A SIM swap is when a criminal convinces your mobile phone company (Safaricom, Airtel, or Telkom) to transfer your phone number to a new SIM card that they control.
Think of your phone number like your house address. If someone tricks the post office into redirecting all your mail to their house, they can open your letters, steal your money, and pretend to be you. A SIM swap does the same thing — but with your phone number.
Once a criminal has your phone number on their SIM card, they can:
- Receive all your text messages (including M-Pesa PINs and bank OTP codes)
- Make M-Pesa transactions using your account
- Access your bank accounts using the OTPs sent to your phone
- Call your family and friends pretending to be you
- Reset passwords for your email, WhatsApp, Facebook, and government accounts
Critical Warning
The average loss from a SIM swap fraud in Kenya is KSh 50,000 to KSh 200,000 per incident. Some victims have lost over KSh 1 million. This is not a small crime. It is a devastating attack. But it is also preventable — if you know what to look for and what to do.
How Does a SIM Swap Happen?
Criminals do not need to steal your phone. They do not need to know your PIN. They simply need to convince Safaricom (or your network provider) that they are you and that your SIM card is "not working."
| Step | What the Criminal Does | What They Need |
|---|---|---|
| 1. Gather information | They find your phone number, ID number, and sometimes your M-Pesa PIN from phishing scams, social media, or data leaks. | Your phone number + basic personal details |
| 2. Visit a phone shop | They go to a small phone shop (not an official Safaricom shop) and pretend to be you. | A fake ID or a convincing story |
| 3. Request a replacement SIM | They say: "My SIM card is not working. I need a replacement." | Your phone number + "proof" of identity |
| 4. The shop activates the new SIM | The shop assistant (who may not know the rules) activates a new SIM with your number. | The shop's willingness to help without proper verification |
| 5. Your phone goes dead | Your phone suddenly shows "No Service" or "No Network." | The criminal now has your number |
| 6. They steal everything | They receive your OTPs, reset your M-Pesa PIN, transfer money, and lock you out. | Minutes of access before you realize what happened |
Insider Threat
Criminals also use insiders — people who work at phone shops or network provider offices and are willing to process fake SIM swaps for money. This is why even careful people can be targeted.
The Six Warning Signs of a SIM Swap
1. Sudden "No Service" Signal
| What You See | What It Means | What You Should Do Immediately |
|---|---|---|
| Your phone suddenly shows "No Service," "Emergency Calls Only," or "No Network" while other people around you have normal reception. | Your SIM card has been deactivated and transferred to another phone. | Do not assume it is a temporary network glitch. Call your bank and network provider from another phone immediately. |
Why this matters: A normal network outage affects everyone in the area. If only YOUR phone has no service, it is almost certainly a SIM swap.
2. Unsolicited OTP Messages
| What You See | What It Means | What You Should Do Immediately |
|---|---|---|
| You receive sudden text messages containing PIN reset codes or verification tokens that you did not ask for. | A fraudster is currently trying to harvest your access tokens. They may be attempting to log into your bank account, M-Pesa, or email. | Never read these codes out loud to anyone. Do not share them. Call your bank immediately from another phone. |
Why this matters: If you receive an OTP you did not request, someone is actively trying to access your account. Even if you do not act on it, they may already be inside your account from another angle.
3. The "Double Registration" Call
| What You See | What It Means | What You Should Do Immediately |
|---|---|---|
| A caller pretending to be customer support tells you your line is "double registered" and asks you to dial a code like *33*... or press ## to fix it. | This is a scam. The code they give you will forward all your calls to their phone or deactivate your SIM. | Hang up immediately. Network providers never call you to clear "double registrations" over the phone. |
Why this matters: There is no such thing as a "double registration" that requires you to dial a code. This is a classic SIM swap setup. The code they give you will make it easier for them to steal your number.
