The Government has warned Kenyans against spoofing scams, where criminals impersonate banks, Safaricom and DCI to steal personal information, banking credentials, OTPs and money.
How spoofing scams work
Spoofing is a technique where criminals falsify the phone number or sender ID displayed on a victim’s phone to make a call or message appear to come from a trusted person or organisation.
In call spoofing, a fraudster can manipulate the caller ID so that a victim sees the number of a bank or other legitimate institution instead of the actual number used to make the call.
The fraudster may then claim that the victim’s bank or mobile money account has been compromised and ask for personal details, PINs or one-time passwords, or instruct the victim to transfer money to an account or M-Pesa number to supposedly secure their funds.
According to the Ministry of Interior and National Administration, some criminals have been using spoofed numbers associated with banks, Safaricom and the Directorate of Criminal Investigations (DCI).
They may also make follow-up calls while posing as DCI officers investigating the alleged fraud, leading victims to disclose more information or lose more money.
SMS spoofing works in a similar way where criminals manipulate the sender name or number so that a fraudulent message appears to have come from a genuine bank or mobile service provider, sometimes appearing in the same conversation thread as legitimate messages.
The messages may contain links directing victims to fake websites where they are prompted to enter banking credentials, allowing criminals to access their accounts.
Do not to rely on caller IDs or SMS sender names alone
The Government has urged Kenyans not to rely on caller IDs or SMS sender names alone, as they can be spoofed.
Members of the public have been advised never to share PINs, passwords, OTPs or card details over the phone or through text messages.
Anyone who receives a suspicious call claiming to be from a bank or government agency should hang up and contact the organisation using its official contact details.
The public has also been urged to avoid clicking links in unexpected messages, enable multi-factor authentication where possible and report suspected spoofing attempts to their mobile operator and the organisation being impersonated.
