How Fake Agents and Copy-Paste Till Numbers Are Stealing Trust — and the Four Checks That Can Protect Your M-PESA

The theft often begins with something that looks ordinary: a WhatsApp message from a person calling themselves an agent, a paper Till number placed beside a counter, a social-media comment that appears to come from a company, or a copy-pasted Paybill sent after a customer asks how to pay. There may be no threatening language, no obvious spelling mistake, and no dramatic promise. The fraudster simply tries to place a false payment destination inside a normal transaction, then relies on hurry, familiarity, and embarrassment to carry the money the rest of the way.

Consider Mercy, a fictional composite based on common payment-scam patterns. She runs a small salon and needs hair products before the weekend rush. She finds what appears to be the official page of a well-known distributor and sends a direct message. A friendly ‘sales agent’ replies immediately, confirms the items, calculates delivery, and sends a Till number. The profile picture carries a logo. The messages are polite. The agent even knows the names of several products. Mercy is told that stock is moving quickly and that her order will only be reserved after a KES 18,400 deposit.

She opens M-PESA, selects Buy Goods and enters the number. Before the transaction is completed, Hakikisha displays a business name she has never seen. Mercy asks why. The agent replies that the company’s main Till is ‘under maintenance’, so payments are temporarily being received through the director’s private merchant account. He adds that dozens of customers have already paid and sends screenshots of supposed confirmations. That explanation is the trap. The unfamiliar name is not a minor inconvenience to ignore; it is the strongest warning on the screen.

Mercy stops. She searches for the distributor’s official telephone number independently, calls it, and reads out the Till number. The real company says the number is not theirs and that no such agent works for them. Her money remains in her account because she treated the name on the payment screen as evidence, not decoration. The entire rescue took less time than chasing a fraudster after the money had left.

A fake agent does not have to wear a Safaricom uniform or stand inside an M-PESA shop. The person may pose as a school bursar, hospital cashier, landlord, online seller, courier, utility-company employee, loan officer, event organiser, fundraising coordinator or customer-care representative. The fraudster’s objective is the same: convince the victim to trust the messenger before verifying the destination. Copy-paste Till and Paybill fraud works because a six-digit number is easy to forward, easy to replace on an invoice, and easy to type without thinking. A copied number can look official even when it belongs to an unrelated merchant.

The first defence is independence. Never verify a Till or Paybill number using only the person, page, call, poster or message that supplied it. A criminal can answer every question asked inside the channel they control. Confirm the number through a separate source that you find yourself: the organisation’s official website, a verified account, a printed invoice obtained directly from its premises, an earlier statement you already trust, a telephone number saved before the dispute arose, or a known employee reached through an established contact. When paying in a shop, compare the number displayed at the counter with the number on the business’s permanent signage and ask the cashier to state the registered business name that should appear on Hakikisha. A handwritten sticker placed over another number, a rushed instruction to use a ‘temporary Till’, or a sudden change communicated only through WhatsApp deserves an immediate pause.

The second defence is control of the payment process. Open the official M-PESA menu or app yourself. Do not hand your unlocked phone to an ‘agent’. Do not use a link that claims it will open a special payment page, and do not dial codes dictated by a stranger. Choose the correct route: Buy Goods and Services for a Till, or Pay Bill for a Paybill. Enter the number yourself, digit by digit, from the independently verified source. For a Paybill, confirm the account or reference separately as well, because fraudsters can alter both the business number and the account field. Re-read the amount before proceeding. A scammer benefits when the customer focuses on the goods and treats the payment details as a formality.

The third defence is Hakikisha. Safaricom describes Hakikisha as the M-PESA safeguard that allows a customer to confirm the recipient’s name before completing a transaction, and it is also available for Paybill payments and agent-related transactions. The important habit is not merely waiting for the screen to appear; it is reading what it says and comparing it with what you expected. Say the displayed name aloud. Ask: Is this the business, institution or person I intended to pay? Does the name make commercial sense? Can the merchant explain and independently prove any difference between the trading name on the shopfront and the legal or registered name shown by M-PESA? A legitimate business may trade under a brand that differs from its registered entity, but the difference should be verifiable through official records or established company contacts. ‘Just ignore the name’, ‘the Till belongs to our accountant’, ‘our system is down’, ‘pay first and we will correct it later’ and ‘everyone uses this number’ are not verification. They are pressure.

The fourth defence is confirmation after payment. Before entering your PIN, make one final comparison: payment route, Till or Paybill number, displayed recipient or business name, account reference, amount and transaction cost. Only proceed when the entire picture is consistent. After paying, rely on the confirmation received on your own phone and the record in your own M-PESA account. Safaricom advises merchants to confirm payments through their own notification line or statement rather than accepting a customer’s screenshot, because screenshots and SMS messages can be edited, recycled or taken from an older transaction. The same principle protects customers: a forwarded screenshot from an ‘agent’ proves nothing about the account you are being asked to pay.

