you're building apps that serve Ghanaian or West African users, SMS OTP should not be your only authentication option.

Consider implementing:

// Instead of relying solely on SMS OTP
// Offer TOTP (Time-based One-Time Password) support

const speakeasy = require('speakeasy');

// Generate a secret for the user
const secret = speakeasy.generateSecret({ length: 20 });

// Verify the token the user enters
const verified = speakeasy.totp.verify({
  secret: secret.base32,
  encoding: 'base32',
  token: userInputToken,
  window: 1
});

Libraries like speakeasy (Node.js) or pyotp (Python) make TOTP implementation straightforward. Pair it with a QR code so users can scan it into their authenticator app.

Your users deserve more than a one-point-of-failure SMS system.

The Bottom Line

SIM swap attacks aren't a distant, foreign threat. They're happening right now in Accra, Kumasi, Lagos, and Abidjan. And because mobile money is the financial backbone of millions of West Africans, the stakes are incredibly high.

The good news: awareness is your first line of defence. Share this with someone who uses MoMo. It might save them from a very bad morning.

This article is part of the CyberSense Ghana series — cybersecurity education built for Ghanaians and West Africans. Follow @cybersense101 on TikTok, Instagram, and Facebook for more.

Pocket Infrastructure: Building a Localized Database Environment with Termux

Michael Asante — Thu, 10 Sep 2026 23:48:56 +0000

Pocket Infrastructure: Building a Localized Database Environment with Termux

When you are architecting a mobile-first retail application, you quickly realize that relying entirely on a constant cloud connection during development and field testing can be a massive bottleneck. Whether you are building an inventory management prototype or testing offline data syncs, having a portable, localized database is a strategic advantage.

Here is how to turn an Android device into a secure, pocket-sized infrastructure environment using Termux to host a dedicated database instance for tracking inventory.

The "Vibe Coder" Mobile Stack

Termux is a terminal emulator that brings a robust Linux environment directly to Android—no rooting required. To build this localized backend, we need:

An Android Device: Your standard smartphone or tablet.
Termux: Downloaded via F-Droid (the Google Play Store version is deprecated).
MariaDB: A lightweight, highly efficient SQL database server.

Step-by-Step Terminal Setup

Deploying this environment is remarkably straightforward. Open your Termux terminal and execute the following setup commands:

1. Update and Upgrade Packages
Before installing anything, ensure your environment repositories are current:
pkg update && pkg upgrade -y

2. Install the Database Server
Pull down the MariaDB package to serve as your relational database:
pkg install mariadb -y

3. Initialize the Database Directory
Set up the necessary system tables and data directories to allow the database to run locally:
mysql_install_db

4. Spin Up the Instance
Start your localized database server in safe mode:
mysqld_safe &
(Tip: The & runs the process in the background so you can continue using the terminal).

5. Secure the Installation
Lock down your environment. Even on a local device, security is paramount. Run the security script to set a root password and remove test databases:
mysql_secure_installation

Why This Architecture Wins

By building this dedicated database instance directly on the hardware, you can test smartphone scanning features, user roles, and spreadsheet integrations with zero latency. It bridges the gap between raw web development and clever network engineering. You get a fully functional SQL environment to design data flow frameworks without paying for cloud hosting or exposing your early-stage prototypes to the open web.

Note: The core architecture and technical strategies in this post are my own, drafted with the assistance of AI tools to optimize structure and clarity.

Stop pasting proprietary application code into public cloud AI endpoints.

Michael Asante — Thu, 10 Sep 2026 14:12:58 +0000

Michael Asante

Sep 10

Stop Leaking Code: How to Refactor Offline with Local AI

#ai #cybersecurity #architecture #webdev

2 min read

Stop Leaking Code: How to Refactor Offline with Local AI

Michael Asante — Thu, 10 Sep 2026 13:27:51 +0000

Stop Leaking Code: How to Refactor Offline with Local AI

The biggest security risk for modern developers isn't just bad routing or weak passwords—it is pasting proprietary application logic into public cloud AI endpoints. If you are building complex, multi-tenant business systems, data privacy is non-negotiable.

Here is how to bridge that gap by deploying a 100% local, offline AI environment to analyze and refactor your codebase securely.

The "Vibe Coder" Local Stack

To build this secure architecture, we only need a few lightweight tools to get our local instance running smoothly on consumer hardware:

Ollama: The engine that runs our local language models.
Open WebUI: A clean, accessible frontend interface.
A Target Codebase: Your existing PHP, Laravel, or C++ directories.

The Secure Implementation Strategy

Getting this running requires a slight shift from traditional web deployment, focusing purely on isolated, local data flow.

Initialize the Engine: Install Ollama and pull a lightweight model specialized in coding (like codellama or phi-3) via your terminal.
Deploy the Interface: Spin up Open WebUI using Docker to create a secure, isolated frontend on your local host port.
Map the Directory: Instead of copy-pasting code snippets, utilize the workspace features to point the local model directly at your application folder.
Execute Offline Refactoring: Query the model to optimize your backend database routes or restructure your Tailwind CSS layouts without a single byte of data leaving your machine.

Why This Matters for Network Security

By keeping your AI assistance strictly localized, you eliminate the risk of third-party data ingestion. You maintain absolute control over your infrastructure and network segmentation while still accelerating your creative workflow. That is the essence of building with cyber sense.