Phone and SMS scams
Spoofed calls and SMS in Kenya: what to check before paying
How to spot spoofed bank, Safaricom, or DCI calls and messages in Kenya, protect your M-PESA account, and report suspicious contacts safely.
Quick check
Got a suspicious number, Paybill, Till, email, website, or company name? Search it before sending money.
A familiar caller ID is not proof of who is calling
A current Government warning reported by KBC says criminals can falsify the phone number or sender name shown on a device. A call or SMS can therefore appear to come from a bank, Safaricom, or the DCI even when it does not.
Treat the display name as a claim, not verification. If a caller says an account is under attack, end the call and contact the organisation through the number on its official website, app, card, or a statement you already trust.
Do not share the code that authorises the loss
Never disclose an M-PESA PIN, bank password, card details, SIM passcode, or one-time password during an incoming call or in reply to a message. A follow-up caller claiming to investigate the first contact does not make the request safer.
Unexpected links can lead to lookalike login pages. Open the provider's known app or type its official address yourself instead of using a link sent in an urgent message.
Read every M-PESA prompt before entering your PIN
K24 has reported on unsolicited payment prompts that arrive through the genuine M-PESA interface. The prompt itself may be real while the transaction was initiated by someone else, so its appearance does not mean you should approve it.
Check the amount, transaction type, recipient or business name, Paybill or Till, and whether you started the payment. Decline any prompt you did not initiate or cannot explain; entering your PIN authorises the displayed transaction.
Pause, verify, and preserve useful evidence
Take a screenshot only after hiding unrelated balances, OTPs, account numbers, ID details, and private conversations. Record the calling number, sender name, time, claimed organisation, requested action, and any destination phone, Paybill, Till, website, or email.
Report the attempt to the organisation being impersonated and your mobile operator through known official channels. If money has already moved, contact the provider or bank immediately and make an official report where appropriate.
Use community reports as a warning layer, not a guarantee
Search the phone number, Paybill, Till, company, website, or email on ScamBusterKE before paying. Existing evidence-backed reports can reveal a pattern, but no reports does not prove that a contact or payment request is safe.
If you add a report, describe the behaviour rather than making unsupported claims about a person's identity. Share only the identifier and redacted evidence needed to help others recognise the pattern.
Help someone check before they pay
Share this practical guide without making claims about any person or business.