Account Security and SIM-Swap Awareness

Keep the phone number and credentials private

A phone number may receive account notifications or authentication codes, so control of the SIM can affect other accounts. Use a strong device lock, keep the SIM and account PIN private, and avoid posting the number publicly where it is linked to payment profiles. Safaricom advises customers to keep the nominated number secure and the M-PESA PIN secret.

Do not read an OTP to a caller, send it over chat or enter it into an unfamiliar page. A real support agent should not need your PIN to investigate a payment. Be cautious of callers who create urgency, claim to reverse money, or ask you to approve a prompt you did not initiate.

Warning signs and first actions

If you suspect SIM swap or account takeover, contact the mobile provider using a verified route from its official site, secure the affected accounts from a trusted device, and notify the bank or wallet if financial access may be exposed. Save message times and case references.

• Your phone unexpectedly loses mobile service or the SIM stops registering.
• You receive password-reset or account-change messages you did not request.
• A payment or sign-in prompt appears without your action.
• Your wallet or merchant account shows activity you do not recognise.

Reduce recovery risk

Use unique passwords and enable available security features. Keep contact and recovery details current, but secure the email account that can reset other services. Review account activity and remove old devices when the platform offers that control.

Safaricom provides account and SIM-swap security information through its official channels. Airtel Kenya also publishes customer-care details and notes it will not ask for a PIN or OTP. Check current instructions directly with the relevant network operator.