If someone in your family in Kenya uses M-PESA, send them this page.
Three tricks are running on M-PESA right now. Each one is built for the person who trusts a text message and answers an unknown call. Each one starts with something that sounds small and helpful, and moves the money before anyone thinks to check.
1. “You sent me money by mistake, please send it back”
A message arrives that looks exactly like the M-PESA “you have received KES X from…” SMS. A few minutes later a call comes in. A polite voice, urgent, sometimes shaking: I sent that to the wrong number by mistake, please send it back to me.
The message was fake. The sender was not M-PESA. No money ever arrived.
Real M-PESA messages always come from the sender name “MPESA”. They never come from a normal phone number. That is the first tell.
What to tell your family in Kenya. Before returning any money that was “sent by mistake”, dial *334# and read the real M-PESA balance. If the money is not there, the message was fake. Do not send anything back. Report the number that called and the fake message to Safaricom by SMS to 333.
2. “Please add me as Shiriki Pay, it will help you too”
Shiriki Pay is a real M-PESA feature. It lets you name a trusted person, usually a family member, who can carry out transactions on your account for you. Useful for the daughter abroad who handles everything remotely, or the sister who helps mum with airtime.
The scam is small and quiet. A stranger, or someone who feels close but is not close, asks to be added. The chat may start in a church group, a WhatsApp bundle, or with a new online friend. Once they are added as a beneficiary, they can move money out of the account.
Safaricom’s own advisory, posted on 17 July 2026, said it plainly: fraudsters may start with a friendly conversation before asking you to add them as a Shiriki Pay beneficiary. A beneficiary should only be someone you know and trust.
What to tell your family in Kenya. Never add anyone as a Shiriki Pay beneficiary unless it is a close family member. If the request comes from a group chat, a new friend, or a “helpful stranger”, say no. To see who is currently added to the account, dial *334#.
3. “This is Safaricom. Your line will be deactivated. Enter this code to keep it”
A person calls. Calm and official. Sometimes Kiswahili, sometimes English. They know your name. They may even mention your last M-PESA transaction. They tell you your line is at risk, or your account has been flagged, and you need to enter a code to protect it.
The code they read out is a real M-PESA transaction code. Entering your PIN at the end sends your money to them.
Two rules spot this call every time.
- A genuine Safaricom call to a customer comes from
0722 000 000. Any other number is not Safaricom, however convincing the voice. - Safaricom will never ask for your M-PESA PIN. Not by phone, not by SMS, not on WhatsApp, not in an agent’s shop. Nobody except you should ever type it.
What to tell your family in Kenya. If a caller asks for the PIN, or asks the person to enter a code the caller reads out, hang up. Call Safaricom back on 100 (prepaid) or 200 (post-paid) to check.
While your family is thinking about it, ask them to dial *100*100# once. This is Safaricom’s SIM lock, launched in 2026. It stops anyone from replacing your SIM at an agent without your confirmation. A stolen SIM is how a fraudster receives all the codes that empty an M-PESA account and any linked bank account. Locking it takes two minutes and it is worth doing once for anyone who uses M-PESA daily.
What to send your family
Short enough to fit in one WhatsApp message:
Mum, three things about M-PESA in Kenya right now:
- If a stranger says they sent you money by mistake and asks for it back, dial
*334#first. If the money is not in your real balance, the message was fake. Do not send anything.- Never add anyone as Shiriki Pay unless it is close family. If asked, say no.
- If someone calls saying they are from Safaricom and asks for your PIN or asks you to enter a code, hang up. Real Safaricom never asks for the PIN.
To report a fraud, SMS the number to
333. To call Safaricom, dial234from your Safaricom line, or0722 002 234from another line. Once, please dial*100*100#to lock your SIM against a swap.
What Safaricom will and will not give back
This is the part nobody in Kenya says out loud. Here is the plain shape of it in August 2026.
For years, if your PIN was entered, Safaricom’s position was that the transaction was authorised and the loss was yours. A lot of people got nothing back.
That is starting to change. In June 2026 the High Court ruled, in a SIM-swap case, that a bank and Safaricom cannot hide behind the fact that a customer’s PIN was entered when the pattern of transactions was obviously suspicious. Safaricom and Diamond Trust Bank were ordered to share a KES 4.4 million loss (about £26,000) with the customer, 60 percent to Safaricom and 40 percent to the bank. In July 2026 the High Court also cleared the way for a class-action case brought by a fraud victim whose account was drained of KES 125,658 (about £740) to be heard in full. That second case is not decided yet.
What this means in practice: recovery is no longer hopeless, but it is not routine. What buys the best chance is speed. Report the fraud by SMS to 333 in the first minutes. Then call Safaricom on 234 from a Safaricom line, or 0722 002 234 from another line. Then go to a police station for an OB (Occurrence Book) number, and take that number and an ID to a Safaricom shop. Safaricom’s fraud team usually works a case in 3 to 5 working days.
Do not wait until morning. In the first 5 to 15 minutes the fraudster’s line is most likely to be blocked before the money is cashed out and gone.