Last Updated on October 30, 2026 by Editorial
SIM swap fraud in Kenya can empty a mobile wallet and a bank account in less time than it takes to work out why your phone has lost signal. A criminal persuades your mobile operator, or someone working for it, to move your number onto a SIM card they control.
From that moment, your calls, text messages and one-time passwords go to them instead of you.
The problem is growing and there’s evidence to back that up. INTERPOL’s African Cyberthreat Assessment Report 2026 says SIM swap fraud in Kenya increased by 327% during 2025.
Another analysis of computer fraud cases reported between February and July 2026 found that about half involved mobile money in some way.
This guide explains how the fraud works, the warning signs to look for, exactly what to do in the first hour if you suspect you’ve been targeted. More importantly, you’ll learn how to become a much harder target.
Key Takeaways
SIM swap fraud lets criminals take control of your phone number and intercept SMS codes to access M-Pesa, banking, and other accounts.
Watch for sudden signal loss, unexpected SIM change alerts, failed logins, and M-Pesa transactions you don’t recognize.
Act immediately. Contact your operator and bank from another phone. Safaricom customers can report M-Pesa fraud by SMS to 333 or dial *334#.
Restrict Safaricom SIM replacements to shops and care desks by dialling *100*100#. Never share your PIN or one-time codes.
A VPN cannot prevent SIM swap fraud. Use authenticator apps where possible, secure your accounts, and check your M-Pesa and bank statements regularly.
What Is a SIM Swap?
A SIM swap is when your mobile number is transferred to a different SIM card. It usually begins when a criminal tricks your mobile provider into activating your number on a SIM card they control.
They can then receive your calls and SMS messages, including one-time passwords (OTPs) used to access your bank accounts, mobile money, email, and other online services.
Whoever controls the number can often approve transactions and lock you out of your own accounts. Safaricom itself describes SIM swap fraud as a form of identity theft, which is a useful way to think about it: the thief isn’t just taking your SIM, they are becoming you.
How SIM Swap Fraud in Kenya Happens
There is no single method, but most cases follow one of three routes.
Social Engineering
The most common pattern starts with social engineering in the form of a phone call. The caller pretends to be from your operator and claims there is a problem, for example that your SIM is registered to two people.
They ask for your M-Pesa PIN or other details, and may tell you to switch your phone off “while the issue is fixed”. Those details are what they need to request a new SIM in your name, and a switched-off phone means you won’t see the alerts that would have warned you.
Insider or Agent Collusion
Not every swap is a trick played on the customer. Safaricom has acknowledged cases where M-Pesa agents colluded with fraudsters to carry out illegal swaps. This is why it introduced an option to restrict swaps at agents.
Stolen or Leaked Personal Details
Your full name, ID number, date of birth and phone number can be gathered from phishing messages, data leaks, malware and even oversharing on social media.
The more a fraudster knows about you, the more convincing they sound when they contact your operator or call you. Keeping your phone protected from malware helps, and our antivirus guides are a good place to start.
Warning Signs of a SIM Swap
A SIM swap can unfold quickly, so learn the signs before you need them:
- Sudden loss of signal: Your phone shows “No service” or “Emergency calls only” for no clear reason, especially if it happens outside a known network outage.
- A SIM change message you didn’t request: Some people receive a notification about a SIM replacement before the swap completes. Never ignore it.
- One-time passwords or password-reset emails you didn’t trigger: Someone may already be trying to get into your accounts.
- Strange calls or texts: Callers who ask for your PIN, ID number or a one-time code, or who tell you to switch off your phone, are a major red flag.
- Failed logins: You can’t sign in to M-Pesa, your banking app or your email, or your passwords suddenly stop working.
- Transactions you don’t recognise: This includes money moved out of M-Pesa or your bank, or loans and overdrafts you didn’t take.
Could It Just Be a Network Problem?
Possibly. Outages and weak coverage cause signal loss too. Quick checks help: see whether other people nearby are affected, move to another location, restart the phone and try your SIM in another handset.
But if the signal doesn’t return within a few minutes, or you’ve noticed any other warning sign on the list, treat it as a possible swap and move to the next section.
Checking an account balance from another device is a sensible way to confirm the problem. Losing a few minutes to caution costs far less than losing money.
What Should I Do in the First Hour After a Swim Swap Fraud?
If you suspect a SIM swap, work through these steps in order. You can adapt them to your situation, but don’t spend the first twenty minutes wondering whether you’re overreacting. Here are the steps to follow:
- Contact your mobile operator. Use another phone to call its official customer care line. Report a suspected SIM swap, request a SIM block, and ask whether M-Pesa can be suspended. Record the time, agent’s name, and reference number.
- Call your bank. Use the number on your bank card or official website. Report suspected fraud and ask the bank to freeze affected accounts, cards, and mobile banking.
- Secure your email and accounts. From a trusted device, change your email password and sign out other sessions. Secure banking apps, WhatsApp, and social media with strong, unique passwords. See our password security guides.
