Safaricom cut fraud incidents by 82 percent in the 2026 financial year and recovered 46 percent of reported fraud losses. It had aimed for a 90 percent cut. The figures come from the Safaricom 2026 Sustainable Business Report, which also lists the systems, partners and certifications behind the result.
This article sets out what the report says Safaricom built, what the numbers show and where customers still carry part of the defence.
How fraudsters use AI against customers
The report says the threat shifted in FY26.
“Threat actors are using AI to accelerate attacks and develop more convincing phishing and social engineering campaigns,” it says. It names deepfakes among the emerging threats that remain “important areas of focus”.
Customers meet this threat as a video, a voice note or a web page that copies Safaricom. Article 1 in this series shows how to spot those fakes.
The report also records social engineering as the leading threat to customers in FY26. It says physical, in person social engineering was the most significant contributor. Fraud still works through persuasion, online and face to face.
The FY26 results in numbers
| Measure | FY26 result |
|---|---|
| Reduction in fraud incidents | 82% (target was 90%) |
| Reported fraud losses recovered | 46% |
| Inflated agent commissions recovered through monitoring and analytics | KSh953 million |
| Intrusion attempts detected and monitored | About 1.25 billion |
| Security events investigated | More than 130,000 |
| Confirmed material cybersecurity breaches affecting customer data or operations | None |
| M-PESA privacy trust score | 70%, up from a low of 63% in FY25 |
| Safaricom privacy trust score | 61%, up from a low of 56% in FY25 |
Safaricom missed its own fraud target, and the report states the gap. Privacy trust scores recovered from their FY25 lows, and the report records no confirmed material breach of customer data.
Fintech 2.0 puts AI inside M-PESA
Safaricom completed the Fintech 2.0 upgrade of the M-PESA platform in FY26. The report describes a platform built on microservices that raised capacity from 4,500 to 6,000 transactions per second, with 99.999 percent availability. It incorporates AI enabled capabilities, including fraud detection, and strengthened real time transaction monitoring.
In practice, the system watches payments as they happen and flags patterns that match known fraud. Khusoko covered the launch in Safaricom unveils Fintech 2.0 in major M-PESA upgrade.
Daraja 3.0 added security APIs for fraud detection, prevention and identity verification. Developers who build on M-PESA can now plug those checks into their own apps. The report counts 149,834 M-PESA developers and 89,780 integrations.
A 24 hour Cyber Defence Centre and 70 AI models
The Safaricom Cyber Defence Centre monitors, detects and responds to threats around the clock. In FY26 the company upgraded it with a next generation Security Information and Event Management platform, more AI powered defence and a threat intelligence platform built in house.
The report lists more than 70 AI and machine learning models in production. It also notes that agentic AI moved from pilot to production in FY26. Safaricom says it is strengthening how it manages the security risks of AI systems themselves.
Safaricom works with others on the threat. The report names a sector wide cybersecurity simulation convened by the Central Bank of Kenya, and joint work with the Communications Authority, National KE-CIRT/CC and Vodacom Group. Khusoko reported on the industry response at the Safaricom Cybersecurity Summit 2025.
Certifications and the next one
Independent auditors certify Safaricom’s security and privacy systems against ISO 27001 for information security, ISO 27701 for privacy, PCI DSS and GSMA Mobile Money.
The company plans to pursue ISO/IEC 42001 certification for AI management systems in FY27.
Less personal data on show means less material for scammers
In March 2026 Safaricom finished data minimisation for M-PESA person-to-person and customer to business payments. Sender notifications now show two names and a masked mobile number. More than 40 million subscribers gain the protection.
The report ties the change to identity theft, unsolicited contact, social engineering and fraud. A scammer who cannot see your full name and number has less to quote back to you when pretending to be someone you trust. For merchant payments, 94 percent of customer names and mobile numbers are now masked, with work continuing towards full coverage.
Khusoko has a guide to protecting your personal data if you want to go further.
Why technology alone does not close the gap
“Technology is only part of the answer,” Group CEO Peter Ndegwa writes in the report. He adds that trust is earned through how the company behaves.
External data shows why. Interpol figures put the rise in SIM swap fraud in Kenya at 327 percent in 2025, with more than 123,000 fraudulent SIMs and about KSh491.6 million drained from mobile wallets. The Communications Authority recorded about 2.7 billion cyber threat events in the three months to September 2026, up 14.45 percent on the previous quarter.
A deepfake ad does not break into M-PESA. It persuades a customer to open the door. No platform upgrade stops a person who sends their own PIN to a stranger.
What customers do to complete the defence
1. Stop. Ignore the countdown. Do not act on urgency from an online ad or an unfamiliar voice call. A recording played at a KICTANet and Safaricom webinar told listeners to weigh any request for money or details before acting. Do not send an M-PESA payment until you know who is asking.
2. Think. Check the Mouth, Voice, Promise signs. Reject any offer of free money, a doubled Fuliza limit or fixed returns. Safaricom lists fake Fuliza limit messages among the top scams targeting M-PESA users.
3. Verify. Use only official Safaricom channels: the MySafaricom app, the M-PESA app, safaricom.co.ke or customer care. Safaricom says it contacts customers only from 0722 000 000 and does not ask for personal information. Three more checks apply to traders and shoppers:
- Pay online through M-PESA or a payment provider rather than typing card details into a seller’s site.
- Confirm any change in supplier bank details with the supplier before paying.
- On public WiFi, pick the right network, check for HTTPS, use a VPN and switch off WiFi and Bluetooth when idle.
4. Report. Forward suspicious texts to 333, which the report confirms is free. Safaricom’s fraud awareness page tells customers to forward the fraudster’s number or message there. Lillian Maranga Manager Core Operation, Safaricom said wrong payments go to 456, where the system holds the money while Safaricom validates a reversal. Report fraud through the apps or by dialling *334#.
5. Refresh, do not buy. Dial *334#, choose Fuliza M-PESA, then Refresh My Limit. Safaricom says customers can refresh once every 30 days. Limits come from automated scoring, not from payment, and no website or person can raise them for a fee.
For Safaricom’s own guidance on scams that copy staff, read its fraud awareness hub and its notice on fake M-PESA messages.
