SS7: the forgotten telecom flaw threatening mobile money

A 50-year-old protocol, built for a small club of carriers that trusted each other by default, still underpins global telecom signaling today. What that means for services that rely entirely on SMS and voice calls to secure an account.

October 18, 2026 · SunuCyberSecurity team

Sources: GSMA, 60 Minutes (CBS News, 2016)

In our piece on AI-boosted mobile money fraud, we mostly talked about SIM swap — convincing a carrier to transfer a number to a new card. There's a second, older and less visible attack path that doesn't even require tricking anyone: direct access to the SS7 signaling network.

A protocol built for a world that no longer exists

SS7 (Signaling System No. 7) was developed in the 1970s so that different carriers' phone networks could talk to each other — locating a roaming subscriber, routing a call, forwarding an SMS. At the time, only a handful of state-owned or incumbent carriers had access to the network, so the protocol never built in authentication between them: every SS7 message is treated as legitimate simply because it's on the network.

The problem is that this 1970s "closed club" has grown enormously — hundreds of carriers worldwide, plus resellers, SMS aggregators and interconnect providers who obtained legitimate SS7 access for commercial reasons. Every additional access point is a potential door for a malicious actor who manages to lease, compromise, or hijack an existing SS7 access.

What SS7 access actually enables

The best-known demonstration dates to 2016: CBS News' 60 Minutes showed, live on air, German researcher Karsten Nohl (Security Research Labs) intercepting the calls and location of a phone provided by a member of Congress, with his consent, using only legally obtained SS7 access — no malware installed on the device. Since then, the GSMA (the global carrier association) has documented and kept updating these risks in its FS.11 guideline.

Sources: GSMA FS.11 (SS7 and SIGTRAN Network Security) · Positive Technologies (published research on SS7 vulnerabilities) · FCC (2017 report on signaling security flaws)

Why this is a mobile-money-specific problem

Nearly every mobile money service relies on SMS or a voice call as its second factor: an OTP code texted to confirm a transfer, an automated call to validate a change. SS7 access can intercept that code without ever touching the victim's phone, without a SIM swap, and usually without leaving any trace visible to the subscriber — unlike SIM swap, which cuts the victim's network immediately and can therefore be noticed. That's exactly what makes this path quieter, and why it stays relevant even when users follow every recommended precaution against SIM swap.

What we know — and don't know — for West Africa

Honestly: there is very little public, documented data on confirmed SS7 incidents specifically targeting West African carriers. That doesn't mean the region is protected, nor that it's especially exposed — it means this kind of intrusion, by its nature, leaves few visible traces and is rarely publicly disclosed anywhere in the world. The GSMA itself notes that the real extent of SS7 exploitation is hard to measure, precisely because victims usually don't detect it.

What we do know with certainty: the region's reliance on SMS/calls as a second factor for mobile money is itself thoroughly documented and very high. That combination — a known dependency on a channel that's vulnerable by design — is reason enough to discuss it, independent of the absence of locally published incident statistics.

Sources

GSMA FS.11 (SS7 and SIGTRAN Network Security Guidelines) · 60 Minutes, CBS News (2016, demonstration with Karsten Nohl / Security Research Labs) · Positive Technologies, published research on SS7 vulnerabilities · FCC, 2017 report on telecom signaling flaws. External figures and facts not published by SunuCyberSecurity unless stated otherwise — see the "What we know — and don't know" section above for what specifically concerns West Africa.

Put this into practice

A free scan, in a few minutes, no credit card.