4. You Cannot Make or Receive Calls
| What You See | What It Means | What You Should Do Immediately |
|---|---|---|
| You try to call someone and the call fails. Someone tells you they tried to call you but got a "number not available" or "switched off" message. | Your number has been transferred to another SIM card. The criminal's phone is now receiving your calls. | Call your network provider from another phone immediately. Say: "I think my SIM has been swapped. Block it now." |
5. Unexpected M-Pesa or Bank Notifications
| What You See | What It Means | What You Should Do Immediately |
|---|---|---|
| You receive M-Pesa notifications for transactions you did not make. Or your bank sends you an SMS about a login or password reset you did not request. | The criminal is already inside your account. They may be transferring money, changing your PIN, or setting up new services. | Call 100 (Safaricom) or your bank immediately from another phone. Say: "My account has been compromised. Block all transactions." |
6. Your Phone Suddenly Asks for a "SIM PIN" or "PUK Code"
| What You See | What It Means | What You Should Do Immediately |
|---|---|---|
| Your phone suddenly asks for a SIM PIN or PUK code that you never set. | The criminal has entered the wrong PIN too many times on the new SIM, causing it to lock. Or they are trying to trick you into giving them your PUK code. | Do not enter any codes. Call your network provider from another phone immediately. |
What is a PUK code? A PUK (Personal Unblocking Key) is a code that unlocks your SIM if you enter the wrong PIN too many times. If a criminal gets your PUK code, they can unlock your SIM on their phone.
What to Do If You Suspect a SIM Swap
Speed Is Everything
If your SIM has been swapped, the criminal has a window of minutes to hours to steal your money. Every minute you delay is money you may lose.
Step 1: Call Your Network Provider from Another Phone (Immediately)
If you are a Safaricom customer:
Call 100 from another phone (borrow from a neighbor, family member, or shop).
Say: "I think my SIM has been swapped. My phone has no service and I did not request a new SIM. Block my number immediately."
Give them: your phone number, your ID number, and your full name.
Ask them to confirm: "Has a new SIM been activated for my number today?"
If yes, ask them to deactivate the new SIM and restore your original SIM immediately.
Ask for a reference number for your complaint. Write it down.
If you are an Airtel customer:
Call 100 from another phone.
Follow the same steps as above.
If you are a Telkom customer:
Call 100 from another phone.
Follow the same steps as above.
Important: Do not wait until you get to a Safaricom shop. Call 100 first. The call center can block your number immediately. Then go to the shop.
Step 2: Call Your Bank Immediately (From Another Phone)
Call your bank's customer care number and say:
"I believe my phone number has been compromised through a SIM swap. Please block all mobile banking, M-Pesa transfers, and online transactions on my account immediately. I am coming to the branch to verify my identity in person."
| Bank | Customer Care Number |
|---|---|
| KCB | 0711 087 000 |
| Equity Bank | 0763 000 000 |
| Co-operative Bank | 020 327 6000 |
| Standard Chartered | 020 329 3290 |
| Absa Bank | 0722 130 130 |
| NCBA | 0711 056 444 |
Ask your bank:
- Has anyone logged into my account today?
- Has anyone requested a password reset or PIN change?
- Has anyone transferred money from my account?
- Please block all online and mobile transactions until I visit a branch.
Step 3: Report to the Police (DCI)
Call the DCI Fraud Hotline: 0800 722 203
Say: "I am a victim of SIM swap fraud. My phone number [your number] has been stolen and my money may have been taken. I need to report this."
They will guide you on how to file a formal report. This is important for:
- Recovering your money (if possible)
- Insurance claims (if you have insurance)
- Creating an official record that may help catch the criminal
Step 4: Go to an Official Safaricom Shop (With Your Original ID)
Do not go to a small phone shop. Go to an official Safaricom, Airtel, or Telkom shop with your original National ID card.
At the shop, ask for:
- A new SIM card (your old one may be compromised)
- Confirmation that the fraudulent SIM has been permanently blocked
- A written report of what happened (for your records)
- Information on whether any transactions were made using your number
Change your M-Pesa PIN immediately after your new SIM is activated. Do not use your old PIN.
Step 5: Check Your M-Pesa Statement and Bank Account
Once your new SIM is active:
- Dial *334# → Enter your new PIN → Check your M-Pesa balance.
