How Fake Agents and Copy-Paste Till Numbers Are Stealing Trust — and the Four Checks That Can Protect Your M-PESA
| A genuine payment request should survive four questions: Who gave me this number? Did I enter it myself? What name does Hakikisha display? Does my own M-PESA confirmation prove where the money went? |
The theft often begins with something that looks ordinary: a WhatsApp message from a person calling themselves an agent, a paper Till number placed beside a counter, a social-media comment that appears to come from a company, or a copy-pasted Paybill sent after a customer asks how to pay. There may be no threatening language, no obvious spelling mistake, and no dramatic promise. The fraudster simply tries to place a false payment destination inside a normal transaction, then relies on hurry, familiarity, and embarrassment to carry the money the rest of the way.
Consider Mercy, a fictional composite based on common payment-scam patterns. She runs a small salon and needs hair products before the weekend rush. She finds what appears to be the official page of a well-known distributor and sends a direct message. A friendly ‘sales agent’ replies immediately, confirms the items, calculates delivery, and sends a Till number. The profile picture carries a logo. The messages are polite. The agent even knows the names of several products. Mercy is told that stock is moving quickly and that her order will only be reserved after a KES 18,400 deposit.
She opens M-PESA, selects Buy Goods and enters the number. Before the transaction is completed, Hakikisha displays a business name she has never seen. Mercy asks why. The agent replies that the company’s main Till is ‘under maintenance’, so payments are temporarily being received through the director’s private merchant account. He adds that dozens of customers have already paid and sends screenshots of supposed confirmations. That explanation is the trap. The unfamiliar name is not a minor inconvenience to ignore; it is the strongest warning on the screen.
Mercy stops. She searches for the distributor’s official telephone number independently, calls it, and reads out the Till number. The real company says the number is not theirs and that no such agent works for them. Her money remains in her account because she treated the name on the payment screen as evidence, not decoration. The entire rescue took less time than chasing a fraudster after the money had left.
A fake agent does not have to wear a Safaricom uniform or stand inside an M-PESA shop. The person may pose as a school bursar, hospital cashier, landlord, online seller, courier, utility-company employee, loan officer, event organiser, fundraising coordinator or customer-care representative. The fraudster’s objective is the same: convince the victim to trust the messenger before verifying the destination. Copy-paste Till and Paybill fraud works because a six-digit number is easy to forward, easy to replace on an invoice, and easy to type without thinking. A copied number can look official even when it belongs to an unrelated merchant.
The first defence is independence. Never verify a Till or Paybill number using only the person, page, call, poster or message that supplied it. A criminal can answer every question asked inside the channel they control. Confirm the number through a separate source that you find yourself: the organisation’s official website, a verified account, a printed invoice obtained directly from its premises, an earlier statement you already trust, a telephone number saved before the dispute arose, or a known employee reached through an established contact. When paying in a shop, compare the number displayed at the counter with the number on the business’s permanent signage and ask the cashier to state the registered business name that should appear on Hakikisha. A handwritten sticker placed over another number, a rushed instruction to use a ‘temporary Till’, or a sudden change communicated only through WhatsApp deserves an immediate pause.
The second defence is control of the payment process. Open the official M-PESA menu or app yourself. Do not hand your unlocked phone to an ‘agent’. Do not use a link that claims it will open a special payment page, and do not dial codes dictated by a stranger. Choose the correct route: Buy Goods and Services for a T