Uganda Signup Spike Investigation

April 9-11, 2026 | Location Analysis & Fraud Rule Impact | Generated Apr 12, 2026

Peak Day Signups

1,767
Apr 10 | +168% vs baseline (~660/day)

3-Day Total (Apr 9-11)

4,388
vs 4,630 prior 7 days (2.2x daily rate)

Location Hashing Flags

236
3-day total | ~79/day vs baseline 14/day

s8p1t (Fido Agent Area)

97
3-day signups | 1.8x growth (in line)

Daily Signup Trend with Fraud Flags & s8p1t Area

Total Signups
Location Hashing Flagged
s8p1t Area Signups

Signup Heatmap by Geohash

<2x growth
2-3x growth
>3x growth
Fido Agent Area (s8p1t)
Fido Agent Area Analysis (s8p1tj / s8p1t)

The s8p1t geohash (Makindye/southern Kampala) saw 97 signups in the spike 3 days vs 128 in the prior 7 days. Daily rate went from 18.3/day to 32.3/day (1.8x growth). This is below the overall 2.2x growth rate, suggesting the Fido agent area is NOT disproportionately driving the spike. Growth within s8p1t is evenly distributed across all sub-areas (NW, NE, ME, etc.).

Geohash Breakdown - Top Areas

GeohashAreaSpike 3dPrior 7dPrior Avg/dSpike Avg/dGrowthFlag

s8p1t Sub-area Daily Signups (Fido Agent Zone)

Fraud Rule Trend (All Types)

Key Finding: Spike is Google Ads Driven, Not Location-Specific

The signup increase is broad-based across all Kampala geohashes with consistent 2-3x growth. Google Ads installs doubled (600 to 1,226/day). The location_hashing fraud rule spike is a mechanical consequence of higher density, not a fraud cluster. The Fido agent area (s8p1t) grew less than average.

Survey Similarity Analysis

Investigation into whether users in the same geohash had duplicate survey data (same address, email, position, DOB, reference phones, device+address combos) — checking for coordinated fraud farm patterns.

CheckCriteriaResultStatus
Duplicate Addresses 3+ users, same geohash, same address 1 case only (3 users in s8p4h: "hoima road, Nansana Division, Central") PASS
Duplicate Emails 2+ users, same geohash, same email 0 cases PASS
Same Position (job) 5+ users, same geohash, same position 0 cases PASS
Same Reference Phone 3+ users, same geohash, same ref1 phone 0 cases PASS
Same Device + Address 2+ users, same geohash, same device model & address 0 cases PASS
Same Birth Date Cluster 4+ users, same geohash, same DOB 0 cases PASS
No Coordinated Fraud Patterns Detected

No coordinated fraud patterns detected in survey data. The spike users show unique addresses, emails, birth dates, and reference contacts — consistent with genuine organic users, not a fraud farm.

Traffic Source Analysis

Source: UG_PROD.SEMANTIC_LAYER.DT_GOOGLE_ADS_CONVERSIONS

Daily Signups by Traffic Source (Apr 1-10)

(null/unattributed)
UAC - L0 Master Signals Aggressive
UAC UG Biz - FS250 & Repay
UAC - In-app L0 no CG
(direct)
UAC - In-app L0 NEW
UAC - L0 no CG DR Top
Other (fb/ig/partners)

Note: Apr 11 omitted from chart due to attribution lag — only unattributed signups show. Final numbers will backfill.

Fastest-Growing Source: (direct) Traffic Exploded

(direct) traffic surged from a baseline of ~136/day (Apr 1-5) to 523/day (Apr 9-10) — a 3.9x increase, the highest growth rate of any traffic source. This suggests organic/Play Store discovery is amplifying the paid campaign spike.

Funnel Conversion Over Time (Apr 1-10)

Signups
Survey Completed
KYC Verified
L0 Disbursed

Traffic Source Comparison: Baseline vs Spike

Baseline = Apr 1-5 daily average | Spike = Apr 9-10 daily average

Traffic SourceBaseline Avg/dSpike Avg/dGrowthSpike Share
(null/unattributed) 541 1,195 2.2x 29%
UAC - L0 Master Signals Aggressive 440 1,000 2.3x 24%
UAC UG Biz - FS250 & Repay 426 739 1.7x 18%
(direct) 136 523 3.9x 13%
UAC - In-app L0 no CG 176 332 1.9x 8%
UAC - In-app L0 NEW 65 219 3.3x 5%
UAC - L0 no CG DR Top 42 82 1.9x 2%
Other (fb/ig/partners) 37 54 1.4x 1%

Note: Apr 11 excluded due to attribution lag — all signups show as unattributed on Apr 11.