Safaricom reported an 82 per cent reduction in fraud incidents for the 2026 financial year and said it recovered 46 per cent of reported fraud losses, but the company fell short of its own 90 per cent cut target, according to its 2026 Sustainable Business Report.
The report says threat actors increasingly use artificial intelligence to accelerate attacks, including deepfakes and more convincing phishing and social-engineering campaigns, with physical, in-person social engineering identified as the most significant contributor.
In the same year Safaricom completed the Fintech 2.0 upgrade of the M-PESA platform, moving to a micro-services architecture that raised transaction capacity from 4,500 to 6,000 per second and achieved 99.999 per cent availability, while embedding AI-enabled fraud detection and real-time transaction monitoring.
The Daraja 3.0 release added security APIs for fraud detection, prevention and identity verification, supporting 149,834 M-PESA developers and 89,780 integrations.
Safaricom’s 24-hour Cyber Defence Centre was upgraded with a next-generation Security Information and Event Management platform, expanded AI-powered defence and an in-house threat-intelligence platform, now running more than 70 AI and machine-learning models, with agentic AI moving from pilot to production.
The company works with the Central Bank of Kenya, the Communications Authority, National KE-CIRT/CC and Vodacom Group on sector-wide cybersecurity simulations.
Independent auditors have certified Safaricom’s security and privacy systems against ISO 27001, ISO 27701, PCI DSS and GSMA Mobile Money, and the firm plans to pursue ISO/IEC 42001 certification for AI management systems in FY27.
Data-minimisation measures introduced in March 2026 now mask sender details for person-to-person and customer-to-business payments, protecting more than 40 million subscribers; for merchant payments 94 per cent of customer names and mobile numbers are masked, with work continuing towards full coverage.
Group CEO Peter Ndegwa wrote in the report that technology is only part of the answer and that trust is earned through how the company behaves.
Interpol figures show a 327 per cent rise in SIM-swap fraud in Kenya in 2025, with over 123,000 fraudulent SIMs and about KSh491.6 million drained from mobile wallets, while the Communications Authority recorded about 2.7 billion cyber-threat events in the three months to September 2026, up 14.45 per cent on the previous quarter.
Safaricom advises customers to ignore urgent requests, verify communications through official channels, report suspicious messages to 333 for free and use *334# for fraud reporting and limit refresh, with Manager Core Operation Lillian Maranga noting that wrong payments are held at 456 while Safaricom validates a reversal.
