The tactics may change, but human vulnerabilities often remain. Two personal encounters with fraud, ten years apart, offer some interesting lessons about organisational change, leadership and resilience.
I was supposed to write a theoretical piece about organisational change management today. Instead, a personal experience from last week gave me something much more interesting to reflect on: a real-life case study.
Ten years ago, while moving houses, I put some furniture up for sale. A man dressed in a full UPDF uniform showed up, paid me in counterfeit US dollars and drove off with my console table, mirror and television.
I trusted the uniform without question.
He got me good.
Fast forward to 2026. I am moving again, listing a few pieces of furniture on an online marketplace, right in the middle of an intensely busy workday. History seemed determined to repeat itself.
A buyer named Martha contacted me on WhatsApp, using the profile picture of a renowned United Nations official. After some back-and-forth messages about the furniture, the conversation took an interesting turn.
“We’ll activate your 999,000/= Mobile Money payout online once you clear the transfer fee of 89,000.”
Then came the fake SMS alerts, presumably intended to make the transaction look legitimate and create a sense of urgency.
This time, however, I didn’t fall for it.
I decided to run background checks on the numbers. My checks suggested that SIM-swap fraud was involved, and one of the numbers appeared to be registered to an actual UN employee whose identity I suspect had been hijacked.
I didn’t lose a shilling, just some precious time.
Reflecting on these two experiences, ten years apart, got me thinking about something beyond fraud prevention: What does this tell us about organisational change management?
Quite a lot, actually.
1. The tactics evolve, but the vulnerabilities remain
In 2015, the scam relied on authority bias. The military uniform created an impression of legitimacy and trustworthiness. I accepted what I saw without questioning it.
In 2026, the authority was digital. A familiar institutional identity, a convincing social media profile and what appeared to be official transaction notifications were used to establish credibility.
The tools had changed, but the underlying human vulnerabilities remained.
Organisations face a similar challenge when navigating change. New technologies, structures and processes are often introduced with the expectation that they will solve existing problems. Yet, if the underlying behaviours, assumptions and practices remain unchanged, the same problems can reappear in different forms.
Digitising a weak process does not make it a strong process. Introducing new systems without addressing the behaviours that undermine them simply transfers old problems into a new environment.
This is an important consideration for organisations undergoing digital transformation. Technology can improve efficiency and expand capabilities, but it cannot independently correct poor decision-making, weak accountability or an organisational culture that discourages questioning established practices.
The real work of change is not just changing the tools. It is changing the behaviours and assumptions that determine how those tools are used.
2. Trust must be supported by verification
Ten years ago, I trusted what I saw. Today, I am more deliberate about verification.
This brings to mind the Zero Trust principle in cybersecurity, which operates on the idea that trust should not be granted automatically, even when something or someone appears familiar or legitimate.
There is an interesting lesson here for organisational culture.
Trust is essential to effective organisations. It enables collaboration, encourages innovation and allows people to work towards shared objectives. However, trust should not come at the expense of accountability, sound processes and appropriate controls.
A healthy organisational culture does not require people to operate with suspicion. Rather, it creates an environment where decisions, transactions and processes can be questioned and verified without this being interpreted as a lack of trust.
This becomes particularly important during periods of organisational change, when familiar processes are being replaced, responsibilities are shifting and employees are learning to operate in new ways.
Leaders must help people move beyond the comfort of “we’ve always done it this way” and develop a culture of continuous improvement, accountability and constructive questioning.
Trust creates the foundation for collaboration. Verification provides the safeguards that protect it.
3. Cognitive overload is a risk vector
Something else stood out about the second incident: the timing.
I was in the middle of a demanding workday, juggling multiple priorities. The transaction was happening alongside other responsibilities, and the messages were coming in while my attention was divided.
It made me reflect on the relationship between cognitive overload and organisational risk.
When people are overwhelmed, fatigued or dealing with competing demands, their ability to process information, question assumptions and make sound decisions can be compromised.
