How to report M-PESA fraud and scams in Kenya

Report suspected M-PESA fraud to Safaricom first

For a suspicious Safaricom or M-PESA request, Safaricom identifies 333 as its fraud SMS reporting line and *234# as another reporting route in its own public guidance. Include the telephone number that initiated the request and keep the original message. Do not include your PIN or one-time password in a report.

If money has left your account, or you think someone controls your line, contact Safaricom through support in the official app or a Safaricom shop promptly. Explain whether this is an unfamiliar transaction, a payment you made after being misled, or a mistaken payment. Ask what account-protection and transaction-review steps are available for your case, and keep the reference you receive.

Do not wait for a community report to be approved before contacting the provider. A fraud report is not a confirmed reversal, and reporting does not guarantee a refund. If a bank account is involved, contact that bank through a channel you find independently as well.

If someone offers to fix or upgrade your line

In a July 2026 notice, DCI said it had arrested eight suspects after an alleged SIM-swap incident affecting an M-PESA operator in Marsabit. DCI said investigations were continuing, so the arrests were not findings of guilt. Its practical warning was not to hand a SIM card, mobile phone or M-PESA handset to a customer, particularly when a group creates distractions or someone insists on handling the device.

Verify an unexpected support visit or call independently before handing over a handset or SIM. Stop following instructions from the person you suspect. Safaricom says its customer calls come from 0722000000 and warns customers not to dial codes on a stranger's instructions. Do not approve an unexpected payment prompt, share a PIN or OTP, or pay an extra fee to someone promising to recover your money.

If your line unexpectedly stops working during a suspicious interaction, use another phone or visit the provider to seek help. A service interruption alone does not prove a SIM swap; explain what you observed and ask the provider to check.

Contact DCI for suspected crime

DCI's official contact page lists the toll-free number 0800 722 203 and regional offices. Its July 2026 notice also lists WhatsApp 0709 570 000 for anonymous reports. Use those published contacts or a police station to report suspected theft, threats or identity misuse. Explain the events in order and ask how to submit supporting records securely and follow up on your report.

Provider support and criminal reporting serve different purposes. Keep the provider reference and any police reference separately so you can follow up with the right organisation. ScamBusterKE cannot open a police case, freeze an account or reverse an M-PESA payment for you.

Prepare a private record of what happened

Write a short timeline: when the contact started, what was offered or requested, the payment date and amount if any, and what happened after payment. Preserve original messages, receipts and the exact website or payment identifier in your own secure records. Note which facts you saw yourself and which were claims made by the other party.

Give transaction references and identity documents only through a verified provider or authority channel when needed. Do not post full receipts, account balances, ID numbers, home addresses or unrelated conversations in a public warning. Keep an untouched original privately and make a separate redacted copy if supporting material is needed.

Add a factual community warning without exposing evidence

Search the actual phone number, Paybill, Till, website or company name on ScamBusterKE, then use the report form to describe your own experience. No report does not prove a number or offer is safe. Existing community reports describe what people report; they are not a legal finding against a person or business.

A useful public description says what you were asked to do, what you paid if applicable, and what happened next. For example: ‘After I paid for the advertised item, the promised delivery did not arrive and my follow-up messages were unanswered.’ Add relevant dates and the identifier in the appropriate fields, without guessing who owns it or making unsupported accusations.

Evidence uploads are private supporting material for moderation. Public report text is separate: do not paste private evidence, PINs, OTPs, full transaction codes or identity documents into it. Redact unrelated personal details before uploading supporting screenshots, and never upload intimate images. A community warning helps others check before paying; it does not replace your provider or police report.