A Machine-Learning Model for Phishing Detection in Swahili Messages: A Case of Tanzania

Abstract

Phishing conducted in Swahili has become a persistent threat to the millions of Tanzanians who depend on mobile-money services, yet the detection tools in common use are built for English and transfer poorly to a language whose morphology, register, and transactional vocabulary differ sharply from it. This study makes three contributions. It establishes that classical machine learning, given features tuned to Tanzanian Swahili, separates phishing from legitimate messages at near-ceiling accuracy, and that a deep-learning comparator adds nothing of operational consequence. It documents the compact lexical signature on which that separation rests, built from direct imperatives, money terms, and mobile-operator names. And it shows that lexical urgency, treated as a hallmark of phishing throughout the English-language literature, carries almost no discriminating signal in this language, a caution against porting feature assumptions across languages unexamined. The evidence comes from a corpus of 2,408 Tanzanian short messages, 1,377 of them real SMS drawn from the BongoSCAM collection, on which three classical classifiers and a convolutional neural network were compared under five-fold stratified cross-validation and four ablation experiments. The linear support vector machine and the random forest each returned a mean F1-score of 0.9983 (± 0.0016) and the convolutional network 0.9989 (± 0.0014), a difference smaller than one standard deviation. Performance held across every ablation, indicating that the signal is linguistic rather than an artefact of data construction. Classical models therefore offer an accurate and computationally frugal basis for protecting Swahili-speaking users, provided the gap between balanced-corpus evaluation and the low phishing prevalence of live traffic is managed by pairing the classifier with human review.