What to Do If Your M-Pesa Account Is Hacked or Compromised

Your M-Pesa account is compromised. Money is missing. Someone else knows your PIN. Whatever happened, the clock is ticking—and panic won't help.

If your M-Pesa account is hacked or compromised, your immediate goal is to stop further damage. This means locking your account, reporting the fraud to Safaricom, and filing a police report. The process is frustrating and slow, but doing it right protects you legally and improves your chances of recovering funds.

Here's what actually works, based on what Safaricom requires and what Kenyan law expects.

Stop the Bleeding: First Hour Steps

Lock your SIM card immediately. Visit any Safaricom shop or call 100 (toll-free) and report that your SIM has been compromised. Ask them to block your line. This prevents the attacker from using your phone number to reset your M-Pesa PIN or authorise transactions. Don't wait for an appointment—walk in and make noise if you have to. This single step stops most active fraud.

Change your M-Pesa PIN if you still have access. Open M-Pesa on your phone, go to Settings, then Change PIN. Use a completely new four-digit code that isn't your birthday, phone number, or anything predictable. If you can't access M-Pesa at all, skip this and move to the next step.

Call Safaricom's fraud hotline. Ring 100 or 722200000 and ask to speak to the fraud team specifically. Tell them your account number (the phone number linked to M-Pesa), describe what happened, and request an immediate account freeze. Safaricom will log your complaint with a ticket number—write this down. You'll need it later.

Expect to wait 15-30 minutes on hold. This is normal.

The Next 24 Hours: Official Reports

Visit your nearest police station and file a formal report. Tell the officer exactly what happened: when you noticed the fraud, how much money is missing, and what transactions you didn't authorise. The police will issue you an Occurrence Report Number (OB number). Keep this safe—it proves you reported the crime officially and protects you if the attacker disputes charges later.

Return to Safaricom with your OB number. Hand it to the customer care team and ask them to escalate your case to the Fraud Investigation Unit. This isn't mandatory, but it speeds up their investigation and increases the chance of account recovery.

Request a detailed transaction history. Ask Safaricom for a complete record of all M-Pesa transactions from the past three months. They should provide this within 48 hours. Review it carefully and circle every transaction you didn't make. Send this list back to Safaricom in writing (email or letter)—it becomes evidence of fraud.

The Longer Game: Follow-Up and Recovery

Safaricom's investigation typically takes 30-60 days. During this time, don't close your account or assume it's lost. Check your registered email weekly for updates. If you receive none after two weeks, return to Safaricom with your ticket number and ask for a status update.

Money recovery depends on how quickly you act and where the funds went. If the attacker sent money to another phone number or withdrew it immediately, recovery is harder. If the money is still sitting in another M-Pesa account, Safaricom can sometimes freeze it.

If you run a business and need help navigating fraud recovery or understanding your financial liability, find a verified Kenyan expert on Kaziiko who can advise you on next steps with Safaricom and tax implications.

Prevention: Don't Become a Victim Again

• Never share your M-Pesa PIN with anyone, not even customer care (Safaricom won't ask for it).
• Use a unique PIN that doesn't match your phone number or national ID.
• Enable M-Pesa alerts in your phone settings so you're notified of every transaction immediately.
• Register a backup phone number with Safaricom so you can recover your account if your phone is stolen.
• Don't download M-Pesa from third-party app stores—only use the official Safaricom version.

Frequently Asked Questions

How long does Safaricom take to investigate M-Pesa fraud?

Safaricom's fraud investigation typically takes 30-60 days. Some cases resolve faster if the funds are traceable. If you don't hear back after 45 days, follow up with your ticket number in person at a Safaricom shop.

Will I get my money back?

Maybe. If the attacker transferred your money to another account that Safaricom can freeze, you have a good chance. If they withdrew cash immediately or sent it to multiple accounts, recovery is unlikely. Either way, having a police report and formal complaint filed improves your position.

What if I discover fraud months after it happened?

Report it immediately anyway. Safaricom can still investigate, though the trail will be colder. File a police report regardless of how long ago the fraud occurred. Your claim is still valid, just harder to prove.

Can I close my M-Pesa account after it's been hacked?

You can, but wait until Safaricom's investigation concludes. Closing the account during an investigation can complicate things. Once they've completed their review and issued a response, you can safely close it.