SIM Swap Fraud In Kenya: How To Protect Yourself (2026)

What a SIM swap actually is

A SIM swap is the moment your mobile number stops being yours. Someone presents themselves as you, asks an operator to move your number onto a new SIM card, and succeeds. Your handset drops to "no service" and every call, every SMS and every one-time password meant for you now arrives on a stranger's phone.

In Kenya that is not a telecoms inconvenience. It is a financial event. Your number is the login for M-Pesa, the recovery route for your bank app, the destination for the code that authorises a transfer, and the identity a dozen lenders use to decide whether to advance you money in ninety seconds. Whoever holds the SIM briefly holds a version of you that banks and lenders will believe.

There is a quieter variant worth naming. Fraudsters sometimes register an entirely new line using a copy of someone else's ID rather than taking over an existing number. Nothing goes dead on your phone, so you notice nothing at all, until a loan appears in your name months later.

Why your SIM is the key to your money

The reason a swap is so profitable in Kenya is how much sits behind the number. The Central Bank of Kenya raised the mobile money transaction limit to KSh 250,000 and the wallet ceiling to KSh 500,000 with effect from 15 August 2023, so a compromised wallet can now move serious sums in a single day rather than trickling out in small amounts.

Then there is credit. A takeover does not only reach the balance you have; it reaches the balance you could borrow. Overdraft facilities and app-based lenders assess a number's history and advance against it in seconds, which means a fraudster can leave you owing money you never received. To understand how those limits are built in the first place, our guide to Fuliza and our M-Shwari review explain the scoring logic a swap exploits.

Finally, the SIM is a reset key. Many banking and investment apps send a verification code by SMS as the fallback when a password is forgotten. Control of the number is therefore control of the fallback.

The law changed in 2025, and most guides still quote the old rules

This is where almost every article you will read on this subject is out of date, so it is worth being precise.

SIM registration in Kenya used to be governed by the Kenya Information and Communications (Registration of SIM Cards) Regulations, 2015. Those regulations were revoked. Regulation 22 of the Kenya Information and Communications (Registration of Telecommunications Service Subscribers) Regulations, 2025, published as Legal Notice No. 90 of 2025 and in force from 30 May 2025, expressly repeals them.

The practical differences matter to you.

Verification against a government database. Regulation 8(b) requires an operator to verify the documents and identification information presented by a person seeking registration against the relevant Government database. That is a materially stronger duty than existed before, and it is the provision to point to if a line was opened in your name on a forged or copied ID.

A much higher penalty. Regulation 20(2) sets a fine not exceeding one million shillings, or imprisonment not exceeding six months, or both. The KSh 300,000 figure quoted across most Kenyan coverage comes from the revoked 2015 rules.

A named complaint route. Regulation 18 lets a person who alleges that subscriber information is false lodge a complaint with the Communications Authority using Form 2. The Authority investigates within thirty days and notifies the operator, and the operator must give the subscriber an opportunity to be heard before deactivating a line. This is the formal mechanism for "someone registered a line using my ID".

A right of review and appeal. Under Regulation 21, a subscriber whose service is suspended may ask the operator to review the suspension. Where the review is upheld the operator must reactivate within forty-eight hours. Where it is rejected the operator must give reasons, and the subscriber may appeal to the Authority within thirty days. The operator must keep records of every review for at least two years.

One point of honesty. The 2025 regulations govern registration, transfer, suspension and complaints. They do not lay down a national procedure specifically for a replacement SIM issued on an existing number, with a mandated waiting period or a compulsory notification to the original holder. Those controls exist as operator policy, not as gazetted law. Do not assume a legal safety net that has not been written.

How fraudsters actually get a swap approved

Almost none of this is technically sophisticated. The common patterns are:

• Harvested personal data. Copies of ID documents circulate widely because Kenyans are asked to surrender them constantly, at building entrances, for job applications, for tenancy, for informal loans. A copy plus a few personal details is often the whole toolkit.
• Insider assistance. Registration runs through a very large agent network. A dishonest agent is the shortest path around any verification standard.
• Social engineering of you. A caller claiming to be from your operator, your bank or a government office asks you to confirm details "for verification", or to read back a code. Section 30 of the Computer Misuse and Cybercrimes Act 2018 makes this phishing, punishable by a fine of up to KSh 300,000 or three years' imprisonment. The deterrent has not stopped it.
• A deliberately awkward moment. Swaps are often timed for a Friday evening, a public holiday or the middle of the night, precisely because shops are closed and you react slowly. The same instinct shows up across Kenyan fraud, as our guide to spotting forex and crypto scams describes.

