SIM Swap Fraud in Kenya: How It Happens and How to Protect Your M-Pesa

Picture this. It's a normal Tuesday evening. You're scrolling through WhatsApp when suddenly your phone shows "No Service." Odd, you think, maybe it's just network issues in your area. You restart the phone. Still nothing. An hour later, out of curiosity, you borrow a friend's phone to check your M-Pesa balance online, and your stomach drops. Your savings are gone. Every last shilling, moved out in a string of transactions you never made.

This is SIM swap fraud, and it's one of the most damaging forms of mobile money crime happening in Kenya right now. If you've never heard of it, or you've only heard the term in passing, this post will walk you through exactly how it works, why Kenya's heavy reliance on M-Pesa makes it such an attractive target for fraudsters, and what you can actually do to protect yourself.

What Is a SIM Swap, Really?

A SIM swap happens when a fraudster convinces your mobile network, or an agent working for it, to deactivate your original SIM card and issue a new one linked to your phone number, but in their possession. Once that new SIM is active, your old one goes dead, and every call, SMS, and one-time password (OTP) meant for you now lands in the fraudster's hands.

Since M-Pesa, banking apps, and most two-factor authentication in Kenya rely on your phone number, whoever controls your SIM effectively controls your financial identity. They can reset your M-Pesa PIN, log into mobile banking, and drain accounts in minutes, often before you even realize your phone has gone silent.

How SIM Swap Fraud Happens in Kenya

Fraudsters rarely "hack" anything in the technical sense. Most SIM swaps succeed through social engineering, meaning they trick people rather than machines. Here's the typical playbook seen across Safaricom, Airtel Kenya, and Telkom Kenya networks:

1. Information gathering. The fraudster collects your personal details, ID number, full names, date of birth, and sometimes your M-Pesa transaction history, through phishing SMS, fake customer care calls, social media snooping, or an inside contact at a telecom agent shop.

2. Impersonation. Armed with your details, they visit a SIM registration agent or call the telco's customer care, claiming they've lost their phone or SIM, and request a replacement.

3. The swap. If the agent isn't thorough enough, or is complicit, the swap goes through. Your line is transferred to their SIM.

4. The drain. Within minutes, they reset your M-Pesa PIN using the "forgot PIN" OTP flow, log into your bank's mobile app, and move money out through PayBill payments, agent withdrawals, or transfers to other lines.

Lost or stolen national ID cards are one of the biggest entry points here. A found or stolen ID gives a fraudster everything needed to walk into an agent shop and convincingly claim to be you.

A Real-World Case Scenario

Let's call her Jane, a small business owner in Nairobi. Jane lost her wallet, ID card included, during a matatu commute. She reported the ID lost at Huduma Centre a week later, once she got around to it, but didn't think to alert her telco in the meantime.

Three days after losing the ID, a woman walked into a Safaricom agent shop, presented Jane's ID (or a forged copy with his photo), and requested a SIM replacement, claiming her phone had been stolen. The agent, under pressure to serve a long queue, didn't run the usual verification questions thoroughly. The swap went through.

Jane's phone lost signal that evening. She assumed it was a network issue and went to bed. By morning, over KSh 180,000 in business savings had moved out of her M-Pesa and paybill-linked bank account through a series of transactions to unfamiliar tills and lines.

The lesson from Jane's story isn't just "be careful with your ID." It's that the gap between losing your ID and reporting it everywhere that matters is exactly where fraudsters strike. Reporting to Huduma Centre alone isn't enough. Your telco needs to know too.

This kind of case isn't hypothetical. In a real ruling that made headlines in Kenya in mid-2026, a DTB customer named Mercy Wairimu Kariuki had her Safaricom line swapped in February 2022. She noticed the loss of signal and reported it to Safaricom the same day, and her line was restored the next day. Even so, fraudsters had already used the window to drain KES 4,418,601 from her bank account over the following three days, moving money through mobile banking transfers and Pesalink in amounts structured to stay under the bank's daily limits. In June 2026, the High Court in Machakos upheld a ruling ordering Safaricom to pay 60% of her losses (about KES 2.63 million) and DTB to pay the remaining 40%, finding that both companies had breached their duty of care to her. The court also rejected the bank's argument that a correctly entered PIN was enough to prove the transactions were legitimate. It's a strong signal that acting fast and keeping a paper trail with your telco and bank can matter later, even if it doesn't stop the loss in the moment.

