wallets across Sierra Leone – and what the law says about who pays?

By Mohamed Wurie Bah Esq.

The Borrowed Voice

A message arrives from someone you love, asking for money. Here is what the law says

about who is responsible, and what you can actually do about it.

I. Tuesday Afternoon

It is a little after four. The generator has not yet come on. Your phone buzzes on the arm of

the chair, and it is your brother’s name on the screen – not a number you have to think about,

but a name that has been in your phone for eleven years.

“Are you around? I’m in a situation. Please send Le 2,000 on Orange Money to this number,

I’ll explain later. Don’t call, I’m in a meeting.

“

You look at the name again. It is his name. The photograph beside it is his face, the one from

the wedding. Below the message sits the whole history of your conversation, the birthday

wishes, the argument about the land in Kenema, the photograph of his daughter in her

school uniform. Everything about this thread says him.

You send the money.

Twenty minutes later, your brother calls, and his first words are,

“Somebody has taken my

WhatsApp.

“

If you have lived in Freetown this past year, you have either been the person in that chair or

you know four people who have. The scam has moved through this country the way dust

moves through a house in harmattan – through every crack, into every room, settling on

everyone.

And when the dust settles, the same question is always left standing in the middle of the

floor.

Who is responsible?

Not morally. Everyone knows the answer morally. Legally – who does the law of Sierra Leone

permit you to point at, and what does it let you ask for when you do?

That question deserves a proper answer, and it has never been given one in plain language.

So let us give it.

II. It Is Not One Crime. It Is Six.The first mistake almost everyone makes, including, sometimes, the police, is to treat this as

a single event called “a scam.

“

It is not. It is a relay race. Six runners, six batons, and each handover is its own offence.

The first runner telephones your brother, or messages him from a hijacked account he

already controls, and talks a six-digit verification code out of him. Sometimes it is dressed as

a WhatsApp support message. Sometimes it is a friend saying I sent you a code by

mistake; please forward it. Sometimes it is not a code at all but a SIM swap arranged with

a corrupted insider. Whatever the costume, it is phishing and computer-related fraud

under the Cyber Security and Crime Act, 2021 (CSCA), and where an insider is involved, a

good deal more.

The second runner takes that code and registers your brother’s WhatsApp on a different

handset. That is illegal access to a computer system contrary to section 33 of the CSCA.

Note what has happened: no door has been opened, nothing has been carried away, and a

crime is already complete.

The third runner downloads the contact list and reads the chat history. Illegal data

interference and unauthorised acquisition of data contrary to section 36 of the CSCA.

The fourth runner writes to you in your brother’s name. Identity theft and impersonation

by means of a computer system contrary to section 42 of the CSCA, and

computer-related forgery contrary to section 41 of the CSCA – because a message crafted

to be taken as authentic is a forgery, whether or not ink was ever involved.

The fifth runner persuades you to send the money. Computer-related fraud under the 2021

Act, and, in the older and simpler language of the common law, obtaining by false pretences

contrary to section 31 of the Larceny Act 1916.

The sixth runner walks into a kiosk in Waterloo and cashes out. That is money laundering

under the anti-money-laundering framework, and it is where the trail usually goes cold.

Why does this dissection matter? Two reasons, both practical.

First, the crime is complete long before the money moves. Even if you never sent a

leone, offences two, three and four have already been committed against your brother. He is

entitled to report them. He does not have to wait to be robbed of cash before he has been

robbed of something.

Second, when you walk into a police station, this is the language that opens doors.

“Somebody scammed my brother” is a complaint.

“My brother’s WhatsApp account was

accessed without right, his contact data was taken, and his identity was used to defraud his

contacts” is a case file.

III. The Line-UpNow let us do what the law does. Let us line up everyone standing near this crime, ask each

one the same question, and refuse to be sentimental about the answers.

1. The scammer

Fully liable, and the only one about whom there is nothing to argue.

But here is a fact that will surprise many people, including some lawyers: unlike the CSCA,

the National Communications Authority Act, 2022 does almost nothing to him.

Read its offences carefully, and you find that the ones that sound relevant are all bound to

licensees. Section 184, unlawful interception, opens with the words “A licensee operating

an electronic communications network or providing an electronic communications

service…

” Section 185, disclosure of content, begins “A licensee, its employees, or

agents…

“ Section 190, unauthorised use of data, catches “a communications entity or

licensee.

“

A man in a bedroom with a stolen verification code is none of those things. He holds no

licence. He operates no network.