Never disclose a one-time password to anyone, including someone who says they are calling from your operator or your bank. A genuine institution does not need your code, because it generated it.

The warning sign people miss

The signal that matters most is boring, which is exactly why it gets ignored: your phone loses network for no reason and stays down.

If your handset shows no service, another phone on the same network in the same room works fine, and you have changed nothing, treat it as a swap until proved otherwise. Do not wait until morning. Do not assume it is a mast fault.

Other signs worth acting on:

• Transaction alerts for payments you did not make, or a balance that has moved.
• A message thanking you for a SIM replacement you never requested.
• A lender's welcome or repayment message for a loan you never took.
• Contacts saying you asked them for money, when you did not.
• Being unable to log into a banking app because "a code has been sent" to a phone that is receiving nothing.

How to lock down your line before anything happens

Prevention here is unglamorous and effective.

Put a PIN on the SIM itself. A SIM PIN, set in your handset's security settings, means the card cannot be used in another device without it. It is the cheapest control available and most Kenyans have never enabled it.

Move away from SMS as your only second factor. Where a bank, exchange or investment platform offers an authenticator app instead of an SMS code, take it. An authenticator lives on the device, not on the number, so a swap does not carry it away.

Use a different PIN for M-Pesa and for everything else, and never store PINs in your phone's notes or gallery.

Stop handing out ID copies casually. Where you must give one, write the purpose and the date across the copy. Under the Data Protection Act 2019 the person collecting it becomes a data controller with real obligations, and the Office of the Data Protection Commissioner can impose an administrative penalty of up to KSh 5,000,000 or 1% of annual turnover, whichever is lower.

Check periodically which lines are registered against your ID. Every major Kenyan operator offers a self-service check. Get the current code from your operator's own app, shop or published customer-care channel rather than from a forwarded message, because fake "verification" codes are themselves a scam.

Keep your registration details current. Regulation 11 of the 2025 regulations requires you to notify the operator of changes within thirty days, and requires the operator to update its records within seven. Stale details make an impostor's version of you easier to sell and yours harder to prove.

Read your statements. Small anomalies are only caught early if someone looks. Our guide to reading a Kenyan bank statement covers what to watch for, and managing money on M-Pesa covers keeping the wallet balance low enough that a bad hour is survivable.

The first hour if it happens

Speed is everything, because the loss is bounded by how long the fraudster holds the line.

1. Get to another phone immediately and call your mobile operator's fraud or customer-care line to report a suspected SIM swap and ask for the line to be blocked. Use the number published in the operator's own app or on its official channels, not one from a search result.
2. Call your bank's fraud line and freeze the accounts. Do this even if you have seen no transaction. Banks can place a hold far faster than they can reverse a transfer.
3. Change your email password first, from a device that is not the compromised phone. Email is the master key to everything else.
4. Go to an operator-owned shop with your original ID as soon as one opens and ask for the number to be restored. Insist the incident is logged as fraud, not as a routine replacement, and get a reference number.
5. Report to the police and obtain an OB number. You will need it for every claim, dispute and lender conversation afterwards. A SIM swap engages several offences under the Computer Misuse and Cybercrimes Act 2018, including identity theft under section 29 and computer fraud under section 26, which carries up to KSh 20,000,000 or ten years.
6. Write everything down with times: when service dropped, when you called, whom you spoke to, what reference you were given. That record is what turns an assertion into a case.

If money has already left the wallet, the reversal mechanics are the same as for any wrongly sent payment, and our guide on reversing an M-Pesa transaction explains what is and is not recoverable. If a payment simply failed or hung during the incident, what to do when a transfer fails covers that separately.

Fraudulent loans taken in your name

This is the damage that outlasts the money. Someone who holds your number for two hours can leave defaults that sit on your credit file for years.