Major Telcos in Kenya and Their SIM Swap Safeguards

Kenya's mobile money ecosystem runs mainly through three players:

• Safaricom, the dominant operator and the home of M-Pesa, handles roughly 28,000 SIM swap requests daily and has invested heavily in fraud detection, pushing confirmed fraud cases down to about 40 in every 750,000 swaps. The telco has rolled out a temporary hold on M-Pesa transactions right after any SIM replacement, a self-service line protection feature you can activate by dialling *100*100# (which locks your line so it can only be swapped in person, ID in hand), and Jitambulishe, a voice-biometrics enrollment option customers can use as an extra identity check. Even so, Safaricom's own data shows SIM swap investigations jumped 327% in 2025, from 11 to 47 recorded cases, and in early July 2026 police arrested eight suspects in Marsabit County over a SIM swap scheme that cost an M-Pesa agent over KSh 1.2 million.

• Airtel Kenya runs Airtel Money and has its own SIM replacement verification process, though M-Pesa's dominance makes Safaricom lines the more common fraud target.

• Telkom Kenya, operator of T-Kash, follows similar SIM re-registration protocols, requiring ID verification at agent shops.

Kenyan courts are also increasingly holding both banks and telcos accountable when SIM swap fraud succeeds. As the Mercy Kariuki case above shows, a correct PIN is no longer treated as proof that a transaction was legitimate if the pattern looks obviously suspicious, and both the telco and the bank can be found to have failed in their duty of care. That's good news for victims seeking redress, but it doesn't undo the stress, and sometimes the money, lost while a case works through court. Prevention still beats compensation.

Safaricom has also been running an active public-awareness campaign in July 2026, warning customers about specific scam scripts making the rounds: callers falsely claiming your SIM has been "registered twice" and asking for your PIN to "verify" it, SMS messages threatening to suspend your line unless you click a link, fake promotional texts promising cash prizes, and unofficial links claiming to raise your Fuliza limit. Safaricom is explicit that it never asks for your PIN, ID details, or one-time passwords by call, text, or social media, so treat any such request as fraud, full stop.

How to Prevent SIM Swap and M-Pesa Fraud

Here's a practical checklist, especially useful if you've ever misplaced your ID, phone, or SIM:

1. Report a lost ID immediately, everywhere it matters. Don't just report at Huduma Centre or the police station. Call or visit your telco (Safaricom, Airtel, or Telkom) and ask them to flag your account and confirm that no SIM swap or new line has been registered against your ID number. This single step would have saved Jane thousands of shillings.

2. Activate SIM/line protection. On Safaricom, dial *100*100# to set up line protection, which requires you to confirm any SIM swap request before it's processed.

3. Never share your PIN, OTP, or ID photos over calls, SMS, or WhatsApp. No genuine agent from Safaricom, your bank, or M-Pesa will ever ask for your PIN or OTP. Be especially alert to calls claiming your SIM has been "registered twice" and asking you to "verify" it with your PIN, this is a known active scam script in 2026. Treat every unsolicited request for your PIN or OTP as fraud, no exceptions.

4. Watch for sudden loss of network signal. If your phone shows "No Service" or "Emergency Calls Only" for no clear reason, don't assume it's a network glitch. Use another phone to call your telco's customer care line right away (Safaricom's line is 333) and ask if a SIM swap was recently processed on your number.

5. Set up M-Pesa and bank transaction alerts on a secondary channel. Where possible, link a secondary email or app-based notification for your bank account so you're not solely reliant on SMS alerts to the compromised line.

6. Use strong, unique PINs. Avoid obvious combinations like your birth year or repeated digits. A predictable PIN makes a fraudster's job easier even without a full SIM swap.

7. Be cautious with agents and shared queues. When registering or replacing a SIM, make sure the agent asks proper verification questions. If they don't, that's a red flag, not a convenience.

8. Freeze mobile money access if you suspect a swap. Safaricom, Airtel, and Telkom can all suspend a line and its linked mobile money wallet on request. Do this the moment you suspect fraud, even before you're 100% sure.

The Bigger Picture

SIM swap fraud thrives in the gap between convenience and caution. Kenya's mobile money system has transformed how people transact, but it also means your phone number has become the master key to your financial life. The scale of the problem is real: Central Bank of Kenya figures put mobile banking fraud losses at KES 810.68 million in 2024 alone, a 344% jump, out of KES 1.59 billion in total banking fraud losses that year. Telcos are getting better at closing the loopholes, but fraudsters adapt just as fast, which is why personal vigilance still matters more than any single security feature.

If you've recently lost your phone, ID, or SIM, don't wait. Report it to your telco today, activate line protection, and keep a close eye on your M-Pesa statement for the next few weeks. A five-minute phone call to customer care is a small price compared to what Jane lost in a single night.

For more practical guides on keeping your phone and mobile life secure, browse our Tech News section for the latest tips, or get in touch with our team through the Contact page if you have questions about securing a new device. You can also check our FAQ for common questions on phone setup and security when buying a new smartphone from us.