How Hubtel built a secure payment platform that processed over GHS 88M across 100,000+ verified recipients in two months 

Before Hubtel: 

A payroll with no way to confirm who it was paying 

When a payment system processes thousands of transactions every month, the question that matters most is not whether the money moved. It is whether it moved to the right person. For an organisation running a large-scale payroll system, that question had gone unanswered for years, and the cost of leaving it unanswered had been significant. 

The system managing these payments ran on submitted lists of eligible beneficiaries. Names came in from various sources into payroll, and at the end of each cycle, money was paid to these individuals. There was no step in that process to confirm that the person on the list was a real person, that they were the right people collecting the funds, or that the account receiving the money belonged to them. 

The result of that gap was costly. Between 2018 and 2024, approximately GHS 548 million was lost to fraudulent entries and weak controls across the payment system. People with unchecked access to the central database could include names that had no legitimate claim to the funds. External contractors managing the system could modify records without formal approval. The list of beneficiaries came in as documents and spreadsheets, and there was no mechanism to catch an entry that should not have been there before the money went out. 

On the administrative side, there was no single record that could show who had been paid, where the funds had gone, or who had authorised each transaction. When questions arose about a payment, the answers required manual effort across disconnected records and still did not always produce a complete picture. 

The problem was not that the payments were wrong. The problem was that nothing in the system confirmed the right person was the one collecting them. 

Bringing Clarity: 

Building a system that knows who it is paying prior to disbursement 

Hubtel was brought in to rebuild the payroll system with identity verification at its foundation. The starting point was a simple principle: before any payment moves, the person claiming it must prove they are who the payroll says they are. 

To do that, Hubtel connected the system to Ghana’s National Identification Authority, which holds a biometric record for every registered Ghana Card holder, including a photograph taken at registration. This connection is the core of how the new system works. 

When a beneficiary logs into their portal to access their payment, the system asks for their Ghana Card number and take a live photograph of themself. That photograph is compared in real time against the image held in the NIA database. If the faces match, access is granted. If they do not match, access is denied. No human reviews the check, and no manual override exists in this new system. 

The second layer of verification applies at the point of transfer. A beneficiary can only move their money to a bank account or mobile money account registered in the same name as their Ghana Card. The money cannot be sent to a relative, a colleague, or any third party. It goes only to an account that belongs to the verified individual. Since bank and mobile money accounts in Ghana now require Ghana Card details to open, this name-matching step closes the last gap in the chain. 

On the management side, Hubtel built an admin portal that gives the institution overseeing the payroll a full view of the entire operation in real time. Every beneficiary’s record is visible, including their Ghana Card details, their allocated payment, whether they have been paid, and if they have moved their funds, the account name and number they moved it to. Nothing in the disbursement process is unrecorded. 

Hubtel integrated APIs so that funds move directly from the payroll system into recipients’ verified accounts and refreshed the organisation’s public-facing website. 

The full set of components Hubtel built: 

Putting Management in Control: 

A complete record of every payment, visible at any time 

The most immediate change the new system brought was not in how the money moved. It was in who could see where it was going 

Before the platform, tracking a disbursement required pulling information from multiple disconnected systems and reconciling it manually. There was no single place to look up whether eligible beneficiaries had received their payment, whether they had withdrawn it, or what account it had gone to. 

The current admin portal changes that. Every transaction in the system carries a full record: who has been paid, their Ghana Card details, the amount they were allocated, whether the biometric check passed, the transfer instruction and the beneficiary account name. An administrator can look up any beneficiary, any transaction, or any disbursement and get the complete picture in seconds. 

The traceability also works as a control mechanism. Because the system records every step of the verification and transfer process, it is not possible for a transaction to be completed and then disputed without a record. A beneficiary who withdrew their money cannot claim otherwise. A transfer to an account that does not match the Ghana Card name cannot be completed in the first place. 

For the first time, the organisation has a transparent system that gives them every necessary information. The scale of what goes out each month, tens of millions of cedis to tens of thousands of people, now has a management system that can account for every cedis of it. 

Pursuing Growth: 

Two months in, GHS 88.5 million out, and a payroll that finally knows who it is paying 

The system went live and ran its first two disbursement cycles within the space of two months. These are the first payments in the history of this payroll system where every single disbursement was preceded by a live biometric identity check and followed by a name-verified transfer. 

In May, we processed payments of about GHS 55 million to over 77,000 beneficiaries and about GHS 33 million to 50,000 beneficiaries in June 

Figure 1: Disbursements by payment run 

The verification architecture also has an emerging role that will become clearer over time. When beneficiaries do not collect their money within a defined period, the organisation will issue a recall notice giving them a set number of days to claim the funds. Individuals who do not respond within that window will have their unclaimed payments returned to the institution. At that point, the system will be able to identify with certainty which unclaimed amounts belong to genuine beneficiaries who simply have not yet collected, and which are funds that nobody with a verified identity ever came to claim. That distinction is what will eventually allow the institution to measure how much the verification layer has reduced unauthorised claims on the system.  

The infrastructure is in place and operating. Every payment is accountable, verifiable, and fully traceable.