Deal with it in order. Get the OB number and the operator's fraud reference first, because every lender will ask for both. Then write to each lender that advanced funds, state that the facility was obtained by fraud, and attach the police report. Then dispute the listing with the credit reference bureaus directly rather than waiting for the lender, since the bureaus run their own dispute process. Our guide to checking your credit score with a CRB sets out how to pull the report and lodge that dispute.

Be careful who you deal with in the aftermath. A common second wave is a "recovery agent" who offers to clear your name for a fee, and unlicensed lenders behave worst of all here. Our guides to spotting an unlicensed loan app and the CBK-licensed digital lenders list are the reference points for who is actually authorised to lend to you at all.

Be realistic about outcomes. Kenyan law gives you complaint, review and appeal routes, and the Central Bank's 2023 press release directs payment service providers to implement fraud risk mitigation and the speedy resolution of customer complaints. None of that is a guarantee of restitution. People do recover money and do get fraudulent listings removed, but it takes documentation and persistence, and some losses are never recovered. Anyone promising you a certain refund is selling something.

Your formal escalation routes

If the operator does not resolve it, you are not finished.

A false-registration complaint to the Communications Authority. If a line was registered using your identity, Regulation 18 gives you a complaint on Form 2. The Authority is required to investigate within thirty days and notify the operator, and the operator must hear the subscriber before deactivating the line.

A review, then an appeal. If your own service was suspended, Regulation 21 gives you a right to request a review from the operator. Upheld, and it must reactivate within forty-eight hours. Rejected, and it must give reasons, after which you may appeal to the Authority within thirty days.

A data protection complaint. If your ID copy was misused, or an operator, lender or agent handled it carelessly, the Office of the Data Protection Commissioner is the correct forum under the Data Protection Act 2019. Regulation 19 of the 2025 regulations separately requires operators to secure subscriber data in line with that Act and to verify the accuracy of their databases.

Your bank's complaints process, then its regulator. Escalate in writing, keep every reference number, and put the sequence of events in the first paragraph rather than the last. If you are choosing where to keep money after an incident like this, our bank account comparison and money transfer comparison are the starting points.

Frequently asked questions

Can a SIM swap happen without me giving anyone information? Yes. If someone holds a copy of your ID and enough personal detail, they may never need to contact you at all. That is why the network-drop warning sign matters so much: it may be the first thing you ever see.

Is a SIM PIN the same as my phone's screen lock? No. A screen lock protects the handset. A SIM PIN protects the SIM card itself, so the card cannot be used in a different phone without it. Set both; they defend against different attacks.

What is the penalty for SIM registration fraud in Kenya? Under Regulation 20(2) of the 2025 regulations, a fine of up to KSh 1,000,000, or imprisonment up to six months, or both. Separately, identity theft under section 29 of the Computer Misuse and Cybercrimes Act 2018 carries up to KSh 200,000 or three years, and computer fraud under section 26 up to KSh 20,000,000 or ten years. Articles still quoting KSh 300,000 are relying on regulations revoked in 2025.

Will my operator refund what was stolen? There is no legal guarantee that it will. You have complaint, review and appeal rights, and payment service providers are required by the Central Bank to resolve customer complaints promptly, but restitution depends on the facts and on how fast you reported. Report within minutes, not hours.

Someone opened a line using my ID. What do I do? Lodge a Form 2 complaint with the Communications Authority under Regulation 18; the Authority must investigate within thirty days. Report the identity misuse to the police for an OB number, and consider a parallel complaint to the Office of the Data Protection Commissioner about how your ID copy was obtained in the first place.

Does a swap put my SACCO or investment accounts at risk too? Any account that uses SMS codes for login or withdrawal approval is exposed, not just your wallet and bank app. Move to an authenticator app wherever the platform offers one, and check what recovery route each account actually uses before you need it.

Reviewed 3 September 2026 against Legal Notice No. 90 of 2025, the Computer Misuse and Cybercrimes Act 2018, the Data Protection Act 2019 and the Central Bank of Kenya's mobile money limit press release of 8 September 2023. Operator procedures, short codes and hotline numbers change; confirm those directly with your operator. This is general information, not financial advice.