If you suspect that your mobile line or M-PESA account has been compromised, contact Safaricom through its official guidance, keep records of what you observe and report, and report suspected fraud to police. If you shared personal banking details, contact your bank and change exposed online-account passwords immediately. Do not use a phone number, login link or instruction supplied by the suspicious message itself.
Reporting an account compromise and asking about an affected transaction are different tasks. Either may be necessary, but neither should be treated as a guarantee that money will be recovered.
What a SIM swap can enable
A subscriber identity module (SIM) swap occurs when a replacement SIM is issued for a mobile number. In a fraudulent swap, criminals may use personal information and impersonation to obtain that replacement and gain access linked to the number, including mobile-money and banking services. The Communications Authority of Kenya described this mechanism in a Kenyan SIM-swap advisory.
The advisory is useful for explaining the mechanism. It does not establish how common the fraud is now, how much victims lose or whether every attempted swap succeeds.
SIM-swap fraud is also different from ordinary phishing and from sending money to the wrong recipient:
- Possible SIM swap or line takeover: someone may have obtained control associated with your mobile number.
- Phishing or social engineering: someone pressures you to reveal a PIN, password or banking detail, or to use a false login page.
- Mistaken transfer: you authorised a payment but sent it to the wrong recipient.
- Account misuse: a transaction appears that you did not authorise, with or without obvious loss of mobile service.
These problems can overlap. Describing the problem accurately helps the operator or bank direct it to the right process.
Warning signs to take seriously
The Central Bank of Kenya fraud-safety guidance identifies warning signs such as unsolicited requests for personal identification numbers (PINs), passwords or banking details, false prizes, pressure and links asking you to log in. Unexpected loss of mobile service can justify checking with the operator, especially when it appears alongside account alerts or suspicious contact.
Loss of service does not prove that a fraudulent SIM swap occurred. Coverage, handset or account issues can also interrupt service. Normal service does not prove that every account is safe either. Treat the signs as reasons to verify through an official route, not as a diagnosis.
Useful observations to record include:
- when service changed and what the handset displayed;
- suspicious messages, calls, prompts or login pages;
- account alerts or transactions you do not recognise;
- information you disclosed and where you disclosed it;
- the time and route used for each report; and
- case or reference details supplied by the operator, bank or police.
Keep the original message or screenshot where practical. Do not continue interacting with a suspicious link merely to collect more evidence.
A short response sequence
On a narrow screen, focus this region and swipe horizontally to read every column.
| What you observe or shared | Use this route | Action and record |
|---|---|---|
| Lost service or suspected line takeover | Safaricom's official contact page | Report the line or M-PESA concern, follow identity checks and keep the case reference. |
| Banking details were shared | An independently located official bank route | Inform the bank immediately and change exposed online-account passwords from a trusted device. |
| An unrecognised or affected transaction | The operator or bank's current transaction process | Give the transaction reference and ask about the dispute or reversal separately from account security. |
| Suspected fraud | Police or DCI reporting information | Report suspected criminal activity and retain the report reference; this does not itself secure a line or reverse a payment. |
| Telecom complaint remains unresolved | Provider complaint process, then Communications Authority guidance | Keep the initial correspondence and references before using the escalation route. |
Contact the mobile operator through an official route
Use Safaricom's official consumer contact page to select a current route. If your handset or line is unavailable, use another working device or channel where practical. Explain whether you are reporting loss of service, a suspected line takeover, M-PESA account activity, an affected transaction, or more than one of these.
The official page is a route to the provider. It is not evidence that a line has already been secured or that a transaction will be recovered. Follow the provider's current identity checks and keep the reference for your report.
Protect banking access when banking details were shared
If you shared personal banking details, the Central Bank's guidance says to inform the bank immediately, change online-account passwords immediately and report the fraud to police. Use an official bank route that you locate independently. Do not wait for mobile-line recovery before changing an exposed online password from a device you trust.
That advice is specifically tied to shared banking details. A bank may need different information for an unrecognised transaction or another form of compromise. State exactly what was exposed and what activity you observed.
Ask about the affected transaction separately
Tell the operator or bank which transaction you dispute and ask which current process applies. An account-compromise report aims to address control and access. A reversal or transaction-dispute request addresses a particular transfer. One does not automatically complete the other.
Do not assume that prompt reporting, a fraud report or a reversal request guarantees repayment. Keep the transaction reference, report references and responses so that you can show what you requested and when.
Report suspected fraud to police
Police reporting creates a report for suspected criminal activity. The Directorate of Criminal Investigations publishes information about anonymous reporting routes on its site. A police report does not itself secure a mobile line or reverse a transaction, so keep the operator, bank and police actions distinct.
What an official Kenyan case illustrates
In one published case, the Directorate of Criminal Investigations reported arrests after suspects allegedly posed as customers and deceived an M-PESA operator before swapping the operator's SIM. The reported swap enabled unauthorised access to the complainant's bank account. These were allegations at arrest stage, not convictions, and the case does not show how frequent the method is. See the DCI report.
Escalate an unresolved telecom complaint with records
If a communications complaint remains unresolved, follow the service provider's complaint process first and keep your initial correspondence and references. The Communications Authority consumer guidance explains its escalation role and the supporting information to retain.
This is a telecom complaint route. It is not the first action for securing a line, a bank transaction-dispute process or a promise of compensation. Police reporting, cyber-incident coordination and communications-complaint escalation also serve different purposes. The Communications Authority describes the national cyber-coordination role on its cyber-security page, but this article does not prescribe a cyber-reporting form or hotline.
Reduce future exposure
Do not share a mobile-money PIN, online password or banking detail in response to an unsolicited request. Navigate to an organisation's official site yourself instead of using a login link supplied in an unexpected message. Review which accounts depend on your mobile number and keep their recovery details current.
Safaricom also describes a preventive SIM Swap Whitelist that restricts replacement of a whitelisted line to its Shop or Care desk. Treat this as the operator's description of a preventive control. It is not a post-takeover recovery procedure or a guarantee against fraud. Use the current official page for details rather than relying on an old code or forwarded instructions.
For a household or business, decide in advance who can contact the operator and bank, where account references are kept securely, and how another trusted device can be used if the main line fails. Staff who handle company lines or payments should know that urgency and authority claims in a message are reasons to verify independently. If you are also reviewing a premises security provider, use the guide to choosing a security company in Kenya for that separate decision.
Check that you have covered the immediate steps
You have covered the immediate steps when you have reported the line or M-PESA concern through an official operator route, contacted the bank and changed exposed online passwords where banking details were shared, raised any affected transaction through the relevant process, saved evidence and references, and reported suspected fraud to police.
Those steps create a record and reduce avoidable delay. They do not prove that every account is secure, that the incident has been fully investigated or that money will be returned. Continue following the official case references until each organisation confirms the status of the issue it owns.
Sources and update note
This article uses official Kenyan operator, regulator, central-bank and police material. The SIM-swap advisory explains a stable mechanism but dates from 2018; it is not current prevalence evidence. Official contact routes and guidance were reviewed as at 8 September 2026 and should be rechecked through the linked official pages before use. No fixed support, fraud or reversal code is reproduced because those details can change; use the current official contact guidance instead.