How to Prevent M-Pesa Fraud on Your Kenyan Business Till Number

M-Pesa fraud targeting business till numbers has grown faster than most shop owners can respond to it. Criminals intercept legitimate customer payments, redirect them to fake till accounts, or use social engineering to drain balances. If your business relies on M-Pesa—and most do—your till number is a target.

The damage isn't just financial. A compromised till damages customer trust, creates accounting nightmares, and can trigger unwanted attention from tax authorities if transactions don't match your records. The good news: most fraud succeeds because businesses skip basic security steps, not because the attacks are sophisticated.

Secure Your Till Number at Source

Your till number is the core vulnerability. Treat it like you'd treat your bank PIN. Register it directly through Safaricom's official portal at safaricom.co.ke, not through third-party resellers or informal channels. Verify every step with Safaricom customer support before you start accepting payments.

Change your till PIN immediately after setup. Use a combination that has no connection to your name, business address, or common sequences. Many businesses use the default PIN or share it openly with staff—both are invitations to fraud.

Limit who knows your till number. Your accountant needs it. Your manager needs it. Your nephew who sometimes helps out does not. Document everyone with access and change your PIN every six months or whenever staff leave.

Spot and Stop Fake Payments Daily

Fraudsters send screenshots of M-Pesa confirmations that never actually hit your till. They look convincing. The customer walks out thinking they've paid. You discover the shortfall hours later.

Check your M-Pesa merchant portal directly—never rely on screenshots. Log into your till dashboard at least twice daily. Compare the transactions recorded there against your shop records. If a customer claims they sent KSh 5,000 but your till shows KSh 2,000, ask them to show you the exact M-Pesa reference number and verify it yourself before handing over goods.

Keep daily settlement reports. Download them from your till dashboard and store them safely. This paper trail protects you if disputes arise and helps business setup experts advise you on tax compliance issues later.

Watch for patterns. If specific customers or time periods show sudden surges in failed transactions, that's a red flag. Report it to Safaricom immediately through their fraud hotline.

Train your staff ruthlessly on this. Every till operator should know: no screenshot, no sale. Make it a rule with teeth. Staff members who let fraudsters slip through should face consequences—not firing necessarily, but retraining and accountability.

Enable transaction alerts on your till account. Safaricom allows SMS notifications for every deposit. Review them. Any unexpected activity deserves immediate investigation.

If you're unsure about your security setup or need help documenting your processes for compliance, find a verified Kenyan expert on Kaziiko who specializes in retail business security and can audit your current system.

Frequently Asked Questions

What should I do if I discover fraud on my till number?

Contact Safaricom customer support immediately. File a detailed report with the exact transaction references, amounts, and dates. Request a transaction freeze while they investigate. Report it to the police as well—you'll need an Occurrence Book number for your records. Keep copies of everything.

Can I recover money lost to M-Pesa till fraud?

Recovery is slow and uncertain. Safaricom investigates, but if the fraudster has already withdrawn or transferred the money, retrieval is difficult. Prevention is far more reliable than recovery. That's why daily monitoring matters.

Should I use multiple till numbers for different branches?

Yes. If one till is compromised, you don't lose access to all your branches at once. Each till number should have its own PIN and separate reconciliation process.

What's the safest way to share my till number with customers?

Print it clearly on receipts, signage, and your social media pages—but only your official till number. Never share it via personal phone calls or unverified messages. If a customer receives your till number from anywhere other than your official channels, they should verify it by asking staff in person.