- Request a full M-Pesa statement from Safaricom (go to a shop with your ID, or request via SMS).
- Log into your bank account (online or at a branch) and check for unauthorized transactions.
- If you find unauthorized transactions, report them immediately to Safaricom (100) and your bank.
- Save all evidence: SMS messages, screenshots, transaction records, and the police report number.
Step 6: Notify Your Family and Friends
Call or message your family and close friends (from your new number) and tell them:
"My phone number was stolen for a few hours. If you received any messages or calls from my number asking for money, personal information, or passwords, it was NOT me. Please ignore them and do not send any money."
Criminals often use stolen numbers to ask family members for "emergency money." This is a common follow-up scam.
Step 7: Change All Your Passwords
Once your new SIM is active, change the passwords for:
- M-Pesa (your new PIN)
- Your banking app
- Your email (Gmail, Yahoo, etc.)
- WhatsApp (they may have tried to take over your WhatsApp)
- Facebook (if you use it)
- eCitizen (if you use it)
- Any other account that uses your phone number for login or verification
Use different passwords for each account. Do not reuse your old passwords.
How to Prevent a SIM Swap
Prevention is the best protection. These steps will make it much harder for a criminal to swap your SIM.
1. Set a SIM Lock PIN on Your Phone
A SIM lock PIN is a 4-digit code that prevents anyone from using your SIM card in another phone. Even if a criminal steals your SIM, they cannot use it without the PIN.
How to set it on an Android phone:
- Open Settings on your phone.
- Go to Security or Biometrics and Security or Lock Screen.
- Look for SIM Card Lock or SIM Lock or Set Up SIM Card Lock.
- Tap Lock SIM Card.
- Enter a 4-digit PIN (NOT your M-Pesa PIN — choose a different number).
- Confirm the PIN.
- Write down the PIN and keep it in a safe place. Do not save it on your phone.
How to set it on an iPhone:
- Open Settings.
- Tap Cellular or Mobile Data.
- Tap SIM PIN.
- Turn on SIM PIN.
- Enter a 4-digit PIN (NOT your M-Pesa PIN).
- Confirm.
- Write it down and keep it safe.
Important: If you enter the wrong SIM PIN 3 times, your SIM will be locked and you will need the PUK code to unlock it. The PUK code is printed on the plastic card that came with your original SIM. Keep it safe. If you do not have it, call 100 to get it.
2. Enable Two-Step Verification on WhatsApp
If a criminal swaps your SIM, they can try to take over your WhatsApp. Two-step verification prevents this.
- Open WhatsApp.
- Tap the three dots (top right) → Settings → Account → Two-step verification.
- Tap Enable.
- Enter a 6-digit PIN (different from your M-Pesa PIN and your SIM PIN).
- Add an email address (optional but recommended — this helps you recover your account if you forget the PIN).
- Tap Done.
Why this helps: Even if a criminal has your SIM, they cannot activate WhatsApp on their phone without your 6-digit PIN.
3. Register Your M-Pesa with an Alternative Number
Safaricom allows you to register an alternative phone number for M-Pesa notifications. If your main number is swapped, you will still receive alerts on your alternative number.
- Go to a Safaricom shop with your ID.
- Ask to register an alternative number for M-Pesa notifications.
- Provide a trusted family member's phone number (with their permission).
- This number will receive SMS alerts for M-Pesa transactions, even if your main SIM is swapped.
4. Use a Banking App with Biometrics (Fingerprint or Face ID)
If your bank's app supports fingerprint or face recognition, enable it. This means even if a criminal has your OTP, they cannot log into your bank app without your fingerprint.
- Open your banking app.
- Go to Settings or Security.
- Enable Biometric Login or Fingerprint Login.
- Set it up with your fingerprint.
Note: This does not replace the need for OTP security, but it adds an extra layer of protection.
5. Do Not Share Your ID Number or Phone Number Publicly
Criminals need your phone number + ID number to attempt a SIM swap. The less they know, the harder it is for them.
