The New Tricks Fraudsters Use, and How to Stay Ahead of Them - tech-ish

This story has significance for readers across Kenya and beyond.

A phone call that sounds exactly like your daughter asks you to send money quickly. It is not her. Current tools can clone a voice from as little as three seconds of audio, about fifteen at most, depending on the tool. A WhatsApp voice note is plenty. To be clear about what we know: no Kenyan voice-cloning case has been publicly documented with names and dates yet. The cases on record are from abroad. But every ingredient is already here, the tools are free or cheap, and the rest of the AI scam toolkit is very much active in Kenya.

Scams themselves are not new. What AI changed is that it removed the old tells. The misspelt SMS, the robotic voice, the too-obvious fake video: those signals are disappearing, and one fraudster can now run a thousand personalised attempts at once. Kenya’s Communications Authority logged over 4.5 billion cyber threat events between October and December 2025, up 441 percent on the three months before. The regulator linked part of that surge to criminals using artificial intelligence. Cybersecurity firm Serianu estimates Kenya lost around KES 29.9 billion to cybercrime in 2025, and we have reported before on TransUnion data showing 81 percent of Kenyans were targeted by fraud attempts in early 2025, with fraudulent phone calls the most common type.

This article walks through the four tricks doing the most damage, then the habits that defeat them. None of the defences needs a smartphone newer than the one you have, and most take under five minutes to set up.

Is that celebrity investment video real?

A deepfake is a video or audio clip manufactured by AI to show a real person saying something they never said. In Kenya, the most common use is the fake endorsement: a familiar face appears to promote an investment platform or money-making app with guaranteed returns.

The endorsement usually leads somewhere: a platform promising AI-powered trading profits. That is how CBEX worked. The scheme promised returns of 100 percent in 30 days through supposed AI trading and collapsed in April 2025 taking money from Kenyans and Nigerians with it. Estimates of the total losses vary widely; Nigerian reports have put them above one trillion naira, and no audited figure exists.

The tell: no legitimate investment recruits through a celebrity video, and guaranteed returns do not exist. If an opportunity arrives as a video of a famous person, treat the video itself as a scam.

Can a scammer really clone my voice?

Yes. Voice cloning tools take a sample of someone’s speech and generate new audio of them saying anything. Researchers at McAfee showed as far back as 2023 that a few seconds of audio produced a convincing match, and the tools have only improved since.

The format abroad is consistent: a family-emergency call, or a call from the “boss” instructing an urgent payment. The caller sounds right, the situation is urgent, and the ask involves money and secrecy.

The tell is the combination: urgency, secrecy and payment. The easiest way to defend yourself costs nothing. Hang up and call the person back on the number you have saved for them. Agree a code word with your family that a caller must produce before anyone sends money. The code word works because cloning tools copy how someone sounds, not what they know. A scammer with a perfect copy of the voice still cannot produce a word your family agreed in private.

How do I know an M-PESA message is genuine?

Phishing means messages designed to trick you into giving up money or information, and smishing is the SMS version. AI writes them fluently now, in good English and good Kiswahili, so bad grammar is no longer a warning sign.

In Kenya the common shapes are the fake M-PESA reversal request, the fake customer care call, and the fake payment prompt from an unfamiliar till. Local TV stations have also reported fraudsters leaning on confusion around M-PESA name masking, the feature that hides your full name and part of your number on payment messages, by posing as helpers who can “verify” a masked sender. There is no such process. If you need to know who sent you money, forward the transaction SMS to 334 and the sender can consent to share their details, as we explained when masking launched.

The best way to know it’s a scam is easy, and worth memorising: genuine Safaricom calls come from 0722000000 only. No genuine agent will ever ask for your M-PESA PIN. And before you confirm any payment, Hakikisha, the M-PESA prompt that shows you the recipient’s name before you complete a transaction, gives you a chance to stop and read.

What does *100*100# do?

It blocks the SIM swap, which is the endgame of most serious fraud, because whoever controls your SIM controls your calls, your SMS codes and your M-PESA. The fraud works by getting a replacement copy of your SIM issued to someone else. The details fraudsters use are often harvested through the tricks above, or bought from Kenya’s underground data market.

The protection takes one dial. Enter *100*100# on your Safaricom line and confirm the prompt. After that, your SIM can only be replaced at a Safaricom Shop or Care Desk with your ID, or by calling Safaricom yourself. That closes the remote route SIM swappers depend on. We have written about this protection since 2022.

The habits that beat every scam here

- Dial *100*100# once. It is the single highest-value step on this list.

- Never give your PIN to anyone who calls you, no matter who they claim to be.

- Don’t use your date of birth as your PIN. Don’t keep your ID behind your phone cover. Don’t write your PIN down and store it behind your phone. Together, those three habits stop your pocket from carrying a complete fraud kit.

- Verify voices the old way: hang up, call back on the saved number, and use a family code word.

- Verify senders with 334 and read the Hakikisha name before confirming payments.

- Inside My OneApp, Safaricom says any transaction in a mini app asks for your PIN again before it goes through. Mini apps are the small services that run inside the main app, such as Ziidi Trader, Safaricom’s service for buying shares at the Nairobi Securities Exchange. The app also locks if your SIM is removed and reinserted.

Where do I report M-PESA fraud?

Forward scam texts to 333. Report fraud anonymously to the Directorate of Criminal Investigations (DCI), Kenya’s detective police unit, on 0800 722 203 or on WhatsApp at 0709 570 000. For wider cyber incidents, KE-CIRT, Kenya’s national Computer Incident Response Team, takes reports at ke-cirt.go.ke. And if your personal data was misused, the Office of the Data Protection Commissioner (ODPC) takes complaints at odpc.go.ke.

The scams got smarter, but the defences are still simple, and they are mostly habits rather than technology. Dial *100*100# now. Agree a code word with your family this evening. And the next time a message or a voice pushes you to act urgently and secretly about money, treat the urgency itself as the warning.

Share this with someone who uses M-PESA: Never share your M-PESA PIN. Dial *100*100# to block SIM swaps. Hang up and call back on the saved number. Agree a family code word. Forward scam texts to 333. Safaricom only calls from 0722000000. DCI fraud line: 0800 722` 203.

Reporting originally appeared via Tech-ish Kenya. Read the full source for additional context.