How to check a website before paying in Kenya

Start with facts you can verify

An unfamiliar website can look polished, show a padlock, display reviews and use the name or logo of a real business. None of those details answers the full question: who operates the site, what exactly are they offering, where will your money and personal information go, and what can you do if the transaction goes wrong?

Use this checklist before paying, creating an account, uploading an ID or following instructions sent through WhatsApp, SMS, email or social media. The checks cannot guarantee that a future transaction will be safe. They can expose mismatches early and give you a clear reason to pause.

1. Preserve the exact address before you investigate

Copy the complete website address from the browser's address bar. Do not rely on the brand name printed on the page or the text of a link in a message. Record the page that contains the offer, the date, the price, the contact details and the payment instructions.

Read the domain from right to left. In payments.example.co.ke, the registered name is normally example.co.ke; words placed before it are subdomains. In example-ke-payments.com, the whole name is different. Look for substituted letters, extra hyphens, misspellings and an ending that does not match the organisation's known site.

Do not use a link in the suspicious message to verify itself. Find the organisation independently through a regulator, a document you already trust or a search result you inspect carefully. The Communications Authority of Kenya advises people to research unsolicited requests and use independently found official contacts when a message appears to come from a company.

2. Define the offer and the operator

Write down what the site says it will provide. Is it selling goods, taking a booking, offering a loan, recruiting for a job, managing an investment, collecting a government fee, or merely introducing you to another seller? Different activities require different checks and complaint routes.

Find the legal or business name in the terms, privacy notice, invoice and checkout page. Record any registration number, physical address, telephone number and email address. Compare those details across the site. A trading name can be legitimate, but you should be able to understand which legal person is responsible for the transaction.

If the site claims to represent a Kenyan company or business name, use the Business Registration Service's official search through eCitizen. BRS currently distinguishes a CR12 official search for companies from a CR13 official search for business names. Registration confirms a registry record; it does not by itself prove that the website, representative, regulated activity or payment request belongs to that entity.

For a regulated product, go one step further. Check the exact licence category and legal name in the responsible regulator's current register. A company registration is not a banking, lending, insurance, investment, recruitment or other sector licence.

3. Inspect the domain record, but do not turn age into a verdict

For common generic domains such as .com or .org, ICANN directs users to its RDAP-based Lookup service for public registration data. The result may show the creation date, registrar and technical status. Some registrant information may be hidden for privacy.

A domain created recently deserves extra checking when the website claims a long operating history. An older domain can also change owners or be compromised, so age is not proof of legitimacy. Hidden registration data is common and is not proof of wrongdoing. Treat domain information as one fact to compare with the business story, not as a pass-or-fail test.

HTTPS is also limited evidence. The padlock means the connection between your browser and that site is encrypted. It does not verify the seller's identity, product, refund promise or payment instructions. A harmful site can use HTTPS too.

4. Search every public identifier separately

Search the exact domain, legal name, trading name, phone number, email address, Paybill or Till number, and any app-store listing. Search the full identifier, not only the brand name. A copied website may use a real company's name while changing the domain or payment recipient.

Search those identifiers on ScamBusterKE and through a general search engine. Read dates and details, not only star ratings or snippets. The Competition Authority of Kenya notes that reviews can help consumers evaluate an online business but warns that bought or fake reviews can give an inaccurate picture.

Treat community reports and reviews as leads to investigate. One account may be mistaken, incomplete or about a different entity. No matching report does not prove safety, especially when a domain or payment identifier is new. Look for facts you can independently compare: delivery terms, recipient names, regulator records, repeated contact details and the site's own promises.

5. Read the terms before the checkout screen

Find the total price, delivery time, refund or cancellation rules, return address, complaint process and the party responsible for fulfilment. Save a copy or screenshot of the terms that apply on the day you pay. If a marketplace or drop-shipper is involved, identify whether your contract is with the platform, an outside seller or both.

The Competition Authority of Kenya says online transactions can raise issues involving payment, returns, delivery and pricing, and that terms should provide a clear complaint-handling mechanism. Missing, contradictory or copied terms are reasons to ask questions before paying.

Compare the offer across the advert, product page, invoice and private messages. Pause if the price, delivery promise, refund rule or responsible seller changes when you reach WhatsApp or the payment step. A discount that disappears unless you pay immediately is not a reason to skip verification.

6. Share only the information the transaction needs

Before entering personal information, read the privacy notice. Ask why the site needs each field and whether the request is proportionate to the service. An ordinary retail purchase should not require your mobile-money PIN, email password, one-time code or remote access to your phone.

Kenya's Office of the Data Protection Commissioner says people have the right to be informed how their personal data will be used, to access it, to object to processing, and to seek correction or deletion of false or misleading data. It also states that organisations should collect data for explicit, specified and legitimate purposes and limit collection to what is necessary.

Do not upload an ID, selfie, bank statement or M-PESA record merely because a chat agent says it will “verify” you. First confirm the legal entity, the purpose, the privacy notice and a contact channel you found independently. Never share a PIN, password or one-time code.

7. Verify the payment route independently

At the M-PESA confirmation screen, compare the recipient name with the verified operator and invoice. For a Paybill, confirm both the business number and account-number format through a channel you found yourself. For a bank or card payment, compare the beneficiary or merchant with the legal entity responsible for the sale.

Stop if the website sends you to a personal number, unrelated business, replacement Till, crypto wallet or different account without a clear, independently verified explanation. Do not accept “the company account is down” as sufficient proof that a stranger's account is authorised.

A small first payment is not a guarantee. It may only show that one order or withdrawal was completed. Decide your maximum acceptable exposure before you start, and never send a second “unlock,” “insurance,” “clearance,” “tax” or “verification” payment simply because the first transfer is now at risk.

8. Use a stop rule, not a confidence score

Do not pay until these facts agree: 1. The exact domain matches a source you reached independently. 2. You can identify the legal operator and explain the offer. 3. Any business record and activity-specific licence match the same entity and service. 4. The advert, terms, invoice and delivery or withdrawal promise are consistent. 5. The site explains how it uses necessary personal data. 6. The payment recipient matches independently verified instructions. 7. You know who handles complaints and what records you will retain.

One unresolved mismatch is enough to pause. Verification is not a points game where five reassuring details cancel one unexplained recipient or domain.

9. If you already paid or shared information

Contact the bank, card issuer or mobile-money provider promptly and ask what protective or recovery steps are available. Change exposed passwords from a trusted device, enable multi-factor authentication where available, and contact the affected service through independently sourced details. If an ID or sensitive personal data may have been misused, keep a private timeline of what was shared and with whom.

Preserve the website address, advert, terms, order confirmation, receipt, payment recipient, messages and complaint attempts. Keep originals private. Do not publish an unredacted ID, bank statement, full M-PESA message, account number, password, PIN, one-time code or unrelated private conversation.

For a consumer problem involving false or misleading representations or unsuitable goods, the Competition Authority of Kenya publishes a consumer-complaint route. For a cybersecurity incident, the Communications Authority directs members of the public to the National KE-CIRT/CC. For misuse of personal data, use the ODPC's official complaint route. Start with the provider where appropriate and keep its response.

If you share a community report, describe what you personally experienced and list only public identifiers needed to connect the account. Do not declare that a person or business committed a crime. A report is a warning signal for review, not a finding of guilt.