Asked to pay a different Paybill or Till? Verify the change first

Treat a changed destination as a new decision

You are ready to settle a bill when a message arrives: the usual Paybill is unavailable, the Till has changed, or you should pay a different account today. The bill may be familiar, but the new destination still needs checking. Pause the transfer until you can independently confirm the change.

This checklist is for changed instructions, including an updated invoice or a follow-up message about an existing order. For the first payment to a business, start with our Paybill verification guide. If somebody claims they have already paid you, use our M-PESA message guide to check that separate question.

A familiar conversation is not independent confirmation

The FBI's Internet Crime Complaint Center describes business email compromise as a pattern in which legitimate business email accounts can be compromised to cause unauthorised transfers. It recommends confirming account changes through a secondary channel and checking the actual sender address. This is general fraud-prevention guidance, not evidence about a particular Kenyan merchant or a claim about how often Paybill changes are fraudulent.

Our practical recommendation is to apply a fresh verification step whenever a requested payment destination changes. A familiar logo, an old conversation thread or an accurate invoice amount should not settle the new question: did the intended recipient authorise this destination?

Write down exactly what changed

Compare the earlier instructions with the new ones. Is the change to the Paybill or Till number, the account reference, the amount, the named recipient, or several of these? Record the differences privately before contacting the organisation. You do not need to send money to collect this information.

Check whether the message asks you to skip a usual step, keep the change secret or meet an unexpected deadline. Those requests are reasons to pause and ask more questions, not proof that the organisation is involved in wrongdoing. A legitimate administrative change can still require careful confirmation.

Confirm through a contact you already trust

Use a previously verified contact or independently established official channel. Do not rely solely on the phone number or link supplied in the change request. Replying in the same thread asks the same channel to vouch for itself.

Ask specific questions: "Has the payment destination for this invoice changed? What exact business name and number should I expect? Does the account reference remain the same?" Read the details back and record who confirmed them, when and through which channel. For a business payment, ask a second authorised colleague to review the change before it is released.

If the organisation cannot be reached or gives conflicting answers, leave the payment pending. Tell the verified contact why you are waiting and ask for corrected written instructions. Do not let someone else operate your phone, dictate PIN entries or turn a payment check into a request for credentials.

Review the transaction you are actually authorising

Once the change is independently confirmed, compare the payment details presented by your usual payment channel with the confirmed instructions. Stop if you cannot understand or reconcile the displayed destination, reference or amount. Do not approve a prompt merely because someone says it will "verify" or "cancel" a payment.

Confirmation of a changed destination is not a guarantee of delivery or a general endorsement of the seller. If the wider offer still raises questions, return to the company verification checklist. Avoid making several unresolved questions disappear behind one reassuring answer.

If the payment has already gone through

Contact your payment provider or bank promptly through its official support route. Explain that you suspect altered payment instructions and ask what response is available. Keep the original message, invoice and transaction reference privately for that process. Do not assume that a second transfer will cancel the first, and do not pay a stranger who promises recovery.

Warn the intended organisation through the independently verified contact so it can check its own instructions and communications. Describe the discrepancy without deciding who caused it. A community report cannot reverse a payment, establish who controls an account or guarantee recovery.

Add a community check without exposing evidence

Search the proposed Paybill, Till, company or website on ScamBusterKE. Treat any matching reports as information to assess, not a verdict. An empty result does not make the changed instruction safe.

When submitting a report, explain the requested change and your experience in neutral language. Keep PINs, one-time codes, personal account references, full receipts and private correspondence out of the public description. Use the private evidence upload only for relevant, redacted supporting material.