Simba

Inspiration

Our phones have become part of our identities.

They are used for communication, mobile money, banking, authentication and account recovery.

Many of these services still rely heavily on SMS one time passwords.

That creates a serious weakness.

If an attacker successfully takes control of someone's phone number through a fraudulent SIM swap, the attacker may also begin receiving authentication codes intended for the legitimate owner.

At the same time, users continue receiving increasingly convincing phishing and smishing messages designed to steal credentials or manipulate them into authorizing fraudulent transactions.

We asked:

What if a phone could help understand whether its digital identity was currently safe?

That question became Simba.

What it does

Simba is an intelligent mobile security platform designed to protect users from SIM swap fraud, phishing and related digital identity threats.

At the center of Simba is the Trust Engine.

The Trust Engine evaluates security information associated with a user's mobile identity and maintains a current trust state.

Signals can include SIM changes, device activity and other telecom information.

When suspicious identity activity is detected, Simba can update the trust state and warn the user.

The platform also includes AI based phishing and smishing analysis.

Users can analyze suspicious messages and links before interacting with them.

For financial institutions, Simba is designed to expose an API capable of returning a simple identity trust recommendation before sensitive transactions.

Possible decisions include:

Allow

Hold

Block

Instead of trusting an OTP alone, a financial system can consider additional identity context.

How we built it

Simba uses React Native and Expo for the mobile application.

The backend architecture uses Node.js and Express.js.

PostgreSQL provides durable storage for security and identity information.

Redis supports fast access to frequently requested trust states and security information.

The AI fraud analysis layer uses Groq API and Llama 3.

The architecture is designed to integrate with telecom APIs for information such as SIM swap detection, device status, number verification and roaming signals.

The platform also incorporates security mechanisms including JWT authentication, bcrypt password hashing, HTTPS and HMAC SHA256 webhook verification.

Push alerts can be delivered using OneSignal, while SMS based security notifications can use Africa's Talking.

Challenges we faced

The biggest challenge with Simba is that digital identity security crosses multiple systems.

The mobile device knows some information.

The telecom operator knows other information.

The financial institution knows something else.

Attackers benefit when these systems cannot communicate quickly enough.

Designing Simba therefore required us to think about security as an interconnected system instead of just another mobile application.

Another challenge was translating complex cybersecurity signals into understandable information.

Showing a user a technical security score is not enough.

The user needs to understand:

What happened?

How serious is it?

What should I do now?

Performance is also important because identity risk decisions may eventually need to happen while a sensitive financial transaction is being processed.

What we learned

Simba taught us that digital identity cannot be protected using credentials alone.

Someone presenting the correct OTP does not necessarily mean that person is the legitimate account owner.

Context matters.

A recent SIM change, suspicious device activity or unusual security event can completely change how much an authentication attempt should be trusted.

We also learned that AI should support security decisions rather than blindly control them.

Simba combines AI analysis with deterministic security logic so that security decisions can remain understandable and resilient.

Our goal is to give users and financial systems a stronger signal about whether a mobile identity should currently be trusted.

Built With

• africa's-talking
• artificial
• bcrypt
• expo.io
• express.js
• groq
• hmac-sha256
• intelligence
• jwt
• llama-3
• node.js
• onesignal
• postgresql
• react-native
• redis
• rest-apis
• sequelize
• telecom-apis