African Banks Are Finally Running Bug Bounties. The Researchers Say Payouts Are the Problem.

Nineteen banks across seven African countries have launched formal vulnerability disclosure or bug bounty programs since early 2024, up from four. The direction is right. The rates, researchers say, are not.

A survey of 210 security researchers conducted by the Nairobi-based collective Ushirika found a median payout of $260 for a critical-severity finding at an African bank program, against a global median in the low thousands for equivalent severity at comparable institutions. Nine of the nineteen programs offer no monetary reward at all, only acknowledgment.

"I reported an authentication bypass that would have let anyone read another customer's statements," said a researcher in Lagos who asked to be identified only by his handle, mkpuru. "They fixed it in four days, which was excellent, and sent me a certificate. I have a certificate. I also have rent."

The risk is not that researchers stop looking; it is where the findings go instead. Several researchers told Afrikons they now submit only to programs that pay, and that colleagues have begun quietly selling findings rather than reporting them. Two banks contacted for this story said their programs are new and rates are under review — the standard answer, and one that has a limited shelf life.