Simba

Inspiration

Millions of people rely on mobile money and phone based authentication for everyday financial activity.

That convenience also creates a serious security problem.

Many financial services still depend heavily on SMS one time passwords. If an attacker gains control of someone's phone number through a fraudulent SIM swap, the attacker may also begin receiving authentication codes intended for the legitimate owner.

At the same time, telecom operators may already know that a SIM has recently changed while the financial institution processing a transaction does not receive that information at the exact moment it needs it.

We asked one question:

What if a financial institution could know whether a phone number was safe to trust before approving a sensitive transaction?

That question became Simba.

What it does

Simba is a mobile focused digital identity trust and fraud protection platform designed to help protect users and financial institutions from SIM swap fraud, phishing and related identity threats.

At the center of Simba is the Trust Engine.

The Trust Engine evaluates signals such as SIM swap events, device changes and other telecom information to maintain a continuously updated trust state for a user's phone number.

When suspicious activity is detected, Simba can change the trust state and activate additional protection.

Financial institutions can query Simba before sensitive operations and receive a clear trust decision:

Allow

Hold

Block

This provides an additional identity signal instead of relying entirely on an SMS OTP.

Simba also addresses phishing and smishing.

Its fraud detection system analyzes suspicious links and messages using artificial intelligence designed around fraud patterns relevant to Rwanda and the wider East African context.

The mobile application gives users visibility into their identity security status and provides tools for suspicious message scanning, security alerts and emergency response.

How we built it

Simba is designed around an API driven architecture connecting mobile users, telecom intelligence and financial institutions.

The backend uses Node.js and Express.js.

PostgreSQL provides durable storage for identity and security information.

Redis provides fast access to trust states, scan results and security information that must be retrieved quickly.

The artificial intelligence layer uses Groq API and Llama 3 for fraud analysis.

The mobile application uses React Native and Expo, allowing the platform to target Android and iOS from a shared codebase.

The architecture also includes telecom API integration for information such as SIM swap detection, device status, number verification and roaming signals.

Security is fundamental to the platform architecture and includes JWT authentication, bcrypt password hashing, HMAC SHA256 webhook verification and HTTPS.

Challenges we faced

The biggest challenge with Simba is that the problem crosses several systems.

Telecom operators possess one part of the information.

Financial institutions possess another.

Users experience the consequences when those systems cannot exchange the right security information quickly enough.

Designing Simba therefore required us to think beyond a normal cybersecurity mobile application.

The platform has to operate quickly enough to provide useful identity trust information during sensitive financial operations.

Another challenge was resilience.

An identity protection platform cannot completely stop working simply because one external service becomes temporarily unavailable.

We also had to make sophisticated security information understandable to ordinary mobile users.

A security system is only useful when people understand what happened and what they should do next.

What we learned

Building Simba taught us that digital identity security increasingly depends on context.

A correct password or OTP does not automatically prove that the person presenting it is the legitimate account owner.

Signals about the SIM, device and recent identity activity can provide additional information about whether an identity should currently be trusted.

We also learned that artificial intelligence is most useful when combined with deterministic security logic rather than being treated as the only decision maker.

Our vision is to create an identity trust layer capable of helping protect digital financial ecosystems before fraudulent transactions happen instead of only responding after users have already lost money.

Built with

Node.js, Express.js, PostgreSQL, Sequelize, Redis, Groq API, Llama 3, React Native, Expo, JWT, Bcrypt, HMAC SHA256, OneSignal, Africa's Talking, REST API, Telecom APIs

Try it out

Simba is a mobile application and does not currently have a public website.

Its source repositories are private.

The public Devpost submission will therefore use screenshots and the required video demo to demonstrate the application, Trust Engine, fraud detection flow and mobile user experience.

Built With

• africa's-talking
• api
• bcrypt
• expo.io
• express.js
• groq
• hmac-sha256
• jwt
• llama-3
• node.js
• onesignal
• postgresql
• react-native
• redis
• rest-api
• sequelize
• telecom