The second week began with a message that arrived at 9:04 in the morning. Pendo was receiving a routine chalk invoice when his phone made the sound of a new message. He saw the BEM logo, the words *fast verification*, and a request to send a six-digit code to “unlock the payment request.” Unlike on the first day, he did not put it in the group immediately. He printed it, wrote down the time, and placed it in a tray labelled **VERIFY BEFORE FORWARD**.
When Elias arrived, Pendo had already opened the callback directory. “I put it on HOLD,” he said. “But the code is here. It might be real.”
“What portal source have you seen?”
“Not yet. I saved a screenshot of the original and did not click the link.”
Ruth came in holding her phone. “Send the warning now. If we wait through every channel, someone will send the code.”
“The warning will go out, but it must contain facts we can show.”
Elias opened the BEM portal on the finance computer. The recruitment page carried that day’s notice: there was no school fee, no code for unlocking a payment, and all communication had to pass through the directory. He saved a dated screenshot and put the first incident ticket number in the warning draft’s header.
Pendo called the helpdesk. Leah answered after two rings. “BEM has not used a verification code for schools,” she said. “Send the message number through the ticket. Do not try to trace it by calling its number.”
Pendo asked, “How can we stop the others?”
“Tell them the official channel has rejected the code request. Don’t say you know the sender’s identity.”
Elias sent the draft to Ruth and Joseph. Ruth read it and asked them to add that a “fraud network” had tried. Elias said the words would be a conclusion. “We can say an unauthorised message requested a code. That is enough to stop people without inventing a villain.”
Ruth looked at him for a moment. “The minutes are passing.”
“That is why we began the process before the warning.”
Musa received the warning through the callback tree and called three heads he knew personally. He did not send a picture of the code. He said, “BEM has not confirmed it. Do not enter the code, do not transfer money, use the directory.” The head of Kijani asked whether this was a response to the first incident. Musa said the first ticket was the reference, but the new tactic had not been confirmed as coming from the same person.
Mwangaza received a call from a new number. The person on the other end identified himself as a BEM coordinator and said the deadline was five minutes away. Pendo took the call but did not give him the code. “Please send an official email with a reference.”
“Email is too slow. Go to the portal and enter the code.”
“We do not use a link or code from a forwarded request.”
The man hung up. Elias wrote down the time of the call and the words spoken, without claiming that the voice made him recognise anyone. Ruth wanted to call back, but Leah told them not to answer the sender’s number.
Four minutes later, a message from Upendo arrived. Its Head was about to send the code because he had been told three other schools had started. Musa called him on the verified line and asked him to open the portal himself. Upendo saw that there was no code request. The Head removed the code from his clipboard and wrote *STOPPED BEFORE PAYMENT*.
Elias read the entry and felt the weight of their first success. No money had been rescued by magic. One person had waited, another had called the right channel, and a third had written down the result.
Ruth posted the warning in the heads’ group: *BEM has confirmed through the directory helpdesk that it did not send a fast verification code. Please preserve the message, do not click the link, do not use the code, and follow the incident ticket.* She showed it to Elias before sending. She had left out the word *fraud* and included every fact.
“Is it right now?” she asked.
“Now a second person can read it and follow the trail.”
Pendo wrote in the verification register: time received, independent portal check, callback name, outcome, people warned. When he opened the sender’s account page, the business name had changed from *Mtoni Process Desk* to a blank symbol. No one had permission to say why, but the timing added pressure to their system.
Leah sent the final line of the ticket: “Keep preserving original messages; no official BEM fee or code was issued.” Elias saved it as evidence, then told Pendo not to delete the screenshot carrying the earlier name.
They went through the entire timeline in the register. The message arrived at 9:04. The portal check began at 9:06. Leah answered the callback at 9:08. The first warning went out at 9:10, and Upendo confirmed it had stopped the code at 9:14. Elias asked whether ten minutes was enough for other schools with slow internet. Pendo said the protocol used the people and phones already available; it did not require new software.
“If we call it ten minutes every time, someone will think it is a rule,” Ruth said.
“Ten minutes is today’s result. The rule is two channels and sufficient approval.”
Musa called from the Bahari office. He said one head wanted to forward the warning without the ticket because he was afraid of confusing the staff. Musa stopped him and said a warning without a source could create another panic. Elias sent the ticket reference, and Musa sent the verified message. They had learned that even a good warning could become noise if it did not include a place to check it.
Pendo sealed the message file in an envelope and marked it *second attempt—stopped before code/payment*. Joseph signed the review side, and Ruth added her initials to the callback line. No one wrote the word *victory*. They knew the person who had sent the request could change the name, the number, or the story again. What they could protect was the habit of waiting and the record of why they had waited.
When Elias asked Pendo whether he could do this without him, the clerk replied, “I’ll start with the portal, then call the directory. If I get stuck, I’ll write down what is stuck instead of clicking.” Ruth heard the answer and said verification was no longer Elias’s personal anger; it was shared work. That gave their day the meaning of a test, not a lucky event.
Two minutes after their warning, the number deleted its business picture and changed the account name.
---