- Report the fraud. Safaricom customers can report M-Pesa fraud by sending an SMS to 333 or dialling *334#. Report the incident to the police, request an Occurrence Book (OB) number, and consider reporting it to the Directorate of Criminal Investigations (DCI).
- Preserve the evidence. Screenshot suspicious messages and alerts. Record phone numbers and times, and download your M-Pesa and bank statements. Keep everything for investigators.
- Recover your messaging accounts. Once your number is restored, register WhatsApp on your phone again and enable two-step verification.
- Avoid further scams. Never share your PIN or one-time codes. Ignore anyone offering to recover your money for a fee, and verify all requests through official channels.
If you’re on Airtel, Telkom or another network, the same principle applies: call your operator’s customer care from another line and ask them to block the SIM and secure your account.
The next 24 to 72 hours
Once the immediate danger has passed, focus on recovery and cleanup:
- Get your number back. Visit your operator’s shop or care desk in person with your ID to get a replacement SIM. Ask what happened to your number and when.
- Review every statement. Check M-Pesa and bank statements line by line. Look for loans, overdrafts such as Fuliza and loan-app activity taken out in your name, and dispute anything you didn’t authorise.
- Reset PINs and credentials. Change your M-Pesa PIN, banking PINs and passwords from a clean device. Remove saved cards, review which devices are linked to your accounts and update your recovery phone numbers and emails.
- Follow up on every report. Keep a simple log with dates, names and reference numbers for the operator, bank and police. Politely chase each one.
- Watch for follow-up scams. After a breach, fraudsters sometimes pose as bank or telco staff offering help. Verify anyone who contacts you by calling the official number yourself.
How to Protect Yourself From SIM Swap Fraud in Kenya
No single step makes you immune, but together these make you a far harder target:
- Restrict SIM swaps to in-person visits. Safaricom introduced a feature that lets customers limit SIM replacements to its shops and care desks. You can activate it by dialling *100*100# from your own line.
- Guard your PINs and codes. Safaricom has repeatedly issued advisories urging customers never to share their SIM or M-Pesa PINs. Genuine staff will not ask for them.
- Don’t switch your phone off because a caller says so. It is a classic way to keep you from noticing alerts. Hang up, and call your operator on its official number.
- Use an authenticator app instead of SMS codes where possible. Apps such as Google Authenticator or similar tools don’t depend on your phone number, so a swap can’t intercept them.
- Ask your bank about swap checks. Safaricom offers a SIM-Swap-Check service that lets participating banks see when a customer’s SIM was last swapped. Ask whether your bank uses it, and whether you can get transaction alerts by email or app notification as well as SMS.
- Check the numbers registered to your ID. Operators offer a way to see which lines are registered under your ID number. Ask customer care how to use it, and report any line you don’t recognize.
- Share less about yourself publicly. Avoid posting your ID number, full date of birth and phone number on social media.
- Be careful where you log in. Sloppy habits on shared or public networks make it easier for credentials to leak. Our public Wi-Fi security checklist covers the basics.
- Report scam calls and messages even if you didn’t lose money. Reports help operators block fraudulent numbers and protect other people.
Does a VPN Protect You From SIM Swap Fraud?
We’re a VPN-focused site, so we’ll be direct: No it does not.
A VPN encrypts your internet traffic with AES-254 and hides your IP address, but a SIM swap doesn’t attack your internet connection. It attacks your phone number, through your operator and through you.
A VPN can’t stop a fraudster from persuading an agent to issue a SIM, and it can’t stop a convincing phone call asking for your PIN.
What a VPN can do is protect you in other situations, such as keeping your traffic private on untrusted networks. It is one layer of protection, and it needs to be paired with the habits above.
If you’re new to the technology, our guides on what a VPN is and what it does and whether VPNs are safe explain what to expect, and what not to.
Wrapping Up
SIM swap fraud in Kenya is frightening because it turns an everyday object, your phone number, against you. But it is not unstoppable. Recognizing the warning signs, knowing who to call and acting within the first hour can limit the damage.
If you’ve been a victim, please don’t blame yourself. These scams are designed by professionals to sound convincing. Many careful, intelligent people have been caught out. Report it, secure your accounts, and lean on your bank, your operator and people you trust.
FAQ
There is no guarantee. Whether money can be recovered depends on how quickly the fraud was reported, where the money went, and the policies of your bank and operator. Acting fast gives investigators the best chance of tracing it. Be wary of anyone who offers to recover your money for a fee.
A legitimate replacement requires identity verification, and Safaricom has introduced ways to restrict swaps to its shops and care desks. Even so, cases happen through social engineering, forged or stolen details and insider collusion. If you believe a swap was done without proper verification, say so clearly in your reports.
It can happen within minutes, and fraudsters often move money quickly. That is why the first hour matters so much.
We recommend it. Banks and operators may ask for a police report or OB number when they investigate, and reports help authorities spot patterns.
The warning signs and first-hour steps are the same on any network. Call your operator’s customer care from another phone, ask them to block the SIM, and ask which anti-swap protections they offer. Don’t assume Safaricom’s short codes work on other networks.
Leave a Reply