So the NatCA Act, for all its 196 sections, is not a criminal statute against this man at all. It is

a regulatory statute – a book of rules for the companies. The criminal weight falls entirely on

the CSCA, 2021, supported by the old offences of obtaining by false pretences and

conspiracy to defraud.

This matters because awareness campaigns keep announcing that scammers “can be

prosecuted under the NatCA Act.

” They cannot. Get the statute right, or the case dies in the

magistrate’s court.

2. The person whose account was hijacked

No liability. None. Not a shilling.

I want to spend a moment here, because this is where the law and our communities have

parted company, and the law is right.

In compound after compound, the person whose WhatsApp was taken becomes the

accused. Neighbours whisper. Relatives calculate. Sometimes they are pressured –

occasionally by a family elder, occasionally by a chief – to repay money they never touched,

never saw, and never asked for.

There is no legal basis for any of it.

Section 155 of the NatCA Act imposes data-protection duties, but read its opening words: “A

licensee or any authorised business providing communications services…

“ A private

individual with a phone is outside that provision entirely. And there exists nowhere in Sierra

Leonean law a duty on a private person to safeguard their contact list for the benefit of the

people in it.As for the code itself – surrendering a verification code to a voice that sounded like a friend is

being deceived. Deception is not a species of complicity. The person who was tricked is the

first victim, not the last suspect.

There is one honest exception, and it should be stated plainly rather than whispered:

sometimes an account is not stolen at all. Sometimes it is lent, used, and then reported

hijacked afterwards. That happens. But it is a question of evidence, to be proved, not a

suspicion to be applied by default to every unfortunate person in the village.

If you take one thing from this article, take this. Stop shaming them. They were robbed

too.

3. WhatsApp, and the company behind it

Here we meet a ghost.

Realistically, Meta has no enforceable liability in Sierra Leone for this scam, and the

reasons are worth understanding, because they say something uncomfortable about the

state of our law.

It holds no licence. Section 36 of the NatCA Act requires a licence to provide electronic

communications services or operate a network. Meta has not applied for one, and NatCA

has not required one. Which means the Authority’s entire enforcement arsenal – compliance

orders under section 33, sanctions under section 34, suspension or revocation under section

43, the consumer obligations in section 152 – points at a company that is not standing in the

room. NatCA cannot fine WhatsApp. It has no hook to hang a fine on.

And now the strangest thing in the whole statute. Section 1 of the NatCA Act carefully

defines “intermediary service providers” as entities “providing access to electronic

communications networks, storing or transmitting information through electronic

communications networks.

” That is WhatsApp exactly. The drafters saw the category and

named it.

Then turn the page, and the next, and the next – through all thirty-eight Parts. The term is

never used again. Not once. There is no takedown duty, no duty to assist an investigation,

no preservation obligation, no data retention rule – and correspondingly, no safe harbour

either.

It is a door frame standing alone in an empty field. Someone measured the opening, cut the

timber, set the posts – and never hung a door, and never built the wall it was meant to sit in.

And there is no way to reach across the water. No requirement of local establishment, no

local representative, no designation mechanism. Compulsion runs only through mutual legal

assistance treaties or Meta’s own voluntary law-enforcement portal – processes measured in

weeks and months, against a cash-out measured in minutes.Meta will help your brother recover his account. On a properly framed request from the

police, it may preserve records. That is the whole of it.

WhatsApp will not refund anybody. Say that plainly and early, because people lose weeks

waiting for a rescue that was never coming.

4. Orange Sierra Leone, and Orange Money

This is the contested ground, and it is also, realistically, the only place where money is ever

recovered. So read slowly.

Start with what is not true. Orange is not liable for the fraud itself. You authorised the

payment. Your consent was obtained by a lie, but the lie was told by the scammer, not by the

operator, and the operator executed a valid instruction from its own customer. Sierra Leone

has no equivalent of the reimbursement rules that now exist in some other jurisdictions for

so-called authorised push payment fraud. There is no automatic refund duty, and any

campaign promising one is setting people up for a second disappointment. Hopefully, a

revised Electronic Transactions Act will help with that

But liability can attach on four separate grounds, and they are independent of each

other.

First – the wallet that should never have existed. If the receiving wallet is registered to a

false name, a borrowed identity, or nobody at all, then the operator is in breach of SIM

registration requirements and of customer due diligence obligations under the Anti-Money

Laundering and Combating of Financing of Terrorism Act, 2012. That is a regulatory breach

enforceable by NatCA under sections 33 and 34, and under the monitoring and enforcement

powers in sections 176 and 177 – and separately by the Bank of Sierra Leone and the

Financial Intelligence Unit. Where the same wallet number surfaces in complaint after

complaint and is still open, the case stops being arguable and starts being obvious.

