SMS Scams and Fraud in Kenya 2026: What the Regulator’s Complaints Data Shows

By the Connect Media Editorial Team · Published 3 October 2026 · Data to 30 June 2026 · Methodology · Sources

Every Kenyan with a phone has met the message: a mistaken M-Pesa transfer you must send back, a prize you never entered, a warning that your SIM card will be switched off. This report asks how big the problem is, using the one set of figures that is published on a regular schedule: the complaints consumers escalate to the Communications Authority of Kenya (CA). It also looks at what surveys and law-enforcement reports add, how the main scams work, and what a business can do so that its own text messages are recognised as genuine.

Key findings

1. What the regulator’s complaints data shows

The CA publishes a consumer-complaints report each quarter. It counts only complaints that consumers were unable to settle with their provider and then escalated to the regulator, so it is a floor, not a census of fraud. Even so, the direction is clear. The Q4 report (April–June 2026) records 670 escalated complaints, 82% of them resolved [1]. In the quarter before there were 563 [2], and in October–December 2025 about 362 [3].

Fraud and scams sit inside the CA’s “Digital Financial Services and Mobile Money” category. That category received 110 complaints in Q4 2025/26, and 86 of them were fraud and scams, against 47 in Q3 [1][2]. The CA says fraud has moved “from traditional fraudulent calls and text messages to more complex schemes involving phishing, impersonation, fake promotions, social engineering, fraudulent mobile money transactions and online marketplace scams” [1]. In other words, the text message is increasingly the first step of a scam that is completed on a mobile money wallet.

2. What surveys and law enforcement add

Complaint counts understate exposure because most people who receive a scam message never complain. A World Bank survey across ten sub-Saharan countries found that 49% of Kenyan mobile owners had received at least one scam call or text. Across the countries, only about 2% of those targeted actually sent money; roughly half the targeted users simply ignored the attempt [4]. That is a useful way to read the problem: scams are cheap to send in bulk, so even a very low conversion rate pays.

On the law-enforcement side, INTERPOL’s African Cyberthreat Assessment Report 2026 reports that SIM-swap fraud rose 327% in 2025, with more than 123,000 fraudulent SIM cards issued and about US$3.8 million (KSh 491.6 million) stolen from mobile wallets in Kenya [5]. SIM swap matters to anyone who sends text messages for a living, because it lets a criminal receive the one-time passwords that businesses send. The CA’s own Q4 report flags “weaknesses in customer identity verification” and, in isolated cases, possible non-compliance with procedures that expose consumers to unauthorised SIM replacement [1].

3. How the common SMS scams work

The scripts change, but the mechanics repeat. Each of the five below combines a believable hook with an instruction to act quickly and outside the official channel.

The CA has specifically warned about the “maximum SIM cards” message. In an April 2020 alert, it described messages impersonating the regulator that told people they had registered the maximum number of lines and pushed them to reveal ID numbers, passwords or card details. The CA’s position was that mobile operators and their agents are the only bodies authorised to register SIM cards and that the regulator would never ask subscribers for personal information for registration [6]. The same script keeps circulating, which is why it appears in the quiz below.

4. What operators and the regulator are doing

• The CA says it is strengthening oversight of SIM registration, replacement and lifecycle management, checking that operators verify customers’ identity before replacing a SIM, and promoting fraud detection and early-warning systems at licensed providers [1].
• Operators. Airtel Kenya was reported to have deployed an AI system that examines more than 250 factors, including sender behaviour, message frequency and target locations, to block scam traffic [4]. Safaricom was reported to send a confirmation SMS when someone tries to register a new SIM against a customer’s ID, and to let customers stop unauthorised SIM swaps with a USSD code [7]. Check your operator’s current instructions, because these services change.
• Consumers are told to guard personal information, report suspected SIM fraud promptly and keep the contact details on their critical accounts up to date [1].

5. For businesses: how to be the sender customers trust

Every scam message teaches customers to distrust text messages from businesses. A genuine sender can fight that effect by being predictable. Customers should be able to recognise a real message from the sender name, from what it asks for and from what it never asks for. Two further reasons to care: your SMS account can be abused to send scams if API keys leak, and sending to people who did not opt in generates the “unsolicited communication” complaints the CA counts every quarter [1].

Practical tools that help: a registered sender ID so messages arrive under your name, one-time-password messages written to a fixed template with an expiry and a do-not-share line, and bulk SMS with opt-in lists and a working opt-out. If you send marketing messages, our guide to SMS marketing under the Data Protection Act covers consent. For account security, keep API credentials out of source code and rotate them if they leak; our developer documentation shows how.

Methodology and limitations

The core data come from the CA’s quarterly Consumer Complaints Reports for Q4 FY 2025/26 [1] and, for Q3, the figures reported by Capital FM [2]. We computed the 83% rise as 86 divided by 47. The Q2 figure of 362 total complaints comes from press coverage of the Q4 report [3]. Survey and law-enforcement figures are quoted as reported by the media outlets cited [4][5]. Limitations: (1) the CA counts only escalated complaints, so it understates real incidence; (2) the CA does not report SMS scams as a separate category; (3) the World Bank survey figures are survey-wide and we could not retrieve the original publication, so we cite the news report of it; (4) the scam examples in the quiz are constructed for illustration; (5) operator anti-fraud features are quoted from press reports and may have changed. Corrections are welcome at info@connectmedia.co.ke.

Frequently asked questions

Sources

1. Communications Authority of Kenya, Quarter 4 FY 2025/2026 Consumer Complaints Report (April–June 2026). ca.go.ke
2. Capital FM, “Consumer complaints to CA rise to 563 in Q3”, 21 June 2026. capitalfm.africa
3. Nation, “Telcos under pressure as scam complaints up 83pc”. nation.africa
4. Eastleigh Voice, “Nearly half of Kenyan mobile users targeted by scams — World Bank”, 20 August 2025. eastleighvoice.co.ke
5. Dawan Africa, reporting INTERPOL’s African Cyberthreat Assessment Report 2026, 3 August 2026. dawan.africa
6. Kenyans.co.ke, “Kenyans warned over new scam fraudsters are using to swindle them”, 23 April 2020 (CA warning on the maximum-SIM-cards message). kenyans.co.ke
7. The Kenya Times, “How to check all numbers registered with your ID”; Kenyan Wall Street on Safaricom’s M-Pesa anti-fraud update. thekenyatimes.com; kenyanwallstreet.com
8. Connect Media, The State of SMS in Kenya 2026.