Skip to content
paybillke
Lending

What to check before using a loan USSD code (Kenya 2026)

A five-point safety checklist for any Kenyan loan USSD.

AO
by Reviewed by Michael Mwangi 8 min read Updated 26 August 2026Verified 26 Aug 2026

1. Is the code the real one?

Verify against a primary source: Safaricom for M-PESA-related codes (*334#, *234#, *254#, *144#) and the bank's own website for bank-specific codes (*848# Absa, *247# Equity, *667# Co-op, *522# KCB, etc.). If you cannot find the code on the primary source, do not dial it.

2. Is the lender licensed?

Government-run (Hustler Fund) and CBK-licensed banks (KCB, NCBA, Absa, Equity, Co-op) are covered here. If a code claims to be an app-based lender product on USSD, verify the lender is on the CBK register: use our CBK licence checker. Unlicensed lenders on USSD are rare but do exist.

3. Is the SIM registered to you?

Kenyan loan products require the SIM to be registered in the borrower's name and linked to their ID for KYC. Using a SIM registered to someone else creates identity confusion and can trigger fraud flags.

4. Is your PIN safe?

Never share your M-PESA PIN. Never enter your M-PESA PIN into a code that did not come from a Safaricom or bank source. If the USSD flow feels weird (unusual prompts, mismatched product names, unfamiliar paybill in the confirmation), abort by pressing Cancel or letting the session time out.

5. Is the confirmation screen what you expected?

The confirmation screen before you enter your PIN shows: product name, principal, fee, total repayable, due date. Verify each. If total repayable is materially different from your expectation, do not proceed.

If you already entered your PIN into a fake code

  1. Change your M-PESA PIN immediately via *334#.
  2. Call Safaricom customer care on 100 for fraud escalation.
  3. Check your M-PESA statement for unauthorised transactions.
  4. Report to the Directorate of Criminal Investigations if funds were taken.

Sources

  1. Safaricom PLC. USSD short codes as published on safaricom.co.ke.
  2. Central Bank of Kenya. Register of non-deposit-taking credit providers.
  3. Individual bank websites for bank-specific USSD codes.

FAQ

Can a fake USSD code steal my money?

A malicious short code (published on a scam site or via a WhatsApp forward) can prompt for your M-PESA PIN inside a session that looks legitimate. Only use USSD codes verified against Safaricom or the lender's own site.

Should I ever share my M-PESA PIN?

Never. Not for a loan, not for a refund, not for a job, not for a call from "Safaricom customer care". Safaricom will never ask for your PIN.

Further reading

Curated external sources we cite. Open in a new tab.