- Do not post your phone number on Facebook, Instagram, or public forums.
- Do not share your ID number unless absolutely necessary (e.g., at a bank or government office).
- Do not share photos of your ID card on WhatsApp or social media.
- Be careful with forms — only give your ID number to trusted, official organizations.
- Shred old documents that contain your ID number or phone number before throwing them away.
6. Be Careful at Phone Shops
When you visit a phone shop for a SIM replacement, repair, or new phone:
- Go to an official Safaricom, Airtel, or Telkom shop — not a small roadside shop.
- Ask for the shop attendant's name and write it down.
- Ask to see their ID badge if they work at an official shop.
- Do not let them take your phone out of your sight.
- Do not tell them your M-Pesa PIN — they do not need it.
- Ask for a receipt for every transaction.
- Check your phone before you leave — make sure it works, your SIM is active, and your balance is correct.
7. Set Up Transaction Alerts with Your Bank
Many banks offer SMS and email alerts for every transaction. If you have an alternative number or email, set this up.
- Log into your banking app or visit a branch.
- Go to Alerts or Notifications.
- Enable SMS alerts for all transactions (deposits, withdrawals, transfers, login attempts).
- Add an email address for email alerts (this is harder for a criminal to intercept).
- Set alerts for large transactions (e.g., any transaction over KSh 5,000).
8. Keep Your PUK Code Safe (But Not on Your Phone)
Your PUK code is printed on the plastic card that came with your original SIM. If you lose your SIM PIN and enter it wrong 3 times, your SIM locks. You need the PUK code to unlock it.
Keep your PUK code:
- In a safe place at home (not in your phone or wallet)
- Written down in a notebook that you keep in a locked drawer
- Shared with a trusted family member (in case of emergency)
Do NOT:
- Save it on your phone
- Take a photo of it
- Share it with anyone except a trusted family member
9. Use a Strong, Unique M-Pesa PIN
Your M-Pesa PIN is your most important financial password. Make it strong:
- Do NOT use your birth year (e.g., 1965, 1972)
- Do NOT use sequential numbers (e.g., 1234, 5678)
- Do NOT use repeated numbers (e.g., 1111, 2222)
- Do NOT use your ID number or any part of it
- Do NOT use the same PIN as your SIM lock, phone lock, or banking app
- DO use a random 4-digit number that you can remember but others cannot guess (e.g., 3847, 5921)
- Change your PIN every 3–6 months
10. Be Wary of "Too Good to Be True" Calls and Messages
Many SIM swap attacks start with a phishing call or SMS. The criminal gathers information first, then uses it to swap your SIM.
| Scam | What They Say | What You Should Do |
|---|---|---|
| "You have won a prize" | "You have won KSh 500,000 from Safaricom. Call this number to claim it." | Ignore it. Safaricom does not call you to tell you that you won a prize. |
| "Your account is suspended" | "Your M-Pesa account has been suspended. Click this link to reactivate it." | Do not click the link. Call 100 directly. |
| "Confirm your details" | "We need to confirm your ID number and phone number for our records." | Hang up. No bank or network provider calls to "confirm details" over the phone. |
| "Technical problem" | "There is a technical problem with your line. We need to send you a code to fix it." | Hang up. They are trying to get your OTP. |
| "Family emergency" | "Your son/daughter has been in an accident. Send money to this M-Pesa number urgently." | Call your family member directly on a number you know. Do not use the number the caller gives you. |
Recovery Checklist
If you have been a victim of SIM swap fraud, follow this checklist:
| Step | Action | Status |
|---|---|---|
| 1 | Call 100 from another phone and block your number | ☐ |
| 2 | Call your bank and block all transactions | ☐ |
| 3 | Call DCI fraud hotline (0800 722 203) and report | ☐ |
| 4 | Go to an official Safaricom shop with your ID and get a new SIM | ☐ |
| 5 | Change your M-Pesa PIN (use a new, random number) | ☐ |
| 6 | Check your M-Pesa balance and request a full statement | ☐ |
| 7 | Check your bank account for unauthorized transactions | ☐ |
| 8 | Change all your passwords (email, banking, WhatsApp, Facebook, eCitizen) | ☐ |
| 9 | Notify your family and friends that your number was compromised | ☐ |
| 10 | Set up a SIM lock PIN on your new SIM | ☐ |
| 11 | Enable two-step verification on WhatsApp | ☐ |
| 12 | Register an alternative number for M-Pesa notifications | ☐ |
| 13 | Set up transaction alerts with your bank | ☐ |
| 14 | Keep your PUK code in a safe place | ☐ |
| 15 | Review your online accounts for any changes you did not make | ☐ |
Important Contact Numbers
Save these numbers in your phone right now. In an emergency, you will not have time to search for them.