Second – the complaint that was ignored. Section 152(1)(e) obliges a licensee to

“address consumer complaints satisfactorily with the utmost priority.

“ Section 152(2)

makes contravention punishable by a fine set by the Authority. This is quietly powerful: a

fraud report that is documented and then ignored is a breach in its own right, entirely

separate from the underlying fraud. You do not have to prove Orange was responsible for

the theft. You only have to prove they ignored you afterwards – which is why you must

always, always get a reference number.

Third – the information you are owed, and the information you are not. Section 80(1)

provides that a licensee shall not disclose a subscriber’s information “except on demand

made by the Authority or by a court order.

“

Notice that this cuts both ways. It protects the privacy of every wallet holder in the country,

including yours. It also means that Orange cannot lawfully tell you who owns the number

that took your money – not because they are shielding a criminal, but because a statute

forbids them. Every victim eventually demands that name and then accuses the operator of

protecting thieves. They are not. They are obeying section 80. The name is obtainable, butonly through a court order, and that is not a loophole; it is the gateway the law deliberately

built.

Fourth – the duty that arises once they know. Where an operator has been told,

specifically and in writing, that a particular wallet is being used for fraud, and permits it to

keep cashing out anyway, a negligence argument arises by analogy with a bank’s duty to

pause where it is on notice of dishonesty. This has not been tested in a Sierra Leonean

court. It should be. Someone should bring it.

And who supervises all this? Section 116(4)(b) of the NatCA Act gives the Authority

power,

“together with the Bank of Sierra Leone,

“ to regulate value-added services

including “non-bank-led money services initiated and terminated on communications

platforms.

“

Mobile money fraud therefore sits in joint custody. And joint custody, as every family lawyer

knows, is where children get lost. Two regulators, each entitled to act, each able to gesture

at the other. Until there is a memorandum of understanding naming a lead, that section is

less a grant of power than a shared shrug.

5. The agent, and the insider

Often the weakest link in the chain, and frequently the easiest conviction – which is why

investigations should start here rather than chasing the ghost at the top.

An agent who hands over cash without demanding identification breaches customer due

diligence rules. And because the agent acts within the scope of an agency relationship, the

operator carries vicarious exposure for what its agents do at the counter.

An employee is in a far graver position. A staff member who arranges a fraudulent SIM

swap, or who sells subscriber data, walks straight into section 185 of the NatCA Act – a

fine of not less than SLL 1 billion or imprisonment of not less than five years, or both –

alongside illegal access and abetment charges under the 2021 Act.

That is the strongest criminal provision in this entire landscape. It just happens to point at the

staff room rather than the street.

IV. The First Hour

Now the part that actually saves money.

Understand the shape of the thing you are fighting. Mobile money does not sit still. From the

moment your transfer lands in the scammer’s wallet, a clock is running, and it is not counting

in days. It is counting in minutes, until somebody walks into a kiosk and turns your money

into paper. Once it is paper, it is gone.

Everything below is ordered by the clock, not by importance.

Immediately – within minutes, not hours:1. Call Orange customer care and demand a block on the receiving wallet. Give the

number, the transaction ID, the amount and the time. Do not hang up without a complaint

reference number, and write down the name of the person you spoke to. This is the only

step with a real chance of stopping the money, and it is also the step that later proves a

section 152 breach if they do nothing.

2. Go to the Sierra Leone Police – the Cyber Crime Unit, or the nearest CID office. Get the

Occurrence Book number. Only the police can trigger the preservation and production

powers under the 2021 Act; a private complaint cannot.

3. Freeze the evidence before anyone deletes it. Screenshot the entire conversation

showing the number and the timestamps. Screenshot the Orange Money confirmation SMS

and your transaction history. Delete nothing – not the chat, not the messages, not the

number. People delete in disgust and destroy their own case.

4. The person whose account was taken should recover it immediately by re-registering

with a fresh SMS code, switch on two-step verification the same minute, and then broadcast

a warning to every contact.

5. Report the impersonating account inside WhatsApp, so it is flagged and any records

are preserved on their side.

Then, within days:

6. File a complaint with NatCA. Section 27(5) requires the Authority to maintain a

consumer complaints unit. Section 27(2)(c) gives it jurisdiction over “complaints between

licensees and consumers.

“ And section 29(1) obliges it to commence investigation

within fourteen days of receiving your complaint. That deadline is written in the statute. It is

your leverage. Use the number.

7. Escalate to the Bank of Sierra Leone and to the Financial Intelligence Unit,

particularly where the sum is large or where you can show the same wallet defrauding

others.

