Whether the message claims to be from Safaricom, a recruiter or a "forex mentor", every scam eventually asks you to do something. Pay a fee, share a PIN or code, click a link, or log in somewhere. If you learn to spot that ask, you're already safer than most people.
The one question that beats most scams
Before you reply, ask: what is this message asking me to do?
Connect Media's list of common scam SMS patterns makes the same point. Each one ends in a request for a fee, an ID, a PIN, a link or a login. The story around the ask changes (a prize, a job, a police warning, a payment "by mistake"), but the ask doesn't.
If the answer is "send money", "give me a code" or "log in here", stop. Don't answer in the moment, and don't let the sender set the pace.
Scams that arrive through your phone
The "sent by mistake" message. You get a text that looks like an M-PESA confirmation. Then a call: "I sent you money by accident, please send it back." The text was fake, so you'd be sending your own money. Genuine messages come from "M-PESA" or "Safaricom", not from a random mobile number. Check your balance yourself, using your own phone's menu or app, before you do anything.
The fake Safaricom agent. Safaricom says it will never ask for your M-PESA PIN, passwords or personal details, whether in person, online or by phone. Its fraud page also warns against pressing any codes because someone claiming to be from Safaricom told you to. Doing so could block your line or send money to a fraudster.
SIM swap. According to one commercial guide (PesaMarket), criminals gather your personal details, then use a fake ID at a shop to request a replacement SIM. Your SIM stops working, theirs activates, and they can receive the codes sent to your number. Protect your ID details, and if your SIM stops working when you didn't expect it, contact Safaricom immediately from another phone.
Scams that promise you something
GASA's State of Scams in Kenya 2026 review reports the highest interaction levels with employment scams (40%), investment scams (39%) and unexpected-money scams (37%). It also says 86% of scam attempts happened on platforms with direct messaging. In other words, the bait usually arrives as a DM.
Fake jobs. Mctaba describes the pattern: you're asked to deposit KES 1,000–10,000 to "activate your account". After paying, you get nothing, or small payouts that never add up to the deposit. A real employer or client doesn't charge you to start work.
Investments, forex and crypto. K24 Digital describes Ponzi and high-yield platforms promising extraordinary returns, sometimes 100% within 40–45 days, paid for with money from newer investors. It also describes pump-and-dump groups, usually on Telegram or WhatsApp, that hype an obscure token and sell the moment ordinary people buy in. INTERPOL reports that in Kenya, victims were shown fabricated account statements.
So remember: a screen showing profit proves nothing. A dashboard is just a webpage someone built. The real test is whether you can withdraw your money. INTERPOL's Operation Red Card 2.0 (December 2025 to January 2026) targeted investment scams, mobile money fraud and fraudulent loan apps, and Kenya made 27 arrests linked to fraudulent investment schemes.
Unlicensed loan apps. The CBK publishes a directory of licensed digital credit providers, which Kenyans.co.ke reported was updated on 9 July. Check an app there before you borrow. Red flags reported by secondary sources include no CBK licence number, demands for full access to your contacts, threatening repayment messages, and calls to people in your contact list. On 14 July 2026, the CBK asked the public to report unregulated providers to dcps@centralbank.go.ke.
Fake sellers on real shopping sites. According to TransUnion research released on 9 June 2026, as reported by The Kenya Times, 39% of Kenyans who lost money to digital fraud in the past year were victims of third-party seller scams on legitimate shopping sites. A trusted platform doesn't make every seller trustworthy. We haven't seen the TransUnion report itself, so treat that figure as reported.
Why they work, and what AI changes
Most scams lean on the same tricks:
- Urgency: "Act now or your account closes."
- Borrowed authority: Safaricom, police, a bank, a government office.
- Polish: Logos, receipts and dashboards that look real.
The Communications Authority's cybersecurity report, prepared with KE-CIRT/CC, describes AI-enhanced phishing, fake login portals, deepfake videos and voice impersonation. It also says criminals disguised malware as legitimate AI tools. The CA blames limited public awareness of phishing and social engineering as one factor.
The practical lesson is that "it looks professional" is no longer evidence. Check who is asking, not how good the message looks.
Your everyday defences
- Never share your M-PESA PIN or any OTP. No genuine company needs it from you.
- Verify through channels you look up yourself. Don't use the number or link in the message. Find the official number or website independently.
- Treat unexpected DMs with suspicion, especially job offers, investment tips and "you've won" messages.
- Don't be rushed. Take ten minutes, and ask someone you trust.
- Be careful with links and logins. If a page asks you to sign in after you clicked a message, close it and go to the real site directly.
If you're a freelancer, this matters even more. A "client" who wants a deposit from you before work starts, or who sends a cheque-style overpayment story, is following the fake-job script. Real clients pay you, not the other way round. Our post on Freelancing as a Researcher covers how to build proof of your work, and legitimate proof never requires paying someone first. For the wider picture, see Why Digital Skills Are the New Literacy.
If you've been hit: the first hour
Speed matters. According to the Ministry of Cyber Affairs, a reversal only works while the money is still in the recipient's wallet. Once it's cashed out, there is usually nothing to recall.
- Contact Safaricom straight away if M-PESA is involved. Forward suspicious messages to 333, which is free (reported by The Star and The Kenya Times). You can also use the Safaricom app's report tab, or Zuri on WhatsApp (0722 000 100, per The Kenya Times). We've seen conflicting descriptions of how reversal requests work, so ask Safaricom directly rather than relying on a guide.
- Report the crime. The Ministry of Cyber Affairs lists the DCI cybercrime line as 0800 722 203 (toll-free). You can also go to any police station and ask for an OB number. That record helps if you later need to dispute a loss.
- Hacked account or technical incident? KE-CIRT/CC lists +254 703 042700 and +254 730 172700 in its report.
- Loan app problem? Email the CBK at dcps@centralbank.go.ke.
- Investment fraud? Report it to the police or DCI, and keep every message, receipt and screenshot.
Phone numbers and emails can change, so confirm them on the official Safaricom, DCI, CBK and KE-CIRT/CC sites if you can.
The habit to keep
You don't need to memorise every scam. The tactics keep changing, but the ending doesn't: someone wants your money, your code, your click or your login. Ask what the message wants you to do, verify it yourself, and when in doubt, don't act.