How to Report a Scam or Cybercrime in Kenya (and Recover Your Money)

Quick answer: If you have lost money, act on the money first — forward the M-Pesa confirmation SMS to 456 to request a reversal, and call your bank's fraud line to freeze the account. Then report the crime. For scams and online fraud, contact the DCI Cybercrime Unit on the anonymous toll-free line 0800 722 203. For hacking, account takeovers and other cyber incidents, report to the National KE-CIRT/CC on +254 703 042700 or +254 730 172700, or email incidents@ke-cirt.go.ke. Speed matters more than anything else.

What to do in 3 steps

1. Act on the money immediately. If you sent or were tricked into sending money on M-Pesa, forward the full M-Pesa confirmation SMS — exactly as you received it, unedited — to 456 to start a reversal. Safaricom can recall the funds if the recipient has not yet withdrawn them and you act within the reversal window. If the money left a bank account or card, call your bank's 24-hour fraud line at once and ask them to freeze the account and recall the transfer.
2. Report the crime. For scams, online fraud, SIM-swap and impersonation, call the DCI Cybercrime Unit on the toll-free, anonymous line 0800 722 203. For hacked accounts, business email compromise, ransomware and other technical incidents, report to the National KE-CIRT/CC on +254 703 042700 or +254 730 172700, or email incidents@ke-cirt.go.ke. You can also report in person at any police station and ask for an OB (Occurrence Book) number.
3. Preserve evidence and follow up. Do not delete anything. Save the messages, transaction IDs, phone numbers, profiles and receipts before they disappear. Get your OB number and the name of the officer handling your case, and keep checking in — recovery and prosecution depend on a documented trail.

How recovery actually works

When you forward the confirmation message to 456, Safaricom's system automatically checks who is asking, whether the request is inside the allowed time window, and whether the recipient still has enough balance to refund you fully or in part. If those checks pass, the funds can be reversed and you will get an SMS confirming the outcome. Bank and card recoveries follow a similar logic: the faster the bank can flag and freeze the receiving account, the more likely it is the money is still there. None of this is guaranteed — organised scammers move money through several accounts fast — but reporting still matters even when your own money is gone, because it helps investigators link cases, shut down mule accounts and warn others.

What to have ready

• The M-Pesa confirmation SMS and transaction ID (or bank transfer reference)
• The phone number, paybill, till or account number the money went to
• Screenshots of the chats, calls, emails, profiles or websites involved
• Dates, times and amounts of every transaction
• Any names, links or social media handles the scammer used
• Your own ID and the phone number tied to the affected account

Frequently asked questions

Can I get my M-Pesa money back if I was scammed? Sometimes — but only if you act before the fraudster withdraws it. Forward the confirmation SMS to 456 straight away. If the recipient has already cashed out, a reversal will not succeed, but you should still report so the account can be flagged.

Is the DCI line really anonymous and free? Yes. The DCI states that 0800 722 203 is toll-free and that officers will not ask for your name, location or phone number. Use it to report a scam without fear.

What is the difference between the DCI and KE-CIRT? Think of the DCI Cybercrime Unit as the police you report a crime to — for fraud, theft and impersonation. KE-CIRT/CC, run by the Communications Authority, is the national technical response team for incidents like hacking, data breaches and malware. For most scams, start with the DCI.

Sources

• Directorate of Criminal Investigations (DCI Kenya) — toll-free crime reporting line 0800 722 203
• Directorate of Criminal Investigations — official contact page
• National KE-CIRT/CC — Report an Incident (hotlines and incidents@ke-cirt.go.ke)
• Safaricom — M-PESA Reversal terms and process (forward SMS to 456)
• Africa Cybersecurity Report 2025 (Serianu) — Kenya's KSh 29.9 billion in cyber losses
• Communications Authority of Kenya — about the National KE-CIRT/CC and threat-event data

For step-by-step reporting and recovery guides covering other countries, see our cybercrime help hub.