This has significant implications for organisations managing change.
Employees are often expected to adopt new systems, learn new processes, adjust to new reporting structures and embrace different ways of working, all while maintaining their existing responsibilities.
The assumption is often that people will simply adapt.
But change requires mental and emotional capacity. It takes time to understand new expectations, develop new skills and become comfortable with unfamiliar ways of working.
When leaders underestimate this human dimension, they risk creating conditions in which mistakes, disengagement, resistance and poor decisions become more likely.
Change fatigue is not necessarily a sign that people dislike change. Sometimes, it is a sign that organisations are asking too much of people without adequately considering their capacity to absorb it.
Effective change management, therefore, is also about managing the human capacity to change.
This means paying attention to workload, communication, support, training and the pace at which change is introduced.
An organisation cannot expect people to embrace change effectively if it does not create the capacity for them to do so.
4. Post-mortems must lead to organisational learning
Perhaps the most significant difference between my 2015 and 2026 experiences was not that scammers had become more sophisticated. It was that I had changed how I responded.
The first experience taught me a difficult lesson about unquestioned trust. Over time, I adjusted my personal approach to transactions, becoming more cautious and deliberate about verification.
That is the essence of organisational learning.
Organisations, like individuals, accumulate experiences. Some are positive, others expose weaknesses in systems, processes, leadership or decision-making.
The important question is what happens afterwards.
A post-mortem is useful because it allows an organisation to examine what happened, identify what went wrong and understand why. However, its real value lies in whether those lessons influence future behaviour.
Do processes change where they have failed? Are controls strengthened? Are employees equipped with the knowledge and skills to recognise emerging risks? Are lessons incorporated into policies, systems and everyday practices?
Without these steps, organisations risk repeating the same mistakes under different circumstances.
Organisational learning requires more than remembering past experiences. It requires translating those experiences into improved capabilities, stronger processes and different ways of working.
Learning from change is important. Institutionalising the lessons is what makes that learning sustainable.
5. Leadership must anticipate the unintended consequences of change
There is one more lesson worth considering.
In both my experiences, the people behind the scams exploited the gap between what appeared legitimate and what could actually be trusted.
In organisations, leaders must be equally alert to the gaps that emerge when change is introduced.
A new technology may create efficiencies while introducing new security risks. A restructuring exercise may improve reporting lines while creating uncertainty about accountability. A new performance management system may improve measurement while unintentionally encouraging behaviours that undermine collaboration.
Every significant change has intended outcomes, but it can also produce unintended consequences.
This is why leadership during change must go beyond communicating the vision and overseeing implementation.
Leaders must continuously assess how change is affecting people, processes and organisational performance. They must create feedback mechanisms, listen to emerging concerns and be willing to adjust the approach when the evidence suggests that something is not working.
Change is rarely a perfectly linear process. The ability to recognise what is happening, learn and respond is just as important as the original plan.
The bigger lesson: Change must go deeper than the systems we introduce
My two encounters with fraud, ten years apart, left me with a simple but important observation: the world changes, the tools change and the tactics change, but the vulnerabilities we fail to address can remain remarkably persistent.
Organisations face the same challenge.
They invest in new technology, introduce new structures, redesign processes and develop new strategies. Yet, unless they also address the behaviours, assumptions, capabilities and cultural practices that shape how people work, the expected transformation may never fully materialise.
Change management is therefore not simply about introducing something new. It is about preparing people and organisations to function differently in an environment that is constantly evolving.
It requires leaders to question old assumptions, recognise emerging vulnerabilities, build new capabilities and reinforce behaviours that make organisations more resilient.
Perhaps the biggest lesson from my two encounters with fraud is this:
Change is not just about adopting what is new. It is also about recognising what needs to change within us so that we don’t keep reproducing the problems of the past in new environments.
And that, to me, is where meaningful organisational change begins.
What experiences have taught you that changing systems is not the same as changing behaviours? I’d be interested in hearing your perspective.
Leave a Reply