A Facebook friend request turned into a nightmare
According to Burundi’s Judicial police, in 2024, online scammers stole over BIF 157 million. Digital law experts call for enhanced prevention and repressive cybercrime laws. However, Paradigm Initiative offers vital digital and physical protection tools to navigate this challenging digital environment.
Ella’s Harrowing Experience with an Online Scam
Ella is a domestic worker at Cibitoke Quarter, a low-income neighbourhood situated in the northern part of Bujumbura, Burundi’s economic city.
Like other domestic workers, after completing her daily duties of cleaning, cooking, and caring for her employer’s households, she spends her free time scrolling through social media platforms such as Facebook, TikTok, and others watching and enjoying various entertaining content via her smart mobile phone.
As she told us, one day, Ella received a Facebook friend request from an attractive young man. She immediately accepted. However, she was unaware that a simple click would soon drain her finances. The young man began engaging her in conversation.
After a few days, he started probing her with personal questions about her life, jobs, and relationships. Ella did not lie and admitted she is a domestic worker.
After several weeks of online interactions, the young man revealed that he is the sole heir to his family’s estate and lives in South Africa. He also promised to financially support her as long as she was interested in commercial activities. Ella agreed.
The young man agreed to send her capital to start commercial activities. However, he claimed that transferring money from South Africa to Burundi through popular mobile payment services like Lumicash and EcoCash was not feasible. He asked her if she had a bank account, and she replied “No”. The guy urged the lady to have one. He then sent her a local number of a person to contact for more details.
Ella immediately contacted the person. He claimed to work at a KCB Bank branch in Ngozi. He requested that she send her national identification card, a passport photo, and an account opening fee of BIF 38,000, approximately USD 13.
After Ella transferred the money, the man from South Africa acknowledged that the Bank account had been opened successfully. However, he requested an additional BIF 50,000, or approximately USD 17, to cover the bank transfer fees. At this point, a Lumicash agent warned Ella that she might be scammed, as had happened to others. She did not send the additional fees.
The young man began insulting and intimidating her, calling her unintelligent and saying she would die poor. At this point, Ella realized she had really been scammed.
Another victim’s dilemma
Beyond what happened to Ella, another young man was intimidated and threatened to pay the scammer who used the young man’s Facebook profile picture and manipulated it to create an edited video depicting an explicit act of masturbation. The scammer then demanded payment, threatening to share the fabricated video with a wide audience unless the victim complied to pay the requested amount of money.
Scammers stole more than 150 million in 2024
According to Police Brigadier General Joseph Kenyatta, General Commissioner of the Judicial Police (PJ), from January to December 2024, scammers stole more than BIF 157 million of Burundian Francs via Lumicash and EcoCash and 4270 phones were also stolen.
Beyond that, the Judicial Police commissioner adds that the police are equipped to investigate and identify cybercriminals. ‘‘For example, among 157 million stolen, more than 111 were seized and 480 phones were given back to their owners.”Noted the PJ.
Who are the Scammers in Burundi?
General Joseph Kenyatta says scam perpetrators are people skilled in computer technology and mobile phone usage. He explains, “It only takes a simple message that falsifies your identity as a celebrity or a well-known figure in power, promising jobs and other significant opportunities. Victims often unwittingly send money, believing they are transferring funds to authorities or other friends when, in reality, they are not.” Kenyatta emphasizes the lack of curiosity among victims.
However, he admits that cybercrime is a complex phenomenon influenced by various factors, including the penetration of smartphones and the Internet. Burundians, like elsewhere, are quickly adapting to these new technologies, which can make them more vulnerable to several cybercrimes,” he noted.
He cited the most common cybercrimes in Burundi, which include the use of identity cards to extort sensitive information from individuals, online scams, and the distribution of illicit content, particularly sharing hateful or defamatory material.
Additionally, account hacking, digital espionage, social engineering tactics, and electronic theft are to be mentioned.
