Spotting M-Pesa and online scams: how they work, warning signs and what to do

Every day, Kenyans lose money to scams: fake M-Pesa messages, "wrong number" refund tricks, fake jobs, fake loans, fake investment schemes and impersonators on WhatsApp. Scammers are skilled at psychology: they create urgency, fear or excitement so you act before thinking. This unit explains the most common scams in detail, the warning signs they share, how to protect yourself and your family, and exactly what to do if you've been targeted.

Why scams work

Scammers rely on emotions:

Rule: when a message makes you feel rushed or emotional about money, stop and verify before doing anything.

Common M-Pesa and mobile money scams

1. The "wrong number" reversal scam

You receive a fake SMS that looks like an M-Pesa confirmation ("You have received KSh 4,500 from..."), followed by a call or message: "I sent money to you by mistake, please send it back."

The truth: no money arrived. The SMS was typed by the scammer from a normal number.

Protect yourself:

• Check your actual M-Pesa balance (via the M-Pesa menu or app), not the SMS.
• Real M-Pesa messages come from "MPESA", not a phone number.
• If someone genuinely sent money by mistake, they can request a reversal through Safaricom (the official process); you don't need to send anything yourself.

2. Fake customer care and "update your details"

Callers claim to be from Safaricom, a bank or M-Pesa, saying your line will be blocked unless you "update details", then ask for your PIN, ID number and codes, or tell you to dial codes that transfer money.

The truth: Safaricom's official customer care won't ask for your M-Pesa PIN. Never dial unknown codes on instruction.

3. Fake promotions and prizes

"Congratulations! Your number has won KSh 100,000 in the Safaricom promotion. Send KSh 1,500 to process your prize."

The truth: real promotions don't ask winners to pay fees. Verify only through official channels.

4. Fuliza/loan limit "boost" scams

"We can increase your Fuliza or loan limit. Pay a small fee." Limits are set by the provider's own systems; no agent can buy you a higher limit.

5. SIM swap fraud

Criminals get your number moved to their SIM, then receive your codes and access M-Pesa and bank apps. Warning sign: your phone suddenly loses service where it normally works. Call your provider immediately from another phone.

6. Fake till/paybill and "pay before delivery" sellers

Online sellers ask you to pay a till or send money before delivery, then disappear. Prefer pay on delivery, reputable marketplaces, or sellers you can verify (physical shop, reviews, trusted referral).

Fake jobs and recruitment scams

Rules: genuine employers don't charge you to get hired. For jobs abroad, use agencies licensed by the National Employment Authority (NEA) and verify on official lists. Check company websites, LinkedIn, and search "[company name] scam".

Fake investments, Ponzi and pyramid schemes

• "Invest KSh 10,000 and get KSh 15,000 in two weeks, guaranteed."
• "Forex account managers" who trade for you with fixed weekly profits.
• Crypto platforms showing growing "balances" you can't withdraw without paying "taxes" or "fees".
• Pyramid schemes where income comes mainly from recruiting new members.

The truth: guaranteed high returns are always a red flag. Early members may be paid with later members' money until it collapses. Check licences with the Capital Markets Authority (CMA) for investment firms and brokers, and the Central Bank of Kenya (CBK) for banks and digital credit providers. See the trading and investing lesson in the earning subject.

Online shopping scams

• Prices far below market (a new iPhone for KSh 30,000).
• Pages created recently with few posts, comments turned off, or copied photos.
• Pressure to pay a deposit immediately "because many people want it".
• Fake courier fees ("your parcel is held, pay clearance fee").

Protect yourself: pay on delivery or through trusted platforms; inspect items before paying; search the seller's name and number; reverse-image-search product photos.

Impersonation scams

WhatsApp account takeover

"Hi, I sent you a 6-digit code by mistake, please send it back." That code is your WhatsApp verification code: sharing it lets them take over your account and then scam your contacts.

Protect yourself: never share codes; turn on WhatsApp two-step verification (Settings → Account).

"Hi Mum, this is my new number"

A message pretending to be a child, relative or friend who "lost their phone" and urgently needs money.

Protect yourself: call the person on their known number or ask a question only they'd know.

Fake officials

Callers pretending to be police, KRA, a hospital, or a school demanding urgent payment (fines, "bail", hospital deposits for a relative "in an accident"). Hang up and verify through official numbers or by contacting the relative/institution directly.

