SIM Swap Fraud in Kenya: The Warning Sign Most People Ignore

Most financial fraud gives you a moment to think. SIM swap does not, and the reason is simple: by the time anything looks wrong, the attacker already controls the number your bank and your wallet use to identify you.

There is one warning sign, it arrives early, and almost everybody misreads it.

The warning sign

Your phone suddenly loses service for no reason you can explain.

No bars. No calls in or out. No SMS. You have not travelled, you have not run out of airtime, and nobody else around you is having trouble.

The natural reaction is to assume the network is down and wait. That assumption is what makes the fraud work. When a replacement SIM is issued for your number, your SIM stops working — that is not a side effect, it is the mechanism. The dead handset in your hand may be the only notice you get.

If your line goes silent without explanation, treat it as an emergency until proven otherwise. Waiting an hour to see if it fixes itself is exactly the hour the attacker needs.

Why the number is the target

Your phone number is not just a way to reach you. In Kenya it is close to being your financial identity:

• It is your M-Pesa account.
• It receives the one-time passwords your bank sends.
• It is the recovery route for your email, which is the recovery route for everything else.
• It authorises loan apps, wallets and payment confirmations.

Control the number and you control the confirmations. That is the whole attack: not breaking your PIN, but becoming the person the system sends the codes to.

How they get there

An attacker generally needs two things: your number, and enough personal detail to impersonate you convincingly.

The number is trivially available. The personal detail comes from somewhere more ordinary than people expect:

• Phishing — a message or call pretending to be customer care, a bank, a promotion, or a government service, collecting your details "for verification".
• Data exposed elsewhere — details you gave to some unrelated service that did not protect them.
• Your own public posts — full name, date of birth, workplace, family names, the answers to security questions.
• Social engineering of the people around the process, rather than of you.
• Documents you handed over casually — a copy of your ID left with someone who had no legitimate reason to keep it.

Notice that most of this is not technical. It is patience and plausible conversation.

Make yourself a hard target

None of these are difficult. Together they move you out of the easy category.

Never share your PIN or any code. With anyone. Ever. No legitimate Safaricom, bank or M-Pesa staff member will ask for your PIN or a one-time password. Anyone who does is, without exception, an attacker. This single rule defeats a large share of attempts.

Treat inbound calls as unverified. A caller who knows your name, your ID number and your last transaction has done homework, not proved identity. Hang up and call the official number yourself, from a number you looked up — not one they gave you.

Lock the SIM itself. A SIM PIN, requested when the SIM is inserted into a handset, is separate from your phone's screen lock and blunts an attacker who has the physical card.

Lock the phone, and lock the apps. A screen lock plus biometrics, and app-level locks on banking and wallet apps where available.

Choose an M-Pesa PIN that is not guessable. Not your birth year, not a repeated digit, not the year on your ID. And do not reuse it as your ATM PIN.

Reduce what you publish. Date of birth, mother's maiden name, workplace, ID images — every one of these is a security answer somewhere.

Do not install apps from links. Malicious apps requesting SMS permissions can read your one-time passwords without any SIM swap at all. Install from official stores, and question any app that wants access to your messages.

Keep your registration details current so the operator's own records match you rather than an old address or a lapsed document.

Check your statements. Not because it prevents anything, but because it shortens the time between a first small unauthorised transaction and you noticing. See how to manage money on M-Pesa.

If it is happening right now

Speed decides the outcome. In order:

1. Get to another phone immediately — a colleague's, a family member's, anyone's.
2. Call Safaricom and report that your line has gone dead and you suspect a SIM swap. Ask them to block the line.
3. Call your bank on its official number and ask for accounts to be frozen. Do this even if you have not yet seen a transaction — you are racing the attacker, not reacting to them.
4. Change the passwords on your email and any financial app, from a device you trust, and revoke sessions where you can.
5. Go to a Safaricom shop with your ID to recover the line properly.
6. Report to the police and get an OB number. You will need it for everything that follows.
7. Write down the timeline — when service died, when you called, who you spoke to, what reference you were given. Memory degrades and this record is what supports any claim.