Internet and smartphone penetration in Burundi
According to the recent data published by Agence de Régulation et de Contrôle des Télécommunications du Burundi (ARCT), Burundi Telecoms Regulatory Authority, in February 2025, the number of mobile phone users in Burundi reached 8 million covering 63.63% of the population which is at 13 097 400 according to the Institut national de la statistique du Burundi ( INSBU)in 2023.
However, out of eight million mobile phone users in Burundi, only 3,2 million people have access to the internet. This figure accounts for just 25.1 percent of the country’s population which is 13 097 400.
Despite a low number of only 25.1 percent of internet users in Burundi, worse still, they experience a sluggish internet speed.
According to ARCT, the cumulative IP capacity recorded at the Burundian border was 26,136 Mbit/s during the third quarter of 2024.
Internet experts suggest that the available IP capacity of 26,136 Mbit/s is not sufficient in relation to the number of users. “If 26,136 Mbit/s is shared equally to 3,291,745 internet users, one user should have an average bandwidth of 7.93 Kbit/s. This bandwidth is significantly below the standard for a satisfactory internet experience, which is generally around 25 Mbit/s for streaming HD video and other data-intensive activities. “ They explained.
In a bid to address growing dissatisfaction among internet consumers, telecommunications operators and internet service providers convened on January 29 with the ministers in charge of Communication and the Interior, they identified several key factors contributing to the ongoing disruptions in service, notably fuel shortage, foreign currency, and frequent power outages.
Léocadie Ndacayisaba, the Minister of Communication, Information Technology, and Media, emphasized the urgent need to enhance infrastructure, stating, “What is needed is to increase the number of antennas and tackle the issue of fuel scarcity. In certain areas, regular power outages compel operators to rely on generators that consume fuel.”, she noted.
The government is expected to explore solutions to mitigate these challenges and restore reliable internet access for consumers, a solution that has been in promise for years.
Is Burundi equipped enough to fight against cybercrimes?
According to General Joseph Kenyatta, General Commissioner of the Judicial Police (PJ), police are equipped enough to conduct investigations, identify criminals, and then transfer the case to the jurisdiction, which treats it like other cases.
However, Kenyata acknowledges the absence of a dedicated department or specialized police units to address the growing number of digital crimes. He also urges Burundians to remain vigilant about such offenses. “I strongly advise everyone that if you lose your mobile phone or computer, you should immediately file a police report to prevent criminals from misusing your identity,” stated the official.
Additionally, he admits that the implementation of the “Law No. 1/004 of March 16, 2022, on the prevention and repression of cybercrime in Burundi requires supplementary measures, including widespread awareness campaigns through communication channels such as radio and television stations, social media, and posters to educate the public about the risks of cybercrime, promote best practices and capacity-building initiatives for police officers.
He concludes that companies and financial institutions need to be trained about the risks associated with cybercrime and prevention strategies.
Cybercrimes landscape analysis in Burundi
Kwizera David, PhD Researcher in Digital Law and Business Lawyer currently a Professor and Head of the Law Department at the University of Burundi, praises the prevention and repression of cybercrime in Burundi law as it came at a critical time: “The growing number of digital services in Burundi needs to be supported by legal regulations with a focus on protecting personal data, ensuring cybersecurity, and safeguarding the rights of consumers who use digital services.” Noted the researcher.
However, the digital law expert argues that the law comprises only 70 articles and addresses just four categories of offenses. The first category focuses on the confidentiality, integrity, and availability of data within information systems. However, the provisions outlined in this law have not been fully developed. “Confidentiality and data integrity are indeed broad subjects that require more comprehensive treatment,” experts note.
Additionally, the law touches on offenses related to terrorism but includes very few articles on this critical issue. It fails to thoroughly cover digital terrorism, with all aspects of cyberterrorism needing to be addressed.
The law also mentions threats to state security. The state’s information system relies on computing. In Articles 61 and 63, the law provides for the protection of privacy, but only two small articles are dedicated to this important topic.
The researcher argues that the law should pay more attention to the protection of privacy and personal data. “There is a pressing need to establish a special legislative framework and an institutional structure to oversee these matters,” he asserts.
