Protecting Your Business from Online Fraud: The Scams Hitting Kenyan SMEs

Fraud in Kenya has industrialised. Mobile banking fraud jumped over 340% in a year, half of phone owners receive scam messages, and the Communications Authority reports attackers now using AI to craft believable messages and impersonations. Consumers lose money; businesses lose money AND stock AND reputation. Here's what's aimed at you.

The scams built for businesses

• The fake payment — a forged M-Pesa SMS or screenshot while the shop is busy. Goods leave; money never arrived.
• The reversal trick — a real payment, goods collected, then a fraudulent reversal request to Safaricom claiming "wrong number"
• The supplier switch — an email or WhatsApp "from your supplier": "we've changed our Paybill, send to this one"
• SIM swap — your line is hijacked, then your M-Pesa, then every account that trusts that number. Investigations rose over 300% in 2025.
• The fake Safaricom/bank agent — a call about "suspicious activity" that talks you or your staff into revealing a PIN or approving a transaction

The rules that block almost all of it

• Confirm payments on YOUR side — the balance, statement or dashboard. Never on the customer's screen. No exceptions when busy; busy is exactly when they strike.
• No goods on a reversal-able payment for strangers — for big sales, wait for confirmation and be suspicious of urgency
• Verify account changes by calling the supplier's known number — never the number in the message announcing the change
• Lock the SIM — set a Safaricom SIM lock PIN, and use app PINs + two-factor authentication on email and socials
• No real agent ever needs your PIN or OTP. Ever. Make every staff member repeat this monthly.

Train the team, not just yourself

Fraudsters don't target the owner — they target the newest employee on the till during the lunch rush. A 20-minute session and a printed "we never..." list by the counter is some of the highest-return security spending a small business can make. Add a simple rule: any payment question or account change gets a second person's eyes before action.

If it happens anyway

Move fast: report to Safaricom (call 100/200 or dial *334#) to attempt a freeze, report at a police station for an OB number, and notify your bank if accounts are linked. Then do the honest post-mortem — which rule above was skipped — and fix the process, not the person. Speed matters more than blame; recovery windows are short.

Scammers don't hack systems — they hack hurry, trust and lunch-hour chaos. Slow the money down by ten seconds and most scams die.