Cybersecurity Basics for Finance Teams Handling Mobile Payments

If your business takes payments through M-Pesa or a similar mobile money channel, you are already running a real-time financial system — and real-time systems are exactly what fraudsters look for. Money that moves in seconds is hard to claw back once it's gone. Most small businesses in Kenya assume cybersecurity is a bank's or telco's problem, not something a five-person finance team needs to think about. That assumption is what makes finance and ops staff handling mobile payments such an attractive target.

You don't need a security department or a big budget to close most of the gaps fraudsters exploit. You need to understand how the common scams work, and put a handful of unglamorous habits in place. That's what this post covers — no jargon, just what to watch for and what to do about it.

Why finance teams handling mobile money are a prime target

Mobile money fraud in Kenya is a mature criminal industry with its own playbooks and scripts, refined and passed around constantly. Finance and ops staff are targeted specifically, not randomly, for a few reasons:

• Speed works against you. An M-Pesa transaction settles in seconds. There's no 24-hour hold, no batch process where someone catches an anomaly. Once money leaves, it's usually gone, and recovery depends on how fast you report it.
• Confirmations can be faked. The SMS or screenshot your team relies on as "proof of payment" is just text and an image. Both can be edited or forwarded from an unrelated transaction. If verification ends at "I saw the message," you have no real verification.
• Staff, not systems, are the entry point. Most successful attacks convince a person to act voluntarily: read out a number, approve a prompt, trust a message that looks legitimate. Your weakest link is whoever is least trained, not whichever server is least patched.

None of this requires your business to be large. A single till number and a couple of staff handling daily reconciliation is enough exposure to be worth targeting.

The fraud patterns actually hitting Kenyan businesses

SIM swap attacks

A SIM swap happens when someone convinces your mobile carrier to move your business phone number onto a SIM they control — usually through social engineering at a carrier shop, a compromised agent, or stolen identity documents. If your M-Pesa business line gets swapped, the attacker inherits your OTPs, your STK push confirmations, and potentially the account itself. This is a serious threat precisely because the weak point sits on the carrier's side, not inside your business — you often only find out once you stop receiving expected messages.

Phishing and social engineering for STK push and OTPs

This is the most common attack by volume. A caller poses as Safaricom support, a bank agent, or "head office" and creates urgency: your line will be suspended, a transaction needs confirming, a system upgrade requires verification. They ask staff to read out an OTP, approve an STK push "to reverse a wrong transaction," or share a PIN "for verification." No legitimate support process ever needs your PIN or an OTP read aloud.

Fake payment confirmation to release goods early

A buyer sends a doctored SMS or screenshot showing a completed payment and asks the seller to release goods immediately, citing urgency — a delivery deadline, a "system delay" on the money coming through. By the time staff check the actual account balance, the buyer and the goods are gone.

Insider manipulation of reconciliation records

Not every threat comes from outside. A staff member reconciling mobile money statements against sales records is in a position to quietly under-report collections, delay recording a payment, or adjust figures to cover a shortfall elsewhere. This fraud is slower and less dramatic than a SIM swap, but it can run for months undetected if reconciliation is infrequent or handled by one person with no second check.

Controls that don't require a security team

Verify through the official channel, every time

Make it a firm rule: a sale is only confirmed when someone checks the actual M-Pesa statement, the paybill/till dashboard, or the payment API callback — never a forwarded SMS or screenshot alone. This is the single highest-value habit here because it directly defeats the fake confirmation scam, and it costs nothing.

Dual approval for large outgoing payments

Any payout above a threshold you set — a supplier payment, a refund, a salary disbursement — should need sign-off from two people, not one. This doesn't need software. One person initiates, a second person approves before the transaction goes out, closing off both external social engineering and internal manipulation.

Lock down the SIM cards tied to your business lines

Treat the SIM card behind your business M-Pesa line like a financial instrument, because it is one. Keep it under the control of a specific, accountable person rather than passing the device around. Register a backup line where possible, and if you receive an unexpected "SIM swap requested" notification you didn't initiate, treat it as an active incident, not spam.

Basic device hygiene

Screen locks on every phone with active M-Pesa access, no exceptions, even for the office "shared" phone. Don't leave a phone logged into a mobile money app unattended on a counter. It sounds obvious, but it's skipped constantly — and an unlocked phone is one of the easiest doors to opportunistic misuse.

Use official APIs instead of reading numbers over the phone

One of the most persistent bad habits in Kenyan business payments is staff reading out till numbers, account numbers, or worse, OTPs over the phone to "help" a customer or a caller claiming to be support. Every number read aloud is a social engineering opportunity. Integrated payment flows — an STK push triggered directly from your point-of-sale or invoicing system, or a proper API integration with Safaricom's Daraja platform — remove that human relay step entirely. The customer gets a prompt on their own phone, tied to their own transaction, and your staff never becomes the channel for sensitive information. If you're still dictating payment details over calls or WhatsApp, moving to an integrated checkout is one of the highest-leverage upgrades available, and it often pays for itself in reduced fraud alone.

Staff training that actually works

A once-a-year memo about "beware of fraud" doesn't change behavior. What works is showing staff the actual shape of a scam in this context: the "your line will be suspended" call, the "confirm your PIN for the system upgrade" SMS, the urgent buyer who needs goods released over a screenshot. Walk through real examples and rehearse the correct response out loud: hang up, verify independently, never read out a PIN or OTP. Treat training as an ongoing control, refreshed whenever a new scam pattern shows up, not a one-time onboarding checkbox.

Reconciliation discipline as a detection tool

Monthly reconciliation is far too slow to catch fraud while it's still stoppable. By the time a discrepancy surfaces weeks later, the money is gone and the trail is cold. Daily reconciliation turns fraud detection from an autopsy into an early warning system. It doesn't need to be complex — a short daily check comparing what the till/paybill statement shows against what was recorded as sold is enough to flag a mismatch within 24 hours, while there's still a chance to act.

The first hour if you suspect fraud

Speed matters more than perfection here. In the first hour after you suspect fraud on a business line or account:

• Report to the telco immediately. Call Safaricom (or your carrier) to report a suspected SIM swap or unauthorized activity and request the line be frozen. The sooner this happens, the smaller the window for damage.
• Change access credentials. Reset PINs, passwords, and linked app credentials for the affected account, assuming they may already be compromised.
• Preserve evidence. Screenshot messages, save call logs, note timestamps, and don't delete anything, even if it seems embarrassing — this is what makes a report actionable.
• Notify affected parties. Tell your bank if funds moved through it, alert staff so they don't fall for a follow-up attempt, and inform customers if involved.

You don't need a formal incident response plan with binders and escalation trees. You need one person who knows these four steps cold and acts on them immediately instead of waiting for a manager's approval.

A checklist you can implement this month

• Set a rule: payment confirmation always means checking the statement/API, never a screenshot or SMS alone.
• Set a payout threshold above which two people must sign off before money leaves.
• Identify who physically controls each business SIM card and lock that down to one accountable person.
• Register a backup line for your business M-Pesa number if your carrier supports it.
• Turn on screen locks for every device with active mobile money access, no exceptions.
• If you're still reading out numbers over calls, price out an STK push or Daraja API integration this month.
• Run one 20-minute staff session walking through real phishing/social engineering examples relevant to mobile money.
• Switch reconciliation from monthly or weekly to daily, even if it's a simple manual check.
• Write down the four first-hour steps (freeze, change credentials, preserve evidence, notify) and make sure at least two people know them.

None of this is expensive or technical. It's about refusing to treat "we've never had a problem" as a strategy — the businesses that get hit hardest are usually the ones that assumed they were too small to be worth targeting.