EXPLAINER: What you need to know about M-PESA fraud schemes

SIMCARDS/SCREENSHOT

Mobile money has transformed financial transactions, offering convenience and accessibility.

However, this convenience has seen a surge in fraudsters who use deceptive tactics to steal money and personal data.

From fake transaction messages to social engineering scams, many customers have in the past fallen victims.

Here are some of the common tricks used by these fraudsters to steal money.

Fake reversal instructions

Fraudsters are using a new trick to scam M-PESA users through fake reversal instructions.

In this scheme, scammers call unsuspecting customers and direct them to the nearest M-PESA agent.

They then ask the customer to hand over their phone to the agent, pretending to be Safaricom customer care.

Once in control, the fraudsters deceive the agent into making unauthorized transactions using the customer’s number.

Safaricom has warned that its customer care team will never ask customers to visit an agent for a reversal.

M-PESA reversals should only be initiated through official Safaricom channels.

To stay safe, always verify requests and avoid following suspicious instructions over the phone.

Fake/Old M-PESA messages

This is one of the most common scams targeting Safaricom users.

Fraudsters send a fake M-PESA message that appears genuine, but instead of displaying an actual balance, it shows LOCKED.

It is worth noting that a genuine M-PESA message is sent from M-PESA and not a customer’s line. 

To manipulate victims, scammers create an emotional story—often claiming they mistakenly sent the money intended for a critically ill relative’s medical treatment.

Out of sympathy, many users quickly send the money back without verifying.

Only after checking their balance do they realize no money was ever deposited—the message was fake, and they have been scammed.

Customers are advised not to call back or attempt to reverse the money. Instead, they should request the sender to forward the message to 456 or call Safaricom for assistance.

“Do not refund the money, instead request the sender to forward the message to 456 or call Safaricom for assistance,” says the company.

In case you receive such a fake message, you should also forward it to 333 to ensure the numbers are blocked and other customers may not be defrauded in future.

M-PESA USSD fraud

This is where fraudsters ask M-Pesa customers to follow certain instructions for sending money via USSD to a fraudster number.

USSD is a communication technology used to send a text between a mobile device and an application program in the network.

Fraudsters have gained expertise in intercepting mobile banking data during transmission.

This is easier for them as data is not encrypted when being transferred over the network.

Safaricom has a network system with built-in encryption mechanisms, encoding all data that passes through the network.

ATM fraud

This is an unlawful act whereby a person mischievously attempts to withdraw funds from another individual’s bank account via M-pesa.

With this type of scam, they manipulate you into authorising an ATM withdrawal from your M-Pesa account.

Many people do not know that, as well as the M-Pesa app and SIM Toolkit, you can use a USSD code to withdraw money from your M-Pesa mobile money wallet through a bank ATM.

To protect yourself from such kind of scams, Safaricom insists that you follow the ATM withdrawal instructions within the Safaricom app and only disclose the code used for withdrawal in the app.

You are also reminded to avoid divulging any other information such as one-time passcodes, ATM withdrawal codes, and authentication codes.

Another trick used by the scammers is where they pretend to be a security officer from Safaricom who is on an exercise to upgrade M-Pesa security.

They will typically say they are testing a feature that helps you to avoid accidentally sending money to the wrong person.

To many, the feature would be helpful since they have lost money after sending it to the wrong recipients.

This immediately puts your mind at ease and once that happens, they will ask you for your ID card number, last time a person made an M-Pesa transaction and the amount, last airtime top-up and amount, and your PIN.

Double registration is another trick

The fraudster will call you posing as a Safaricom customer care agent and claim your phone line was mistakenly registered to two different people and that they want to verify your information to be sure you are the original owner.

They will then ask for the same information they would need to successfully request a SIM swap, including your PIN and the last few transactions you did on your M-Pesa.

They will ask you to switch off your phone and switch it back on after some minutes, which is all they need to request the SIM swap and transfer money from your M-Pesa.