Building Secure Apps When Everyone is Trying to Scam Your Mum

My mum called me yesterday from her home in Akure, asking if a WhatsApp link about a "Federal Government 100k Sapa-Relief Grant" was real. She was ready to click it because a deacon from her church shared it. It’s the classic trap: high urgency, a trusted social circle, and a beautiful, professional-looking landing page.

TechCity’s recent recap of Internet Safety Month 2026 hits right at the center of this problem. In 2026, cybercriminals are not just sending poorly spelled emails anymore. They are using AI to clone voices, spin up polished fake investment apps in minutes, and write perfectly convincing phishing copy.

As a developer, this isn't just a "user education" problem. It's an engineering challenge. How do we build products that keep our people safe when the attackers are using better tech than some of our local startups?

The Friction vs. Security Nightmare

We all know the standard security playbook: use password managers, enable Two-Factor Authentication (2FA), and inspect every URL. But let’s be real about the ground reality in Nigeria.

If you force a user in a chaotic bus park in Owerri to use an authenticator app just to log in and check their delivery status, they will uninstall your app. SMS OTPs are the default here, but they are incredibly expensive for us to run, and the local telcos fail half the time anyway.

So, what do we do? We have to design for "defensive UX."

Instead of expecting users to always "think before they click," we need to build guardrails inside the software:

• In-app warning patterns: If an account is doing something unusual, don't just send a generic alert. Use clear, local language. Tell them: "We will never ask you for your PIN over the phone."
• Smarter rate limiting: We need to watch for automated scraping and fake API requests trying to validate phone numbers on our platforms.
• Context-aware authentication: If someone usually logs in from a cheap Android phone in Gbagada and suddenly attempts a high-value transfer from an iPhone in Jos, lock it down instantly and trigger a manual review.

AI Scams are Outperforming Our MVPs

The TechCity recap pointed out that fake investment platforms and remote work scams are looking incredibly professional. Frankly, some of these fraudulent sites have better UI/UX and load faster than legitimate products built by local dev shops.

They are using AI tools to generate clean code, flawless copy, and convincing customer support chatbots. When the barrier to entry for creating a highly polished scam is this low, trust becomes our most valuable asset.

If you are building a product in Nigeria today, you can no longer afford to look "sketchy." Your SSL certificates must be perfect. Your transactional emails cannot come from a generic Gmail address. Your domain names must make sense. If your genuine product looks like a rushed side project, users will mistake it for a scam, or worse, they won't be able to tell the difference when a real attacker clones your layout.

Empathy Over Elitism

We in the tech community love to laugh at people who fall for WhatsApp scams or fake customer care handles on Twitter. But as the TechCity piece rightly noted, our parents and older relatives need support, not criticism.

If my mum, with all her caution, can almost fall for an AI-generated scheme, then the average person stands no chance without active help. When we build, we must build with the assumption that our user is tired, distracted, and currently being targeted by five different scammers.

"No gree for anybody" is a great slogan for the streets, but when it comes to security, our systems must be the ones that refuse to break, even when the user makes a mistake. Keep debugging, keep securing your endpoints, and please, go call your parents and check their phone security settings today.