Furthermore, the law imposes penalties that are significantly heavier than those outlined in the Code Pénal du Burundi. ’’For instance, Article 315 of the Penal Code stipulates that fraud is punishable by a sentence of 2 months to 5 years in prison and a fine of only 50,000 to 100,000 FBU. In contrast, the law on the prevention and repression of cybercrime imposes much harsher penalties: for equivalent fraud, the sentence can range from at least 5 to 10 years in prison and a fine of 10 to 20 million Burundian Francs.’’ disclosed the expert.
Expert Recommendations
The digital law expert suggests the law should be revised as it lacks clarity regarding the procedures that victims should follow and the authorities responsible for handling these cases. “A victim of a digital offense is required to present his case to an ordinary police officer,” Kwizera points out. This approach raises concerns, as specialized police officers trained in cybercrime, along with a dedicated prosecutor’s office, should be involved in these matters. “A more structured response is essential for effectively addressing the complexities of cybercrime,” he notes.
Another significant shortcoming of the law is its failure to address the protection of intellectual property rights.
The expert argues that it does not adequately safeguard the rights of cyber consumers. “The law is supposed to ensure their well-being through protective mechanisms and penalize anyone who attempts to infringe upon their freedom,” he emphasizes.
According to the researcher, this legislation overlooks the importance of international cooperation in combating cybercrime. It lacks provisions related to procedural matters, extradition, prosecution of offenders, and compensation for victims.
Experts stress the need to reference existing frameworks, such as the African Convention on Cybersecurity and the Protection of Personal Data, as well as the Budapest Convention on Cybercrime, which was adopted in 2001. “Incorporating these international standards is crucial for an effective legal response to cyber threats,” he asserts.
How to protect ourselves against digital and physical threats?
Paradigm Initiative a non-profit organisation that shapes policy, defends rights and builds capacity in the digital environment towards a digitally inclusive and rights-respecting world, in its AYETA-Digital Rights Toolkit, states that protecting personal information and securing communication for those on the frontlines of advocacy, journalists, activists, and digital rights defenders has become more critical especially in this digital era since these individuals often navigate high-risk environments where their safety and privacy are paramount.
Essential digital protection tools
To this end, the AYETA-Digital Rights Toolkit provides digital protection tools that are essential in this landscape. These tools include password managers like Bitwarden and KeePass that allow users to generate and securely store strong, unique passwords, safeguarding their online accounts.
Adding another layer of security, multi-factor authentication apps such as Google Authenticator and Authy help ensure that even if a password is compromised, unauthorized access remains unlikely.
Virtual Private Networks (VPNs), including NordVPN and ProtonVPN, play a crucial role in encrypting internet traffic and masking IP addresses, enabling users to bypass censorship and maintain their anonymity online.
For secure communications, encryption tools like Signal and PGP provide end-to-end encryption, ensuring that messages remain private.
The Tor Browser stands out as a powerful tool for anonymous browsing, routing internet traffic through multiple servers to obscure users’ identities.
Meanwhile, antivirus software such as Avast and Malwarebytes acts as a frontline defense against malware, while firewalls like Windows Defender Firewall block unauthorized network access.
Additionally, the OONI Probe helps detect internet censorship and network interference, empowering users to understand their digital environment better.
Vital physical protection tools
According to the same tool, the need for protection extends beyond the digital realm since physical protection tools are equally vital. Full-disk encryption solutions like BitLocker and FileVault safeguard data in the event that devices are confiscated. Burner phones offer a disposable option for sensitive communications, providing an extra layer of security when needed most.
In moments of crisis, the Signal app serves as a reliable means of encrypted messaging, particularly during protests where secure communication is essential. First aid kits become indispensable for emergencies encountered during fieldwork, while trusted contacts facilitate the sharing of itineraries and emergency plans among colleagues.
Situational awareness is crucial; monitoring surroundings for potential threats can make all the difference. Lastly, pre-saved emergency numbers for police, medical assistance, and legal aid ensure that help is just a click away when it matters most.
The tools conclude that in a world fraught with risks, these tools are not merely options but necessities for those who dare to stand up for justice and truth.