Social media impersonation

Fake pages of celebrities, politicians, companies or government programmes ("Apply for the government youth fund here, pay KSh 500"). Check for verification badges, the official website, and official announcements.

Phishing links

SMS, email or WhatsApp messages with links to fake login pages ("Your HELB/KRA/bank account needs verification"). The page looks real and steals your login and codes.

Protect yourself: don't click; type the official address or use the official app; check the domain (.go.ke for government).

Universal warning signs

1. Urgency or threats ("now", "within 30 minutes", "or else").
2. Requests for PINs, passwords or one-time codes.
3. Payment before you receive anything (fees, deposits, "processing").
4. Too good to be true prizes, prices, salaries or returns.
5. Unofficial channels: personal numbers, Gmail addresses, Telegram for "official" business.
6. Pressure to keep it secret ("don't tell anyone, it's a special offer").
7. Unusual payment methods: sending to personal numbers, gift cards, crypto.
8. Spelling, odd language or slightly wrong names/logos (though modern scams can look very professional).

The 5-second checklist

Before you send money, share a code or click a link, ask:

1. Did I start this contact?
2. Am I being rushed?
3. Are they asking for a PIN, code or password?
4. Can I verify through an official channel I find myself?
5. Would a trusted friend think this is normal?

Think about it: You receive an SMS: "Confirmed. You have received Ksh 3,500.00 from JOHN KAMAU 0712xxxxxx..." Then a call: "Please, I sent you money by mistake for my child's school fees, send it back." What do you check, and what do you do?Show answer

Check your real M-Pesa balance in the M-Pesa menu or app, and look at who sent the SMS (real ones come from "MPESA", not a phone number). If no money arrived, it's a scam: don't send anything, block the number and report it. If money genuinely arrived, tell the caller to request a reversal through Safaricom's official process.

If you've been scammed

Act fast:

1. Call your mobile money provider or bank immediately to report the transaction and try to block or reverse it (for Safaricom M-Pesa, use the official customer care channels).
2. Change passwords and PINs if you shared them; secure your SIM (ask about SIM swap).
3. Report:
4. Forward scam SMS to 333 (Safaricom's scam reporting short code) where applicable.
5. Report to the police (nearest station) or the DCI (Directorate of Criminal Investigations), which handles cybercrime.
6. Report fake pages/accounts to the platform (Facebook, WhatsApp, TikTok).
7. For investment fraud, inform the CMA; for job scams abroad, the NEA.
8. Keep evidence: screenshots, numbers, transaction codes, dates.
9. Warn others: family, friends, groups.
10. Beware "recovery scams": people offering to recover your lost money for a fee are usually more scammers.
11. Don't blame yourself: scammers target everyone, including educated and careful people. Reporting helps stop them.

Protecting family members

• Elderly relatives: explain the "wrong number" and "fake customer care" scams; agree they'll call you before sending money to anyone unusual.
• Young people: warn about fake jobs, betting "tips", online "investment" groups and sextortion (threats to share intimate images: never pay; report and get help).
• Agree a family code word for real emergencies.
• Share this lesson in family WhatsApp groups.

Summary

• Scams use urgency, fear, greed, authority and helpfulness to make you act fast.
• Common M-Pesa scams: fake "wrong number" refunds, fake customer care asking for PINs, fake prizes, limit boosts, SIM swaps, fake sellers.
• Other scams: pay-to-work jobs, jobs abroad through unlicensed agents, Ponzi/forex "account managers", fake shops, WhatsApp code theft, "new number" family impersonation, fake officials, phishing links.
• Warning signs: urgency, requests for PINs/codes, pay-first, too good to be true, unofficial channels, secrecy.
• If scammed: contact your provider immediately, secure accounts, report (333, police/DCI, platforms, CMA/NEA), keep evidence, warn others, beware recovery scams.

Check yourself

1. What should you check after receiving an M-Pesa "wrong number" message? (two words: your actual ...)

   Show answer

   balance

2. Do real M-Pesa confirmation messages come from a phone number or from MPESA?

   Show answer

   MPESA

3. Will Safaricom customer care ask for your M-Pesa PIN? (yes or no)

   Show answer

   no

4. Which Safaricom short code receives scam SMS reports?

   Show answer

   333

5. Which body licenses agencies for jobs abroad? (abbreviation)

   Show answer

   NEA

6. Which regulator should you check for investment firms and brokers?

   Show answer

   CMA

7. Someone offers to recover your scammed money for a fee. What is this likely to be? (two words)

   Show answer

   recovery scam