A mobile-money transfer is fast, cheap and final in all but name. Those qualities are what customers value, and they are exactly what a fraudster needs. Most of the losses do not come from broken systems. They come from a handful of repeating patterns, and each one leaves signs that a provider can learn to read.

Why the money is a target

Criminals follow volume and speed. In Kenya, mobile money is part of daily life: the 2024 FinAccess Household Survey found that 84.8% of adults use formal financial services and 52.6% use mobile money every day. The Central Bank of Kenya counted more than 95 million registered mobile-money accounts in August 2026, a figure that includes people with more than one account.

Four features make that scale attractive to fraud:

  • Speed. Funds can be moved, withdrawn or passed on within seconds. After that, recovery is hard.
  • Distance. A fraudster never has to meet the victim.
  • A single key. For many customers, the phone number and the PIN are all the security there is.
  • Reach. A message that fools one recipient in a thousand still pays when it goes to a million.

It helps to sort every case into one of two kinds. In unauthorised fraud, someone else moves money from the account without the owner knowing, for example after stealing a PIN or taking over the phone number. In authorised fraud, the owner is deceived into sending the payment. The second kind is harder to spot, because the right person is doing the paying, and harder to reverse, because they agreed to it.

What links both kinds is that the attack usually starts with a person, not a computer.

Pattern one: persuading people to pay

Social engineering works by turning trust, fear, urgency or greed against the customer. The stories change. The structure does not.

  • The "wrong send". A message that looks like a payment confirmation arrives, then a call or text asks for the "mistaken" money back. Often nothing arrived at all. Sometimes real money did, and the fraudster later asks the provider to reverse it too, so the victim pays twice.
  • Impersonation. The caller claims to be the bank, the provider, a government office or the police, and asks for a PIN or one-time code, or for funds to be moved to a "safe" account. Caller ID and sender names can be faked.
  • Prizes, investments, jobs and emergencies. Each asks for money up front: a fee to release a prize, a deposit for high returns or a well-paid job, or urgent help for a relative in trouble.
  • Business payment fraud. An organisation receives a convincing request, often by email, to change a supplier's bank details or make an urgent payment for a senior executive.

The warning signs repeat across all of them: urgency, secrecy, contact the customer did not expect, and a request for a PIN, a code or a payment. For a provider, the practical lesson is to say one thing often, plainly and in local languages: we will never ask for your PIN or a one-time code. Then back that message with pauses and warnings on risky payments.

Pattern two: taking over the account

In an account takeover, the criminal controls the account and uses it as their own. On mobile money and mobile banking, a common route is the SIM swap, and it follows a recognisable sequence.

The five stages of a SIM swap takeover: the fraudster gathers the victim's details, has the phone number moved to a SIM card they control, the victim's phone loses signal, the fraudster receives the codes and resets the PIN, and the account is emptied. ANATOMY OF A SIM SWAP Details gatheredleaked data · calls Number movedto the criminal's SIM Signal lostoften the first sign Codes receivedPIN and password reset Account emptiedtransfers out THE SIGNAL DROPS BEFORE THE MONEY DOES
Each stage leaves a trace. The earlier a provider acts on one, the less there is to recover.

The fraudster first collects details about the victim, often from leaked data or by tricking them. Next, someone is persuaded, fooled or bribed into moving the victim's number to a new SIM. From then on, the one-time codes and calls meant for the victim go to the criminal, who resets the PIN and drains the account. Stolen or guessed PINs, malware on the phone and codes handed over by deceived customers lead to the same place.

The point for a provider is simple. A text-message code proves that someone holds the number. It does not prove who. So the defences sit around the code, not inside it:

  • Check for a recent SIM change before a PIN reset or a large transfer, and add a cooling-off period or extra checks when there has been one.
  • Do not rely on text-message codes alone for high-value actions.
  • Watch the sequence: a new device, a PIN reset and a new payee, followed quickly by large transfers.
  • Tell customers what an unexpected loss of signal may mean, and that they should contact their operator and their bank at once.

Mobile operators hold part of the answer too, through strict identity checks for SIM replacement and staff who are accountable for each one.

Pattern three: the people inside the system

Not every fraudster is a stranger.

Agents handle cash at the edge of the network. Some deceive customers, for example by faking a reversal or keeping part of a deposit. Others are the victims, of fake confirmation messages or counterfeit notes. Vetting, training, monitoring agent transactions, mystery shopping, a clear way for customers to complain and quick action on agents with repeated complaints all reduce the risk.

Insiders with system access can move money, change customer details, help with SIM swaps or sell customer data. The answers are familiar ones: least-privilege access, segregation of duties, a second person to approve sensitive changes, logs of staff actions that someone actually reviews, and a culture where staff can raise concerns safely.

Money mules are the exit route. Their accounts receive stolen funds and pass them on, sometimes knowingly, often after an offer of easy money or a fake job, sometimes without understanding. Look for accounts that take in many payments from unrelated people and move them on or withdraw them quickly, new accounts with sudden heavy use, and several accounts sharing one device, phone number or address.

Closing a mule account cuts the fraudster's exit and meets an anti-money laundering duty in the same step.

What to do at each stage

The controls group naturally into three layers.

  1. Prevent. Repeat the PIN-and-code message until customers can recite it. Show the recipient's name before a payment completes, so a wrong payee stands out, while remembering that a name proves nothing about honesty, because fraudsters often use accounts registered to real people. Add limits and friction to first payments to new recipients, large amounts, and payments soon after a PIN reset or SIM change.
  2. Detect. Monitor transactions and account behaviour for these patterns, in real time where possible, so a payment can be held before the money leaves.
  3. Respond. Speed is what recovers money. Run a reporting line that is well known and open at all hours. When a customer calls, record the transaction reference, time, amount, receiving number or account, and how the customer was first contacted. Pass the case to the fraud team immediately, and do not promise recovery. Freeze receiving accounts and trace funds with other providers. Explain decisions to victims clearly and fairly.

Then close the loop. Each case shows a gap in prevention, detection or response. Fraudsters adapt quickly, so the controls have to adapt as well.

In Kenya, payment service providers are overseen by the Central Bank of Kenya under the National Payment System Act, 2011. Regulation 14 of the National Payment System Regulations, 2014 makes a provider liable to its customers for what its agents do within the scope of the agency agreement, and the agreement cannot remove that liability. The Registration of Telecommunications Service Subscribers Regulations, 2025 require operators to register and verify SIM users. The Computer Misuse and Cybercrimes Act, 2018 makes computer fraud, identity theft and impersonation, and phishing criminal offences, and reporting institutions must report suspicious transactions to the Financial Reporting Centre under the Proceeds of Crime and Anti-Money Laundering Act, 2009.

Our free course Mobile Money and Payment Fraud covers these scams, SIM swap, agent and insider fraud, mules and the response in depth, with a knowledge check and a certificate.

Sources