These four checks are deliberately simple because fraud prevention must work when a customer is tired, distracted, in a queue, speaking to an impatient seller or trying to solve an urgent problem. The rule can be remembered in four words: Source. Enter. Name. Confirm. Source means find the payment details independently. Enter means control the phone and type the details yourself. Name means use Hakikisha and stop at any mismatch. Confirm means review the whole transaction and keep your own genuine record.

THE FOUR CHECKS TO COMPLETE BEFORE EVERY TILL OR PAYBILL PAYMENT

The most dangerous moment is often the moment after a mismatch is noticed. Many victims actually see the wrong name, but the fraudster supplies a quick explanation and social pressure does the rest. The customer worries about appearing difficult, losing the bargain, delaying a delivery or embarrassing the cashier. That is why consumers must normalise cancellation. Pressing ‘No’, going back, calling the organisation and asking for proof is not rude. It is responsible financial behaviour. A genuine seller who values customers should welcome reasonable verification.

A copied Till number can also be planted physically. A fraudster may place a small printed label over a genuine number, send customers to a personal Till while pretending to assist at a busy counter, or change a number on a digital menu, poster, invoice or social-media graphic. Businesses should inspect their payment displays daily, remove unofficial stickers, train staff to state the registered name customers should see and place one verified payment notice where it cannot be casually replaced. Customers should become especially careful when a payment instruction is handwritten, sent from a personal number, introduced as a temporary emergency measure or accompanied by a demand for secrecy.

Online, a polished profile is not proof. Logos can be copied, page names can be changed, and fake support accounts can respond beneath genuine customer complaints. A common pattern is for the impersonator to say, ‘Please inbox us your number so our agent can assist,’ then move the victim into a private conversation where a false Till or Paybill is supplied. Do not judge legitimacy by profile photographs, follower counts, screenshots or the speed of the reply. Use verified accounts and independently published contact details. Safaricom states that it will not ask customers for their M-PESA PIN, passwords or personal details, and warns customers against following instructions from unknown callers.

No merchant, agent or customer-care representative needs your M-PESA PIN to receive a payment. Your PIN is the authorisation that moves your money; it should remain known only to you. Shield the screen while entering it. Reject requests to share an OTP, SIM passcode, account balance, identification details, or a screen-sharing view of your phone. A fraudster who fails to steal through a false Till may attempt a second attack by pretending to help with a reversal.

   Each check closes a different opening used by impersonators and payment-number fraudsters.

When a payment has gone to the wrong destination, speed matters. Do not continue negotiating with the suspected fraudster and do not send another amount to ‘unlock’, ‘cancel’ or ‘refund’ the first payment. Preserve the original M-PESA confirmation, screenshots, phone numbers, profile links, invoice and conversation. Contact Safaricom through official channels immediately. Safaricom’s published guidance says fraudulent numbers or messages can be forwarded to 333. A reversal request can be started through official M-PESA channels, including forwarding the original transaction message to 456, the M-PESA or mySafaricom apps, Zuri or customer care; the method available and whether recovery succeeds can depend on the transaction type and circumstances. Report criminal conduct to the police as well. Never pay a stranger who promises to recover the money faster.

Merchants also have a duty to protect the public. A business that changes a Till or Paybill should communicate the change through several established channels, display the registered recipient name, remove outdated signage and give customers enough time to verify. Staff should never become angry when a customer reads Hakikisha, calls the head office or asks for a written invoice. Payment confidence is part of customer service.

For families, the strongest defence is repetition. Teach parents, teenagers, employees and older relatives the four words: Source. Enter. Name. Confirm. Put them beside the shop till, in the family WhatsApp group and in workplace payment procedures. Before school fees, rent, hospital bills, online purchases, deliveries, fundraising contributions or business deposits, take the pause. The larger the urgency and the stronger the pressure, the more important the pause becomes.

Money rarely disappears because the phone failed to show any warning. It often disappears because a warning was explained away. The unfamiliar name was visible. The number had changed. The agent was rushing. The payment details came from a copied message. The victim felt it would be awkward to stop. Public education must therefore go beyond telling people to ‘be careful’. It must give them a repeatable action they can perform under pressure.

Before you press Send, verify the source independently. Enter the details yourself. Read the Hakikisha name as though your money depends on it—because it does. Confirm the entire transaction and keep your own record. Four checks, one short pause and one firm decision to cancel at a mismatch can stand between an ordinary payment and a painful loss.

Source note: Safaricom Secure M-PESA guidance on Hakikisha, transaction confirmation, fraud reporting and reversal options; Safaricom Fraud Awareness guidance on impersonation and reporting. Accessed July 13, 2026. Safaricom Secure M-PESA | Safaricom Fraud Awareness | M-PESA Reversal

Share this guide. A verified payment is cheaper than a reversal attempt.

Read Also : THE “PRIZE” TEXT THAT CAN EMPTY YOUR M-PESA