V. What You Can Actually Ask For

Let us be honest about remedies rather than encouraging.

Through NatCA — against Orange, not against the thief. Section 30 lets the Authority,

after hearing a complaint, order refunds (s.30(h)), impose financial sanctions (s.30(f)), award

costs, or grant “such other relief as may be deemed necessary and reasonable“

(s.30(j)). Section 34(2)(a) goes further: where a compliance breach has caused damage, the

Authority shall order that the complainant be compensated. Section 176(4)(b) allows it to

order a licensee to pay compensation. And section 32 gives any aggrieved person a right of

appeal to the High Court.So a statutory compensation route genuinely exists. But understand its shape precisely: it

runs against the operator, and only where the operator itself breached a duty. It is not a

general refund window for fraud victims, and it must never be advertised as one.

Through the courts – against the thief. A civil claim for money had and received, tracing

the funds into the wallet. An injunction freezing that wallet before trial. And critically, a court

order under section 80(1) compelling Orange to disclose who registered the receiving

number. That order is the answer to the question every victim asks. It is how you find out

who took your money.

On conviction, a criminal compensation order. And under section 34(4), where an entity is

convicted under the NatCA Act, anyone who suffered loss may be compensated by it.

The honest bottom line: if the money has been cashed out, you will probably not see it

again. Almost everything depends on the first sixty minutes. Which is why the paragraph you

should reread is Section V, not this one.

VI. The Holes in the Fence

This scam is not thriving because Sierra Leoneans are gullible. It is thriving because our

legal fence has gaps you could drive a lorry through. Six of them, stated plainly so they can

be argued about:

One. There is no statutory mechanism to recall or reverse a fraudulently induced mobile

money transfer. Not a fast one, not a slow one, not any.

Two. There are no statutory SIM-swap safeguards – no cooling-off period, no mandatory

alert to the original subscriber, no enhanced verification above a threshold. The single most

dangerous operation in the system is the least regulated.

Three. There is no allocation of loss for authorised push payment fraud. By default, the

entire loss sits on the person with the least power and the least information in the

transaction.

Four. The orphaned definition of “intermediary service provider” in section 1 of the NatCA –

the door frame in the empty field.

Five. There is no mandatory fraud data-sharing between operators, the Bank of Sierra

Leone, the Financial Intelligence Unit and the police. So one wallet can defraud forty people

across two networks and never once be aggregated into a single picture. Forty separate

complaints, none of them adding up.

Six. Foreign platforms sit entirely outside the regulatory perimeter. No local representative

requirement, no registration threshold, no duty of assistance. Comparable West African

jurisdictions have begun closing this. We have not.

None of these requires a new Act. Most could be done by statutory instrument under the

powers NatCA already holds in section 194.VIII. Five Sentences to Carry Home

Never share a verification code. WhatsApp will never ask for one. Neither will Orange.

Nobody legitimate will ever, in your entire life, need that number from you.

Turn on two-step verification tonight. It takes ninety seconds, and it defeats this entire

attack. It is the closest thing to a vaccine that exists here.

Any request for money on WhatsApp must be confirmed by voice – on a number you

already have. Never the number in the message. And when the message says don’t call

me, I’m in a meeting, understand what you are looking at: that sentence is not an excuse. It

is the whole trick. It exists for one reason, which is to stop you from hearing the wrong voice.

If you have sent money, call Orange within minutes. Not tomorrow. Not after you have

finished being angry.

Report even small amounts. Repeat wallets only become visible when reports are added

together, and yours may be the one that completes somebody else’s picture.

VII. Last Thing

There is an old habit in this country of treating a fraud victim as a fool. It is a way of

reassuring ourselves – that could not happen to me, because I am not careless.

But look again at the message in the first paragraph. It came from the right name, above the

right photograph, at the top of eleven years of real conversation. Nothing about it was

careless. The scam does not work by finding stupid people. It works by borrowing a voice

you have every good reason on earth to trust.

The law understands this better than the neighbours do. Under the Cyber Security and

Crime Act, the person who lost the code and the person who sent the money are both

victims of the same relay, run by the same six runners.

The only fool in the story is the one who took the money. And he is counting on you being

too ashamed to report him.

Do not give him that.

Mohamed Wurie Bah is a Barrister and Solicitor of the High Court of Sierra Leone and

Head of the Department of Law at IMATT College, Freetown. He teaches and writes in

the field of cyber law, media & telecommunication and technology regulation.

This article is for general public information and is not legal advice. Anyone facing a specific

loss should consult a qualified legal practitioner without del