Do not wait to see whether it resolves. Do not call a "help" number sent to you by SMS. Do not let embarrassment slow you down.

After the event

• Document the losses precisely — transactions, times, amounts, reference numbers.
• Follow up in writing with your bank and Safaricom, quoting your OB number, and keep copies. Verbal reports are hard to rely on later.
• Check for damage you have not thought of — loans taken in your name, changed beneficiary details, forwarding rules quietly added to your email. Fraudsters set up ways back in.
• If your personal data was misused, the Office of the Data Protection Commissioner takes complaints under the Data Protection Act 2019 — the channels are listed in debt collectors in Kenya.
• Expect a second approach. Someone will offer to recover your money for a fee. Nobody who contacts you unprompted can recover it, and paying them turns one loss into two — the same pattern described in how to spot a forex or crypto scam.

If you run a business on that number

The exposure is larger, and worth planning for deliberately.

If your business takes payments on a personal line, a SIM swap takes your business as well as your savings — the takings, the customer relationships, the number on your signage. Separating business collection from your personal wallet limits the blast radius and makes an incident survivable rather than existential. See paybill vs till vs Pochi la Biashara.

Two more habits worth building:

• Do not leave large balances sitting in the wallet. Settle to a bank account regularly. A wallet is for collecting, not for holding.
• Make sure someone else can act. If you are the only person who can report a compromised line, an incident while you are unreachable is worse than it needs to be.

The related tricks that need no SIM swap at all

SIM swap is the most complete version of the attack, but several cheaper variants achieve part of the same result, and recognising them protects you from both.

The "wrong number" reversal. A message claims money was sent to you in error and asks you to send it back. Nothing ever arrived. Always check your actual balance and statement, never the text of an SMS — see how to reverse a wrong M-Pesa transaction.

The fake agent call. Someone calls about a "failed transaction", a "system upgrade" or a "reversal we need to process", and walks you through steps that authorise a payment or reveal a code. The tell is always the same: at some point you are asked to enter something, read something out, or approve something.

The SMS-reading app. An app installed from a link, requesting permission to read your messages, harvests one-time passwords directly. No SIM needed. Question any app that wants access to SMS.

The screen-share. "Let me help you fix it" ends with someone watching you type your PIN. No legitimate support process requires remote access to your handset.

The agent-counter overlook. Shoulder-surfing at a busy agent, then a distraction. Shield the keypad, and never let anyone else operate your handset.

The common thread is that none of these break any technology. They rely on you acting quickly while someone plausible is talking. Slowing down is the defence — a genuine process survives you hanging up and calling back on a number you looked up yourself.

Frequently asked questions

What is SIM swap fraud? An attacker obtains a replacement SIM for your phone number, moving the number to their handset. They then receive your one-time passwords and can access mobile money and bank services that rely on that number.

How do I know if my SIM has been swapped? The characteristic sign is sudden, unexplained loss of mobile service — no calls, no SMS, no data — when there is no network problem and nothing has changed on your side.

What should I do first if I suspect a SIM swap? Use another phone immediately. Call Safaricom to report and block the line, then call your bank to freeze accounts. Do not wait to see if service returns.

Will Safaricom or my bank ever ask for my PIN? No. No legitimate staff member asks for your PIN or a one-time password. Any such request is fraud, however convincing the caller sounds.

Can I get my money back after a SIM swap? It depends heavily on speed and where the money went. Report to Safaricom, your bank and the police immediately, keep every reference number, and follow up in writing.

Does a SIM PIN actually help? Yes, as one layer. It is separate from your screen lock and protects against someone using the physical SIM card, though it does not stop a fraudulently issued replacement — which is why the service-loss warning sign still matters most.

Someone called saying they are from customer care and need to verify my details. Is that normal? Treat every inbound call as unverified. Hang up and call the official number you look up yourself. Knowing your details proves research, not identity.

Reviewed 29 August 2026. Describes the SIM swap mechanic and the practical response. Operator procedures for blocking and recovering a line are set by Safaricom and change — contact them directly. General information, not security or legal advice.