SIM-Swap Fraud and How to Keep Your Business Lines Safe
"Do you have network?" Kiprop asked his colleague in the middle of a Thursday meeting. His phone had suddenly shown "No service". Chebet checked hers: full bars. Kiprop shrugged, blamed his phone and went back to the slides. By the time he restarted it, borrowed a charger and finally called his provider that evening, someone else had been using his number for hours. They had reset his email password, received banking codes by SMS and started moving money. This is SIM swap fraud, and in Kenya, where so much of business runs through a phone number, it deserves serious attention.
How SIM swap fraud in Kenya works
Your phone number is more than a way to call you. It receives one-time codes, password reset messages and confirmations for mobile money and banking. Whoever controls your number can often reset your accounts.
In a SIM swap, a fraudster convinces someone, or a system, to move your number onto a new SIM card in their possession. They might use personal details gathered from social media, a stolen ID, a phishing call or information you shared without thinking. Once the swap happens, your SIM goes dead and theirs comes alive with your number.
The warning signs
Your phone suddenly loses service while others nearby have network
You receive an unexpected message about a SIM replacement or upgrade
Friends say they received strange messages from your number
You get notifications of password resets you did not request
Calls to your number go somewhere else, or nowhere
The most important sign is the first one. If your line dies without explanation, especially if you have recently received odd calls asking for personal details, treat it as urgent. Call your provider from another phone immediately, and contact your bank. Minutes matter here.
Protecting your business lines
Many businesses have important numbers: the line tied to the till, the number registered for online banking, the WhatsApp number customers know. These need more protection than personal lines.
Keep a register of every company line, who holds it and what accounts it is linked to
Register business lines properly with your provider, in the company name where possible
Set a SIM PIN, so a stolen phone cannot simply be used with your SIM
Use authenticator apps instead of SMS codes for email and other key accounts
Turn on transaction alerts with your bank and check them daily
Ask your bank what extra checks they apply after a SIM change on your account
That last point is worth a phone call. Many banks and payment providers have safeguards that delay or flag transactions after a recent SIM change. Find out what yours offers.
Guard the details fraudsters need
SIM swap fraud usually starts with information. Be careful about what is publicly visible: your ID number, date of birth and full name together are a gift to a fraudster. Train staff never to share personal or company details with callers claiming to be from the bank, the network or KRA. A genuine institution will not mind if you hang up and call back on the official number.
Fatuma, who handles finance for a small import company, follows a simple rule she teaches every new hire: "If someone calls asking for information, they are the one who should already have it." It sounds obvious. It works.
When staff leave
A surprising risk is the company line that walks out of the door with a departing employee, still linked to the business banking or the supplier WhatsApp group. When someone leaves, recover or transfer business numbers, update the registered contact numbers on accounts and remove them from anything they no longer need. A proper HR system that tracks company assets helps make sure the SIM card is on the exit checklist alongside the laptop.
Practical tip to end on: save your provider's customer care number and your bank's fraud line in a second phone, or write them on a card in your wallet. When your main line goes dead, that is exactly when you will need them, and you will not be able to look them up.