| Organization | Number | When to Call |
|---|---|---|
| Safaricom Customer Care | 100 | SIM swap, M-Pesa fraud, lost SIM, account problems |
| Safaricom M-Pesa Reversal | 456 | Wrong M-Pesa transaction (forward SMS to this number) |
| Airtel Customer Care | 100 | SIM swap, account problems |
| Telkom Customer Care | 100 | SIM swap, account problems |
| KCB Bank | 0711 087 000 | Unauthorized transactions, account blocking |
| Equity Bank | 0763 000 000 | Unauthorized transactions, account blocking |
| Co-operative Bank | 020 327 6000 | Unauthorized transactions, account blocking |
| DCI Fraud Hotline | 0800 722 203 | Report fraud, cybercrime, SIM swap |
| Communications Authority | 020 420 3000 | Report telecom fraud, unlicensed operators |
| Police Emergency | 999 or 112 | Immediate danger, physical threat |
Save these numbers in your phone with clear names: "Safaricom Help 100", "M-Pesa Reversal 456", "KCB Bank Help", "DCI Fraud 0800", "Police Emergency 999". Do this now. In an emergency, you will not have time to search for numbers.
Frequently Asked Questions
You cannot prevent someone from attempting a SIM swap, but you can make it much harder and catch it quickly. The steps in this guide (SIM lock PIN, two-step verification, alternative M-Pesa number, and being alert to warning signs) make it very difficult for criminals to succeed.
Borrow a phone from a neighbor, family member, shopkeeper, or friend. Explain that you have an emergency. Most people will let you make a short call. You can also use a payphone or go directly to an official Safaricom shop (but calling 100 first is faster).
Safaricom investigates each case. If the fraud is confirmed and you reported it quickly, they may refund some or all of the money. However, there is no guarantee. This is why prevention is so important. The faster you report, the better your chances.
It is much harder, but not impossible. Some criminals use fake IDs, bribe insiders, or exploit weak verification at small phone shops. This is why you should always go to official Safaricom shops for SIM replacements and never share your ID number publicly.
If your phone has no service, your SIM is already swapped. Borrow a phone immediately and call 100. Or go to the nearest official Safaricom shop with your ID. Time is critical — every minute counts.
Yes, but only after you have fully recovered: new SIM, new PINs, two-step verification enabled, and all passwords changed. Once you have taken these steps, mobile banking is safe. In fact, using a banking app with biometric login (fingerprint) is often safer than carrying cash.
No. M-Pesa is safe if you use it correctly. The problem is not M-Pesa. The problem is criminals who steal your phone number. Follow the prevention steps in this guide, and M-Pesa will remain one of the safest ways to send and receive money in Kenya.
The One Thing to Remember
If your phone suddenly shows "No Service" and you did not request a new SIM card, assume your SIM has been swapped. Do not wait. Do not hope it will fix itself. Call 100 from another phone immediately. Your money depends on it.
I have met seniors who lost their life savings to SIM swap fraud. I have also met seniors who spotted the warning signs and stopped the fraud before it cost them a single shilling. The difference was knowledge and speed. This guide gives you both. Read it again. Share it with your family. Save the important numbers. And remember: your phone number is your key to your money, your identity, and your family. Protect it like your house keys. Because to a criminal, it is the same thing.
— Kevin, Senior Citizens Tech Haven