SIM Swap and M-Pesa Fraud Investigation in Kenya
Forensic reconstruction of SIM swaps, fake M-Pesa confirmation messages and mobile money theft, delivered as evidence your advocate can take to court.
Instruct Us on Your Matter Call +254 100 177 094How mobile money is actually stolen in Kenya
Most losses fall into one of five patterns. Knowing which one you are dealing with decides what evidence must be preserved first.
SIM swap
A fraudster obtains a replacement SIM using a forged ID or an insider. Your line goes dead, and they receive your M-Pesa PIN resets and bank OTPs.
Fake M-Pesa confirmation message
A “payment received” message that never came from M-Pesa, created with SMS spoofing, a message-generator app or an edited screenshot. The seller, landlord or agent releases goods or cash against it.
Wrong-number reversal trick
You get a real or fake transfer message, then a call: “I sent it by mistake, please return it.” The money you send back is real. The money you “received” never existed or is reversed.
Impersonation and PIN capture
Callers posing as Safaricom, your bank or a relative talk you into revealing a PIN, an OTP or a reset code.
Agent and till fraud
A fake deposit message convinces an agent to hand over cash, or a fake till confirmation convinces a shopkeeper to release stock. Businesses lose most to this pattern.
The fake M-Pesa message: what the sharp boys show you, and what the record shows
A message on a screen proves nothing. It is text, and text can be typed, spoofed or generated. The M-Pesa statement and your actual balance are the record. Here is the gap we look for.
[10-character code] Confirmed. Ksh45,000.00 received from JOHN DOE 07XX XXX XXX on 12/9/26 at 2:04 PM.
Looks right. Arrives in the usual thread. Often shown in a hurry, with a phone you are not allowed to hold.No entry for this code between 2:00 PM and 2:10 PM. Balance unchanged: Ksh12,300.00.
The money never arrived. Everything you “saw” was text.What we examine to tell a genuine message from a fake
| Check | Genuine message | Fake message |
|---|---|---|
| Transaction code | Unique 10-character code that appears in the M-Pesa statement | Missing from the statement, malformed or reused from an older transaction |
| Balance and charges | New balance and transaction cost reconcile with the previous balance and tariff | Arithmetic, fees or balance do not reconcile |
| Message metadata | Stored in the phone’s SMS database with the network’s service-centre details and timestamps in sequence | Spoofed or app-generated messages often carry different service-centre data, odd timestamps or sit out of sequence |
| Wording and format | Consistent date format, spacing and name format | Small differences in spelling, spacing, date style or name case |
| Source | Delivered by the network and recoverable from the device | Screenshot only, or a message that cannot be traced to the network |
Simple protection for shops, agents and landlords: never release goods, cash or keys on an SMS or screenshot. Check your balance on the M-Pesa menu or app, or the till or Paybill portal, before you hand anything over.
What UFC investigates
Phone and SMS forensics
Forensic imaging of the handset, recovery of SMS records including deleted messages, and analysis of sender and delivery data.
Fake message authentication
Opinion on whether a message or screenshot is genuine, spoofed, generated or edited, tested against the M-Pesa statement.
M-Pesa statement analysis
Reconciling the disputed messages with the statement, identifying receiving numbers and following onward movement of funds. Your advocate then obtains network and bank records by court order.
SIM swap reconstruction
A timed sequence of the swap: loss of signal, replacement SIM, OTPs, app logins and transfers. This supports claims against a bank or a mobile network.
Insider and agent fraud
Investigations for banks, mobile network partners, agents and merchants where staff collusion or repeated losses are suspected.
Expert report and testimony
A court-ready report with the supporting certificate for electronic evidence, and expert testimony where required.
The legal framework we work within
- Computer Misuse and Cybercrimes Act, 2018: computer fraud, computer forgery, identity theft and impersonation, phishing, and interception of electronic messages or money transfers.
- Penal Code (Cap. 63): obtaining by false pretences, section 313.
- Evidence Act (Cap. 80), Sections 106A and 106B: admissibility of electronic records and the certificate that must accompany them.
- Data Protection Act, 2019: personal data compromised in a SIM swap may support a complaint to the Office of the Data Protection Commissioner.
- National Payment System Act, 2011: the regime governing mobile money providers and their obligations.
The first hours after a SIM swap or fake-message loss
- Stop the loss. Contact your network provider to block the new SIM, and your bank to freeze accounts, cards and mobile banking.
- Dispute the transaction. Report it to the M-Pesa customer line immediately and forward scam SMS to 333.
- Keep the phone as it is. Do not delete messages, reset the device or reinstall apps. Screenshots are not a substitute for the original data.
- Report to the police. File with the DCI Cybercrime Unit or the nearest station and obtain an OB number.
- Call us for preservation. The earlier the handset is imaged, the more we can recover.
Frequently asked questions
Can UFC get my stolen M-Pesa money back?
We cannot promise recovery and we do not reverse transactions. We establish how the money moved and who is behind it, and our report supports recovery through Safaricom, your bank, the police and a court order.
How can I tell if an M-Pesa message is fake?
Do not rely on the message. Check your actual balance and your M-Pesa statement for the transaction code. A genuine payment appears in both. A fake message does not.
Can a fake M-Pesa message be proved in court?
Yes. We recover the message data from the device, compare it with the M-Pesa statement and prepare an expert report, with the certificate required under Sections 106A and 106B of the Evidence Act.
What are the signs of a SIM swap?
A sudden loss of network, unexpected SMS about a SIM or PIN change, bank alerts you did not trigger, or being unable to make calls while others around you can.
Can a bank or mobile network be held responsible for a SIM swap?
That depends on the facts and is a matter for your advocate. A forensic timeline of the swap and the transactions that followed is the evidence that makes such a claim possible.
Do you act for shops, agents and businesses?
Yes. We investigate repeated fake-message losses, agent fraud and insider collusion for businesses, and work with advocates and law firms in Kenya and abroad.
Instruct us while the evidence is still there
Send the details of your matter and we will tell you what can be recovered and how fast to move.
Instruct Us on Your Matter +254 100 177 094Ultimate Forensic Consultants Ltd is PSRA-licensed and ODPC-registered, with offices in Nairobi, Mombasa and Kisumu. This page is general information and not legal advice.