Scam Artists Remotely Swapping SIM Cards to Defraud Kenyans

There’s nothing as scary as realizing that you are under attack and there’s really nothing you can do about it, this emotional state and sense of helplessness is heightened when it’s something you do not understand completely.

A recent event narrated by a tweep has left many Kenyans in a panic mode, some even opting to disable mobile money and mobile banking services or switch service providers after a number of people told stories of how they have lost thousands of shillings to fraudsters through unauthorized SIM swaps.

Sammy (@sammy_ynwa) threaded his experience on Twitter, “I am a Safaricom customer with Tel No. 07213***73. I am a victim of a scam that happened to me yesterday. I got a call and I quickly realised that this is one of the cons and I disconnected the call without sharing any information…” he starts.

He then explains that immediately after disconnecting from the call, he got an SMS notification from Safaricom alerting him that they had received a SIM swap request on his number, a task he claims he did not initiate. “Since I was not aware of any sim swap, I contacted @SafaricomPLC via Twitter and they assured me that my line was safe,” he narrates. From here, things get a little scarier…

“I then got several SMSs from Safaricom confirming what my PUK number is. I had not sent any requests to know my PUK. Happening concurrently, my line was topped up with Ksh 5. I informed Safaricom of this, but they were confident that my line was safe… In the evening at 7:25pm, I got another SMS telling me my number is being swapped. I immediately contacted @Safaricom_Care. As I was engaging them on Twitter, my line went dead. I called them immediately to have the line blocked which they did.”

The biggest questions Sammy has is how a SIM swap was initiated without him being physically present at a Safaricom Customer Care Center and answering questions on his recent transactions as is usually the case for such an operation.

Such Cases Date Back to Two Years Ago

Following this thread, a number of Kenyans came out that either they or someone close to them has been a victim of the SIM swap heist. “It happened to me 2 years ago. I called Safaricom customer care immediately after I noticed my line was dead. However, the person who swapped my line was able to borrow money from Mshwari. I had to repay the 4k,” tweeted @PWamugunda

“My friend lost KShs. 1,500 (all the money that was in her MPESA at the time). Fraudulent people called her pretending to be @Safaricom_Care staff, sent 5 bob to her MPESA and somehow accessed her MPESA and swept all the balance left in there,” read another tweet by @acollolo

“Sammy, I went through the same 3 wks ago. That Friday afternoon. Someone kept flashing me with a hidden number several times, my phone lost network at around 5pm. On contacting Safaricom Via twitter. I was told my SIM was swapped at Safaricom Sarit centre at 5:17 pm,” @jndinya responded.

Inside Job

As many people do not understand how exactly these SIM swaps are being done, there have been unconfirmed conclusions that Safaricom staff and agents could be involved.

Should we conclude that Safaricom staff are partly behind these scam from the above questions? Its becoming scary.

— Anzazi Kitsao (@Anzazi1) July 17, 2018

This is scary! Some of these must be inside-job manenos!

— Simon Lagat™ (@LagatSKL) July 16, 2018

Most of the fraud on Mpesa and safaricom is from the staff or agents contracted by Safaricom .These people have studied the system and know the Loopholes .If that's not true then Safaricom are so careless and there systems need to be audited and Implement GDPR to secure our data

— lewy (@munenelewy) July 17, 2018

There’s even speculation that mobile money lending apps could be the source of all this pain:

I think it has something to do with the money lending apps; tala, branch etc

— Dragonfly (@Jahlykips) July 17, 2018

We have reached out to Safaricom for a comment on the matter and we will update this article once we have an official response, all we can report for now is that according to their Twitter account, they are looking into the matter.