Paybill scams in Kenya — and how to spot them in 2026

M-Pesa is one of the most secure consumer-payment systems in the world, but the fraud ecosystem around it is sophisticated, fast-moving, and overwhelmingly social-engineering based. The technology is rarely the weak point — the human is. Here are the scam patterns we see most in 2026, ranked by frequency, with what to look for and how to protect yourself.

1. The fake-paybill switch

How it works: someone receives a forged invoice from a school, hospital, or service provider — often by email or WhatsApp. The paybill number on the invoice is wrong: it belongs to the scammer, not the real institution. The victim pays via M-Pesa, money lands in the scammer's account, and the real bill remains unpaid.

How to avoid it: never trust a paybill number that came in an email, WhatsApp message, or SMS that you didn't request. Always confirm the paybill on the institution's official website or by calling them directly using a number from their site. Use the paybillke directory as a cross-reference — if the number on your invoice doesn't match what we list (and we cite an official source for every verified entry), call before paying.

2. The fake confirmation SMS

How it works: a scammer sends you a fake M-Pesa confirmation SMS claiming they paid you, usually for goods you're selling on Facebook Marketplace or OLX. The message looks authentic — even formatted like Safaricom's SMS. You release the goods, then realise the money never arrived.

How to avoid it: M-Pesa transactions show up in your wallet balance immediately. Always check your actual M-Pesa balance (dial *144# or open the M-Pesa app) before releasing goods or services. The SMS is just a notification — the truth is in your balance.

3. SIM-swap M-Pesa fraud

How it works: a scammer obtains enough personal information about you (often from social media + a leaked database) to convince Safaricom you've lost your SIM. They get a replacement SIM with your number, take over your M-Pesa, drain your wallet, and use Fuliza. You lose service first; by the time you call Safaricom, the damage is done.

How to avoid it: enable M-Pesa biometrics in the M-Pesa app (Settings → Security). Limit what personal data you publish on social media. If your phone signal disappears suddenly in a busy area or after suspicious calls, call Safaricom from another phone immediately on 100 (free from any Safaricom line). Set a strong M-Pesa PIN that's not your birthday or a sequential pattern.

4. The fake "Safaricom Customer Care" call

How it works: someone calls claiming to be from Safaricom. They say there's a problem with your account, a recent transaction needs to be reversed, or you've won an M-Pesa promo. They guide you through a series of menu prompts that, in reality, transfer your money to them or unlock a Fuliza loan in your name.

How to avoid it: Safaricom never calls you to ask you to enter PINs or navigate menus on the phone. Real Safaricom customer-care calls confirm your identity and give you information — they never instruct you to do something on the dial pad. Hang up immediately if you're asked to enter your PIN, send money, or accept Fuliza during a call.

5. The "reverse a mistake" scam

How it works: a scammer sends you a small amount of M-Pesa "by mistake," then calls or texts begging you to reverse it. Their script: "I sent KES 5,000 instead of 500, please send back the difference." If you do, you'll have sent the scammer real money — and they'll have reversed the original transfer through Safaricom's normal mistake- reversal process, leaving you out of pocket.

How to avoid it: never send money back manually for "mistakes." If a Safaricom transfer was a genuine error, the sender can request a reversal through Safaricom's official process by calling 100 within 7 days. They don't need you to do anything.

6. The "Pay to apply" job scam

How it works: a job advert promises high pay, requires you to pay an upfront fee via paybill or till for "processing", "uniform", "medical", or "training." The job doesn't exist; the paybill belongs to the scammer.

How to avoid it: legitimate Kenyan employers never ask you to pay for an application or interview. If a job requires upfront payment of any kind via M-Pesa, walk away.

7. The unsolicited loan / "deposit to verify" scam

How it works: someone offers you a fast loan and says you need to pay a small fee (KES 500-2,000) to a paybill to "verify" or "activate" the loan. The loan never materialises.

How to avoid it: real CBK-licensed digital lenders (Tala, Branch, KCB-M-Pesa, Zenka) never require upfront fees. They evaluate, approve, disburse — fees are deducted from the loan proceeds, not paid in advance. See our lending directory for licensed lenders.

If you think you've been scammed

Move fast — the first hour matters most:

1. Call Safaricom on 100 (Safaricom line, free) immediately. Report the scam, request a reversal, ask for the receiving SIM to be flagged. Some transactions can be reversed if you act within the first hour.
2. Save evidence: M-Pesa transaction code, screenshots, the scammer's phone number, any messages.
3. Report to the police via DCI's Complaint Online portal or visit your nearest station with the evidence.
4. Report to Safaricom Fraud by emailing fraud@safaricom.co.ke with full details.
5. If Fuliza was used in your name fraudulently, dispute it directly with NCBA via the Fuliza menu. They've resolved many fraud-related Fuliza disputes.

Long-term protection

• Enable M-Pesa app biometric login
• Set a strong, non-obvious PIN — don't use your year of birth, ID number, or sequential digits
• Don't announce travel, large purchases, or bonus payments on public social media
• Don't share your phone number publicly any more than necessary
• Keep your M-Pesa daily transaction limit set to what you actually use — Safaricom lets you reduce it, which limits scammer damage
• Bookmark paybillke's directory and check our guides for scam-pattern advisories when new ones emerge.